cant access safe mode due to a virus/malaware

mambo69

Help!!

My netbook shut down on me, then when it rebooted I get some stupid message telling me to pay €100 for a code to enter my pc, checked online and seems to be malaware

How can i access safe mode so i can run my antimalaware, virus checked etc?? hitting F8 is having no effect, i can only acccess the bios on F2

Any help is good, I also have a laptop so if i need to download and boot from disc I can, as i do have an external drive.

Netbook is a Samsung NC10 running XP

ta

santer_2

Choose any of these

http://www.google.co.uk/search?q=rescue+disc&ie=utf-8&oe=utf-8&aq=t&rls=Palemoon:en-US:official&client=firefox-a

They will run before windows loads

The Kaspersky instruction are here

http://www.howtogeek.com/howto/36403/how-to-use-the-kaspersky-rescue-disk-to-clean-your-infected-pc/

mambo69

I have an external USB drive, for some reason i load Kapersky but then i just keep getting a message no bootable medium found!

mambo69

Can i use a disc to boot up XP so i can get on and then run the malaware and virus software i have? I dont want to reinstall XP as i have data i dont want to lose

RussJK

You should be able to run an antivirus scan using the USB drive. Obviously you'll have to make it from another computer:
List of various bootable antivirus programs: https://forums.moneysavingexpert.com/discussion/comment/41653210#Comment_41653210
and Unetbootin, the program to put put this on a USB properly: http://unetbootin.sourceforge.net/

For this type of malware (ransomware) I'd recommend Panda & Dr Web first. If the ransomware sits on the MBR, then both companies have a good track record of restoring the original MBR by removing the malicious code that's been inserted before the normal/legitimate code.

Another method would be to get a 2.5" external caddy/casing/enclosure (£5) and stick your netbook's hard drive in it, then you can run all the scans you want from another computer. The scans won't necessarily make the netbook bootable though, and/or might replace the MBR instead of repairing it (which would make it harder to reinstall using the recovery partition). Realistically it'd be better to use this method to get all your data off, then put the drive back into the netbook and run the recovery/restore partition and reinstall.

Alternatively, if you write out fully - or even better take a photo - of the message and post it here, it's possible to track down a code for the screen you are getting. Does Windows load first and then the message? Or does the message appear during the early bootup sequence?

mambo69

the message appears during the boot up sequence. its after about 30 seconds, i can access F2 but not f8 to run safe mode

santer_2

If it will run, there is the repair install option

http://www.dougknox.com/xp/tips/xp_repair_install.htm

Note

[FONT=Arial, Arial, Helvetica]At this point an option to press R to enter the Recovery Console is displayed. Do not select this option.

http://support.microsoft.com/kb/917964

[/FONT]Windows XP repair feature won't delete your data, installed programs, personal information, or settings. It just repairs the operating system.

http://camtech2000.net/Pages/XP_Repair.htm

You will need the product key

RussJK

In that case I'd go with the Panda SafeCD first, followed by Dr Web LiveCD, as the infection will be on the MBR in that case and both companies warn against using standard tools in those cases,

e.g. the section beginning with "Trojan.MBRlock supersedes winlocks?":
http://news.drweb.com/?i=1706&c=5&lng=en&p=0

mambo69

Just some happy news we put a bootable version of Kaspersky onto a USB and it found and quarantined the little !!!!!!!

just running all my checkers now, but i am back on!!

santer_2

Thank You for posting the update

RussJK

Well done. These kinds of ransomware are more rare in the West, and more common in Russia.

Did it give a name to it?