Urgent help needed.... PCEU virus..

[CallmeGoose]

My missus encrypted gorvernment laptop has been infected with a PCEU virus. Essentially it puts up a window upon launching the system, and blocks all access to the hard drive..



Now this is where the unique problem comes in. My missus computer/hard drive is encrypted with Check Point Endpoint security, so even though ive followed all the existing guides ive found on google, none work as they cant actually see C: drive, due to the encryption.

No version of safe mode works, hitman bootable USB doesnt work, ERD commander doesnt work, MSDART doesnt work.

This would be a 30min fix if the dam hard drive wasnt encrypted, and its annoying as my missus needs to finish her work tonight and meet deadlines.

Putting the hard drive in a caddy and trying to access it on my laptop doesnt work as the computer cant see the drive.

Only option is for her to take it into IT dept in the morning on her day off. Anyone have any ideas? Im at my wits end with this one...

[DJ OD]

Tell her to stop watching porn on a work laptop...


DJ OD

[Zippeyrude]

I had this, arsehole as it stops access to windows

The way i fixed it was to connect usb devices and the iphone at bootup, this meant that when you closedown (via ctrl alt del task manager menu) it goes to the screen where it asks you for the option of 'close programs and force shutdown'.

From there, cancel and when in windows run malwarebytes.

Job done

[CallmeGoose]

cant even get access to task manager though :- (

[akimba]

We use safeguard encryption and your fucked dude, its a rebuild job :-( we havent been able to boot to any safe modes either when things go wrong

[Zippeyrude]

Do you get the menu with ctrl alt del?

[big3card]

Ive also had this were malwarebytes wouldnt remove it, the way round if i remember was to use spotmau and add a new admin account and attack it from the new account as it simply blocks access to the original

[Nibb]

Can you boot Hirens from the DVD drive then run combofix via the DOS utilities?

[akimba]

The hard drives encrypted so when you login you log in to its kernal not windows and its kernal passes thru the credentials to windows so you cannot access drive at all without loggin into the encryption kernal so no usb boot devices will work etc and also cos of the pass thru to windows you cannot get to safe mode :-(

[beansontoast]

It would really stick in my craw, but in this case would it be worth paying for the dirty f*ckers solution to get past it on boot up?

[CallmeGoose]

Apparently even paying the 'fine' doesn't solve the virus, and it stays on the screen


Sent from my iPad using Tapatalk HD

[CallmeGoose]

When I press control - alt - del, the menu windows menu comes up, but when I press task manager it takes me back to the fine page, obviously with task manager running in the background


Sent from my iPad using Tapatalk HD

[liveseytowers]

Not quite sure I'd be doing all that stuff to try and fix it if it's a government laptop. They will probably have software logging what devices you've plugged in etc and it's probably against company policy plugging all that in. I normally say if a user is stupid enough to get a virus like this then they have to put up with some disruption.

How did it get on there?

[big3card]

when task manager is open there is the file tab in the top left of the pain to open the run command ... cant you do anythin from there?

[gaz188]

If you have XP or Win 7 installed try pressing F8 when loading the operating system. Choose last good boot configuration, ( i think that's what is says in the list ) and see if that works. I know If you have Windows 7 installed with more than one account on the PC, log in as Administrator, or someone else who has administrator privileges. you should be able to log in okay in as the virus only affects the user who was logged in when the PC was infected, Run system restore from system tools if you have not turned it off.

Hope it helps.

[CallmeGoose]

Windows 7 enterprise. I've got access to the registry via Microsoft diagnostics and recovery toolset.

One of the guides told me to look under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ for a "shell" file and click "modify"

The entry should be "explorer.exe" but instead it is cmd.exe /k start cmd.exe

Sent from my iPad using Tapatalk HD

[CallmeGoose]

when task manager is open there is the file tab in the top left of the pain to open the run command ... cant you do anythin from there?

Task manager opens but it is immediately blocked by the fine window


Sent from my iPad using Tapatalk HD

[Zippeyrude]

When I press control - alt - del, the menu windows menu comes up, but when I press task manager it takes me back to the fine page, obviously with task manager running in the background

ok so you do not go into task manager, you just need the alt ctrl del menu (that has the option to shutdown)

when the pc boots, insert a few usb devices (iphone, flash drives with autorun content if possible).

you need to get the timing right. the usb devices install.

then from the ctrl alt del screen, shut down and catch the shutdown process that will try and force the shutdown of the open usb apps. cancel this and it will leave you in the windows environment, ready to use malware bytes

trust me it works, took me hours to figure the workaround and loads of attempts to get the usbs to work, but it did....

[CallmeGoose]

Mate your an absolute star! Pm me your PayPal address. Im going to send you five quid to get yourself a pint! The missus is well chuffed...


Sent from my iPad using Tapatalk HD

[Zippeyrude]

Mate your an absolute star! Pm me your PayPal address. Im going to send you five quid to get yourself a pint! The missus is well chuffed...

cool beans, pleasure - glad i could help mate