Computer taken over by scammers

grumpycrab

I've found somebody who allowed their computer to be remote controlled and locked and asked for £200 to unlock. Is this is reinstall job? If I put the hard drive in a caddy can data files be recovered? Thanks.

esuhl

As with all malware, you can probably get rid of it without reinstalling the OS, but at least with a reinstall you can be 100% sure.

So long as the PC you connect the caddy to is up-to-date with an antivirus, etc. and you scan the files first, it shouldn't be a problem to access them that way.

grumpycrab

Thanks. Guess I can try a malware program from a boot disk. Any recommended?

ossie

malwarebytes

Tiexen

If its the Crypto Locker virus is not that it's hard to get rid of. It's that all your data files - pictures, documents, etc. will be encrypted, and are not able to be unencrypted without the key provided once you pay the ransom. It will also encrypt things on attached storage or network shares. Simply having an external USB drive connected with your data backed up on it won't be enough - those files will be encrypted also

grumpycrab

Tiexen wrote: »

If its the Crypto Locker virus...all your data files - pictures, documents, etc. will be encrypted,

That's a !!!!!!. I'll get hold of the computer this week and check it out. Nasty.

aerostar

Do NOT have any other computers on wireless or cabled and connected to the your network at the same otherwise you may well find those compromised as well !!!!

esuhl

grumpycrab wrote: »

Thanks. Guess I can try a malware program from a boot disk. Any recommended?

I wouldn't bother with a boot disk (unless the malware prevents you from using the system normally). But I'd definitely try several different anti-malware apps. Various different ones seem to pick up different things...

My suggestions would be:
Avast antivirus (or whatever antivirus is installed).
MalwareBytes' Anti-Malware
Spybot - Search & Destroy
TDSSKiller
adwCleaner
ComboFix
HijackThis

bluesnake

this chap has put in quite a bit of effort in removing unwanted stuff, and you may find your fix there. However there are some items where the encryption is too good and you have to either pay up, or loose it

https://www.youtube.com/results?search_query=britec09

closed

who did it, and how is it locked?

The 'we're microsoft' scams usually don't do any damage, but pretend to have found virus problems which are really trivial event log errors, and charge to clean the logs

kasperky rescue cd is often useful if it really is infected.

Sparx

Boot into safe mode, run CCleaner (check startup items) and remove anything suspicious. Then run Malwarebyte's Anti-Malware and a full a virus scan.