Afternoon all

 

My dad just rang to say he opened an email that flashed up loads of porn and then a banner came up saying that his machine was locked and they wanted £100 to release it!!! (this after me saying to him just two days ago not to open anything he didnt know who it was from!!!)

 

Help needed please

 

kit

Sorry to hear about your dad's computer.

 

Have you tried rebooting it.

 

Do not pay any £100 to these arseholes, they are simply common thieves and nothing more.

 

Hope you get it sorted.

I told him to keep rebooting it and it should hopefuly go away! He knows not to pay anything but just wish he would listen to me!!!...anyone would think he was a bit dim!!!

 

Kit

I would say by re-booting the system should get rid of the stuff he doesn't want.

There might be a worm type program, that re-boots itself when system is re-booted, but hopefully not in your Dad's case. 

Had one of these dam things on a work laptop.

 

It would boot into Windows and then start a full screen page that was impossible to get out of. Tried alsorts to stop it from running but in the end up we had to just flatten the computer and re-build the system.

 

I would recommend a re-build

Sonix...Rebuild?...behave yourself!!! Im sure if he doesnt get it working himself today he will just give it to his super duper IT mate who'll fix it...he away on his hols at the mo though!!!

 

kit

See if he can boot it in safe mode and do a system restore.

Sonix...Rebuild?...behave yourself!!! Im sure if he doesnt get it working himself today he will just give it to his super duper IT mate who'll fix it...he away on his hols at the mo though!!!

 

kit

 

The thing is with these type of Internet nasties they generally leave exploits open when removed anyways. Maybe I am just a freak but I know if I got something like that even if the best Antivirus in the world told me it were removed I would install fresh. 

 

Always use a Sandbox to open files that maybe suspicious

See if he can boot it in safe mode and do a system restore.

 

That would work too

All working now He just kept rebooting it until it went away and he will drop it off at his mates when he's back just to make sure all is good!!...Maybe now he will listen to me!!!

 

Cheers all

 

Kit

All working now He just kept rebooting it until it went away and he will drop it off at his mates when he's back just to make sure all is good!!...Maybe now he will listen to me!!!

 

Cheers all

 

Kit

 

I really find it hard to believe it had gone by continually rebooting.... Just be safe.. Especially if you are shopping online etc..

At the very least I would load Malwarebytes in safe mode and do a full scan; it might have any number of nasty surprises, data loggers, spambot, even be used to store child porn images for remote access.

What anti virus software is he running.

Heard only the other day (think it might have been on here) that rebooting it will often get rid of it. He's going away for a few weeks so he's not using it til he gets back then his mate can sort it proper to make sure theres no nasty suprises.

 

kit

Best of luck removing that, they can be done but they ain't easy by an stretch. Formatting usually the best option. One solution kills all issues. 

Full scan with superantispyware and malewarebytes should clear it.

 

Then get a decent anti virus

Ive told him not to use it until his mate gets back from his hols then he can sort it out

 

Thanks for all the help folks.

 

kit

Full scan with superantispyware and malewarebytes should clear it.

 

Then get a decent anti virus

 

 

Might, might not though.

 

AV doesn't tend to stop these things getting in.

 

The hard part is trying to get MWBytes on there once this is on, lately I've been pulling the hard drive and scanning it on another PC, which seems to do the job.

Obviously thats a little more advanced than the average user can handle and requires some extra hardware.

If you cant fix it with MWB, you run to www.bleepingcomputer.com  and ask for help using SDFix and Combofix.

 

You can also boot of of some Windows Install disks and then run MWB etc, from a USB stick.

Have a look on http://us.norton.com/security_response for a remover. There's also MBAR ( Malware anti root kit) ,RogueKiller and Adwcleaner . Not forgetting the old faithfull -SPYBOT .