Digital Spy

Search Digital Spy
 

DS Forums

 
 
 

locked files due to a virus


Reply
Thread Tools Search this Thread
Old 01-05-2012, 22:06
milosimab
Forum Member
 
Join Date: Sep 2007
Posts: 1,472

hi - hope someone can help me
I have a windows vista laptop. I had a virus which displayed a screen saying the Yorkshire police had locked my pc. I managed to restore my system to an earlier date and can now access the laptop. However it has locked most of my files and favourites. All my Itunes files in the library are prefixed with Locked and the same with amazon files and my favourites. Can anyone advise me if there is anyway I can access my files - I have googled it but I found the answers quite complex and I am not too computer literate. Any help appreciated.
milosimab is offline   Reply With Quote
Please sign in or register to remove this advertisement.
Old 01-05-2012, 22:25
psionic
Forum Member
 
Join Date: May 2002
Location: Crystal Palace TX
Posts: 18,581
Have you tried starting your computer with 'Safe Mode with Networking' from the Windows boot menu? Keep tapping f8 when you turn on your computer until you see the menu.

Once running in safe mode with networking, try downloading and installing the free version of malwarebytes from http://www.malwarebytes.org/products/malwarebytes_free
Install it. Let it update itself, then run a full scan. Remove anything it finds.

If you cannot install malwarebytes, try installing Rkill first from http://www.bleepingcomputer.com/down...ti-virus/rkill

Good luck
psionic is offline Follow this poster on Twitter   Reply With Quote
Old 01-05-2012, 23:21
milosimab
Forum Member
 
Join Date: Sep 2007
Posts: 1,472
Have you tried starting your computer with 'Safe Mode with Networking' from the Windows boot menu? Keep tapping f8 when you turn on your computer until you see the menu.

Once running in safe mode with networking, try downloading and installing the free version of malwarebytes from http://www.malwarebytes.org/products/malwarebytes_free
Install it. Let it update itself, then run a full scan. Remove anything it finds.

If you cannot install malwarebytes, try installing Rkill first from http://www.bleepingcomputer.com/down...ti-virus/rkill

Good luck
Thanks for this - I will give it a try. hopefully it will work.
milosimab is offline   Reply With Quote
Old 01-05-2012, 23:36
whoever,hey
Forum Member
 
Join Date: Mar 2006
Posts: 29,226
I know someone thats had these same symptoms, and malwarebytes cleaned it.
whoever,hey is offline   Reply With Quote
Old 02-05-2012, 00:01
max99
Forum Member
 
Join Date: Jun 2005
Posts: 8,610
This guide explains how to remove it using rkill and Malwarebytes. Ignore any other programs or helplines which claim to automatically remove it, as they are usually worthless.

However... this appears to be a new variant of this type of malware and it's not clear at present whether the 'locked' data files have simply been renamed or something more sinister. There should be more info by tomorrow.
max99 is offline   Reply With Quote
Old 02-05-2012, 00:28
LION8TIGER
Forum Member
 
Join Date: May 2005
Posts: 7,075
This guide explains how to remove it using rkill and Malwarebytes.
Was going to post that guide to the OP but psionic beat me to it with his post which is the same thing really. Good guide, easy to follow.
LION8TIGER is offline   Reply With Quote
Old 02-05-2012, 23:24
Tinwreckingood
Forum Member
 
Join Date: Dec 2007
Posts: 219
I had this problem last year and it was a nightmare until I found this same solution online,

( there are a lot of con merchant .coms out there with fake cures but you can tell those by their childish / silly names

I already had Malwarebytes installed ( that's the bit that takes the longest) so just had to install rkill,

Sorted it first time .......and it's not been back since

Thank you Mr rkill ... you are a star !
Tinwreckingood is offline   Reply With Quote
Old 03-05-2012, 14:38
max99
Forum Member
 
Join Date: Jun 2005
Posts: 8,610
Advice here regarding the locked files (page 2 onwards):

https://community.mcafee.com/thread/...rt=10&tstart=0

If you don't know what you're doing, back up the encrypted files first.
max99 is offline   Reply With Quote
Old 04-05-2012, 15:24
milosimab
Forum Member
 
Join Date: Sep 2007
Posts: 1,472
Hi all

Thanks for your help - I used a combination of the guide which seemed to clean up my pc and find all the infected files and clean up the registry. The files were still locked so I followed the url on Mcfee forum - I used a book I had dowloaded on my kindle as an original which was also locked on my pc and then entered it into the DR Web encryptor and it found all my locked files and unlocked them. It does leave the original locked onces which I had to delete later but that was the least of my worries. I am very relieved and will now back up. Greatly appreciate everyones help.
milosimab is offline   Reply With Quote
Old 04-05-2012, 15:28
max99
Forum Member
 
Join Date: Jun 2005
Posts: 8,610
Glad you got all your files back and thanks for lettings us know.

Now, backup your files. Next time you may not be so lucky...
max99 is offline   Reply With Quote
Old 04-05-2012, 19:26
psionic
Forum Member
 
Join Date: May 2002
Location: Crystal Palace TX
Posts: 18,581
Direct link for the decryption tool. ftp://ftp.drweb.com/pub/drweb/tools/matsnu1decrypt.exe

As mentioned above it needs one copy of a non-encrypted data file to compare with an encrypted version of the same file, in order to decrypt all the others.
psionic is offline Follow this poster on Twitter   Reply With Quote
 
Reply



Thread Tools Search this Thread
Search this Thread:

Advanced Search

 
Forum Jump


All times are GMT +1. The time now is 14:44.