PDA

View Full Version : Ransomware Attack (please help me avoid this nightmare happening again!)



PaulyJ
2009-08-16, 02:32
Hi all,

Well it was only the second ever time i have had any problems with any form of attack in about 8 yrs, so maybe i am quite lucky but this last one nearly had me wiping precious data, via a complete re-install, such was it's impotence causing symptoms.

I was surfing the web as normal, and Spybot kept asking me to allow registry changes, totally out of the blue so i declined them, until a spybot window with a greyed out "decline change" button appeared, i had no choice other than clicking the close window button on the top.

Anyway i knew i had a problem because a few weeks earlier i had seen the same process minus the greyed out button, whilst being attacked by an automatic, unknown by me, installation of a program called Microsoft Security Centre Pro. Which caused all other exe's to be deemed as infected and unable to be run.

So i rebooted to find a program called "Total Security" greeting me with the most urgent message splashed all over my desktop as a wallpaper, "Your computer is at risk bladi bah blah"

Assuming i could fix this as i had previously i headed for the Task Manager to kill the program, but unlike before it was dis-abled.

I don't have much technical knowledge of these things, i could not get online, and i could not run anything other than this ransomware, even if i was desperate enough to give into this attack and pay them i couldn't of because it would not let me run the app that connects me to the net. Bit of a own goal for them.

So i was about to re install Xp and i thought i would see if i could search for Total Security.exe, to my surprise i could run explorer and find i found the folder Total Security in AllUsers.Winnt and 3 files inside one an exe named something like 101747577.exe and i tried to delete it, but windows said i could not. I was able to delete the other 2, but they came straight back.

I rebooted and for some reason i cant fathom, Total Security was not running, i could use all my programs and i dl'd a reg fix for Task manager, and Dbam to get rid of the malware.

I have followed the procedures described in the "How did i get infected in the first place" thread but i also wanted to tell my specific story to see if anyone could help me from getting saddled with this nightmare again.

Plus i was surprised to find no reference for "Total Security" in reference to malware from a google search and just wanted to tell all how i was able to disable it.

Thx for reading

tashi
2009-08-16, 02:41
Hello PaulyJ :welcome:

In order for someone to advise you they will need to take a look at the system. "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Please produce the log and start a new topic with a link back to this one.

Cheers.