Fake Police Popup

Hello

im having a big problem in one of my users there is a virus that when i boot the computer and my computer is completeley bootet.

Then my windows start menu bar etc every thing from windows dissapeares and i only see my background pickture.

then a big webrowser shows up in full screen.

that is pretending like they are from the belgium cyberpolice and that i broke a law the title is in dutch and the rest of it is french.

they want me to pay of course it's fake they want me to pay with a paysafe card or ucash €100.

the anti virus doesn't do any thing about it NOTHING.

im happy i have two diffrent users.

please help me.

Find more posts tagged with

Comments

rootkit

Hello

Welcome to the forums!

In order to be able to further investigate the reported situation we need a bit more information from your computer as follows:

. A BDSYS log;

[how to GENERATE A BDSYS LOG]

. Save and extract the BDSYS tool to a location of your choice:

http://www.bitdefender.com/files/Knowledge.../BDSysLog_i.exe

. Make sure you close all active applications and then run "BDSysLog_i.exe"; If you receive a firewall

alert,select to Allow the application to connect;

. Click the "Create log" button to start generating the

log; A progress bar is indicating that the tool is creating the report;

. When the small window appears with the message "Log

saved" then the report is complete and a new file named "bdsyslog.zip" has appeared on your Desktop;

. Upload that file on

http://www.sendspace.com

http://www.mediafire.com

and send me a PM with the download link.

If you were already asked to generate the log file, disregard the message above and just post the ticket ID.

IMPORTANT:

.During this process the Real Time Protection in Bitdefender must be temporarily disabled;

.If you receive a Bitdefender Firewall alert to inform you that BDSysLog_i.exe tries to connect to the internet,then you need to select Allow;

[how to DISABLE THE ANTIVIRUS PROTECTION in Bitdefender 2012]

In order to disable the antivirus protection, please open Bitdefender and click the "Settings" button in the upper side part of the interface"; In the new window go to "Antivirus" > "Shield" tab and click on "ON" under On-access scanning. Select the time interval that suites your troubleshooting needs and click "OK". The On-access scanning should be enabled back after finishing the troubleshooting procedure.

[how to DISABLE THE ANTIVIRUS PROTECTION in Bitdefender 2013]

We will get back to you as soon as the analysis is complete.

Have a nice day.

rootkit

Hello

The file was sent to our labs, I will get back to you soon with the results.

Take care.

schockie

sigh ....

rootkit

Hello,

Thank you for your patience!

We have analyzed the scan log you have sent us. In order to remove all infected objects from your computer you need to perform the following steps:

. Restart the computer in Safe Mode With Networking;

[How to restart in SAFE MODE With Networking]

- Restart the computer;

- Press the "F8" key several times before Microsoft Windows begins to load; you need to press "F8" until you will be displayed a text menu;

- Select "SAFE MODE With Networking"

Download and install the software and then run it to clean your computer's registry and temporary files:

http://download.piriform.com/ccsetup322.exe

http://www.piriform.com/docs/ccleaner/usin...gistry-cleaning

Once the cleaning is complete it's recommended to restart your computer(again in Safe Mode).

If you have a registry cleaner already installed, you can use that one.

Open Windows Registry Editor

[how to open Windows Registry editor]

http://techie-buzz.com/how-to/how-to-use-regedit.html

and locate the following keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

and

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

and delete all the subkeys.

[how to CLEAN REGISTRY ENTRIES]

Warning: Please make sure to follow the exact steps detailed below and to delete the exact keys/values detailed. Altering another section of your Windows Registry may render your system unusable.

In order to clean your Windows registry section please follow the steps below:

- click "Start" and then select "Run..."; (on Windows Vista/7 type "run" in the "Start Search" box and hit Enter)

- type "regedit" in the run edit box and hit "OK" to open the Registry Editor;

- browse to the registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

and

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

- delete all the keys under this key there should be a lot of .exe entries

- after you delete the exact key(s)/value(s) written above you may close Registry Editor.

The second key is only for 64 bits systems.

[How to check if your computer is a 32bits or 64bits]

Please right click on the icon MY COMPUTER / COMPUTER located on your desktop and go to PROPERTIES. There, under system information and computer information you will see a notification about your computer being a 64bits. If none ( nor one about 32bits ) then your computer is a 32bits one.

Note:

- if using Vista or 7 you will see if your computer is either 32bits or 64bits.

- if using XP you will only see it mentioned ONLY if your computer is a 64bits.

If the situation persists or you require further assistance please do not hesitate to contact us.

Have a great day!