Solved Department of Justice Virus, can't boot into safe mode or command prompt

[meehashe]

I have the police / department of justice virus that has infected my pc severely. I am running xp. I can't boot into safe mode, or safe mode with command prompt. I tried downloading hitmanpro kickstarter and it won't boot to the flash drive (it attempts), but just loops back to the same message. I am stuck in a cycle and not getting anywhere.

 

[meehashe]

downloaded the reatogo-x software, burned to a cd, and attempted to boot to this cd. It said it was starting the program, etc -- but it brought me to the blue screen of death.

 

[TwinHeadedEagle]

Hello,



They call me TwinHeadedEagle around here, and I'll be working with you.



Before we start please read and note the following:

• At the top of your post, please click on the "Watch thread" button and make sure to check Watch this thread...and receive email notifications. This will send an email to you as soon as I reply to your topic, allowing me to solve your problem faster.
• Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process. Please do not perform System Restore or any other restore.
• Instructions I give to you are very simple and made for complete beginner to follow. That's why you need to read through my instructions carefully and completely before executing them.
• Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
  
• All tools we use here are completely clean and do not contain any malware. If your antivirus detects them as malicious, please disable your antivirus and then continue.
• If during the process you run across anything that is not in my instructions, please stop and ask. If any tool is running too much time (few hours), please stop and inform me.
• I visit forum several times at day, making sure to respond to everyone's topic as fast as possible. But bear in mind that I have private life like everyone and I cannot be here 24/7. So please be patient with me. Also, some infections require less, and some more time to be removed completely, so bear this in mind and be patient.
• Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. If you solved your problem yourself, set aside two minutes to let me know.
  
• Please attach all report using
  
  button below. Doing this, you make it easier for me to analyze and fix your problem.
  
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

Please print these instruction out so that you know what you are doing

• Download OTLPENet.exe to your desktop
• Download Farbar Recovery Scan Tool and save it to a flash drive.
  
• Ensure that you have a blank CD in the drive
• Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• Wait for the CD to detect your hardware and load the operating system
• Your system should now display a Reatogo desktop
  Note : as you are running from CD it is not exactly speedy
• Insert the USB with FRST
• Locate the flash drive with FRST and double click
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

 

[meehashe]

Hi TwinheadedEagle,
Thank you for your help!

1 - I burned the OTLPENet.exe to a CD on another PC
2 - Booted to the CD -- I could see it loading reatago (black screen w white font)
3 - It brought me to this screen (see attached)

 

[TwinHeadedEagle]

I would like you to follow these instructions and to burn HitmanPro.Kickstart

http://www.surfright.nl/en/kickstart

 

[meehashe]

I burned HitmanPro.Kickstart and ran the program. It took a long time, but I'm into windows now! I will await further instructions.

Also, I have windows 7, not xp.

Thanks!

 

[TwinHeadedEagle]

Why did you tell me you have Windows 7 but written XP above? Did you follow all instructions to remove ransomware?

 

[meehashe]

My apologies, since I wasn't able to get into my system at all that evening, I couldn't remember or validate what OS I had. I did just verify I have Windows 7 Home Premium.

Regarding your question. Yes, I ran HitmanPro.Kickstart. Since I am able to get into windows and the virus screen is not displaying -- I would imagine the virus may be removed -- but I was unsure if you wanted me to do any other steps.

Thanks.

 

[TwinHeadedEagle]

Good. Let's rescan your system one more time:



Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[meehashe]

The virus came back again when I rebooted my computer. I am in the process of running HitManPro again. Then, I will run FarBar.

 

[meehashe]

I ran HitManPro again...as soon as my system rebooted the MoneyPak virus is back. HitManPro did find some items and cleaned them....I'll run it again just to see if it grabs it a second time.

Ran HitManPro again -- "no threats found". Software forced a reboot when it was completed. Took me to the owner password screen, I entered my password. Virus came up immediately -- I did not click on anything. I powered down the system.

 

[TwinHeadedEagle]

Okay, we will need to work outside Windows. Is your Windows 32-bit or 64-bit?

 

[meehashe]

64-bit

 

[TwinHeadedEagle]

Please download Farbar Recovery Scan Tool x64 and save it to a flash drive.

• Plug the flashdrive into the infected PC.
• Restart your computer and tap F8 to bring up the Advanced Menu, then click Repair your computer
• Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.
• In the Choose Recovery Tool menu select Command Prompt.
• You will see a big black window with a blinking cursor (command prompt).
  
  
  
  
  
  Access the notepad and identify your USB drive
  
  In the Command Prompt please type in:
  

  notepad

  and press Enter.
• When the notepad opens, go to File menu.
• Select Open.
• Go to Computer and search there for your USB drive letter.
• Note down the letter and close the notepad.
  
  
  
  
  
  Scan with Farbar Recovery Scan Tool
  
  Once back in the command prompt window, please do the following:
• Type in e:\frst64.exe and press Enter.
  You need to replace e with the letter of your USB drive taken from notepad!
• FRST will start to run. Give him a minute or so to load itself.
• Click Yes to Disclaimer.
• In the main console, please click Scan and wait.
• When finished it will produce a logfile named FRST.txt in the root of your pendrive and display it. Close that logfile.
  
  Transfer it to your clean machine and include it in your next reply.

 

[meehashe]

Here is the logfile. Thanks!

 

[TwinHeadedEagle]

Once again we shall use FRST for additional checks. Re-run FRST/FRST64 the same way:

• Type User32.dll into the Search: field in FRST then click the Search Files button.
• FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.
• Please attach it to your reply.

 

[meehashe]

attached.

 

[TwinHeadedEagle]

Download attached fixlist.txt and save it to your USB flashdrive as fixlist.txt

>> Boot into Recovery Environment


Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....

• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your USB flashdrive.

>> Exit out of Recovery Environment and post me the log please.



Try to boot Windows normally...

 

[meehashe]

Attached is the fixlog.txt. I exited out of recovery and restarted. I am able to get into windows! The virus has not popped up.

 

[TwinHeadedEagle]

Very good. How is the situation now?