Solved Your computer is locked. Metropolitan police

[pcmatty]

Hi all
Help my laptop has been locked by what i think is a trojon thats got through my firewall

It says

Your computer is locked has been locked by the automated information comtrol system AICS

On the top right blue box says METROPOLITAN POLICE.

and underneath it says ways to pay. Epay , paypoint , payzone.

Im not gonna pay. Is it the police or have i been hacked ?

Plz can someone help me ;(

Matt

 

[pcmatty]

Btw ive sent this message with my iphone.
I do have a pc but dnt know what to do.

Matt

 

[Hanna 1]

Matt
Download WDO (windows defender offline) from another computer and make the steps in the tutorial to find out if your computer is compromised. Remember to select 32 or 64 bit

What is Windows Defender Offline?

 

[Sir George]

Hi all
Help my laptop has been locked by what i think is a trojon thats got through my firewall

It says

Your computer is locked has been locked by the automated information comtrol system AICS

On the top right blue box says METROPOLITAN POLICE.

and underneath it says ways to pay. Epay , paypoint , payzone.

Im not gonna pay. Is it the police or have i been hacked ?

Plz can someone help me ;(

Matt

Go to the following site and follow the instructions;

Remove METROPOLITAN POLICE Ransomware (Uninstall Guide)

HTH

 

[gregrocker]

I would still first run Defender Offline and Malwarebytes in Safe Mode.

Apparently the malware creators have responded to the fix in the post above and made changes reflected in the comments to the fix. So read them thoroughly to see newer locations for the registry fix.

 

[pcmatty]

It says i cnt run windows defender in safe mode.
SIr george
Ive tried that solution u said but it dnt pin point where the trojon is
I tried looking at the shell file it just says explorer.exe
Cnt see where it is.

Also tried running windows defender on my user account on laptop but as i just go to open it the pc lockup appears.

Cnt get mc afee loaded up either

Matt ;(

 

[gregrocker]

Did you even read the link Hanna1 provided? What is Windows Defender Offline? You must burn or write Windows Defender to a CD or flash stick and boot it to scan.
How to Boot your Computer from a Bootable CD or DVD

Try Malwarebytes in Safe Mode. I already advised you on this and you ignored it. You must be thorough.

MucAfee is the worst AV crapware out there, as bad as an infection itself. Uninstall it and install Microsoft Security Essentials as soon as you can get into Win7 or in Safe Mode , run a full scan.

 

[pcmatty]

In safe mode i try to run windows defender but i get this

The ver of the file is not compatable with the ver of the windows your running check your computers system info to see whether u need an x86 (32bit) or x64(64bit)

 

[gregrocker]

Again, you will need to burn Defender to a CD or write it to a flash stick using another computer. Read how in the link provided. First determine if you have Win7 32- or 64- bit by looking at Control Panel>System.

Also in Safe Mode install and run a full scan with Malwarebytes. See if you can download and install it in Safe Mode with Networking. If not download it to a stick or CD and transfer it to problem PC in Safe mode to install and run it.

 

[Hanna 1]

Greg, I have directed matt to the site and to follow instractions and in red i've marked the 32 or 64 bit to download cause i have seen matt's system specs which indicate clearly 64bit.
Mat, You have to download the 64bit, but you have to follow the instrutions then you can burn the downloded file on a clean machine then put the said disk and boot with it.it doesn't matter to go in safe mode because the machine is booting from the cd.and i approve and second the malwarebytes anti malware proposed by gregrocker, which can be installed in safe mode after running WDO and rebooting.

 

[pcmatty]

I been running malwarebytes for 37mins so far nothing found.

 

[pcmatty]

Greg ur saying mc afee is crap?
I thought it was the best anti virus ever.

 

[pcmatty]

Hanna heres the problem
My laptop is windows 7
My pc is windows vista
So how is me putting windows defender on a flash drive on my pc going to cure the problem on my laptop ?
I installed the correct windows defender exe
It says mssstool64
I clicked on it thats where it says the following

"The ver of the file is not compatable with the ver of the windows your running check your computers system info to see whether u need an x86 (32bit) or x64(64bit)"

matt

 

[Hanna 1]

Matt. you have to burn the downloaded file on a 64bit machine.
We are triing to help you with our humble but trusted solutions.
MBAM takes some time for the scan.
If you are certain of your thinking, you can try, but poste back your results.

 

[pcmatty]

Yes i know u ppl are helping me im not the brightest plz be patiant.
Malwarebytes still scanning after 55 mins now found 4 things in results.
Pup bundle installer. OI
Trojan agent
Trojan agent.ck
Trojan agent.gen
Should i hit remove selected ??
Pup bundle installer wasnt selected.
Matt

 

[Hanna 1]

yes you can remove the selected files and after that you have to run mbam a second pass maybe the program can catch more

 

[pcmatty]

I hit remove
Doing another scan.
U think them trojans i removed might has resolved it ?
I still running in safe mode with networking
Matt

 

[pcmatty]

Dammm after 2 runs of mbam it still hasnt worked. ;(
Matt

 

[Sir George]

It says i cnt run windows defender in safe mode.
SIr george
Ive tried that solution u said but it dnt pin point where the trojon is
I tried looking at the shell file it just says explorer.exe
Cnt see where it is.

Also tried running windows defender on my user account on laptop but as i just go to open it the pc lockup appears.

Cnt get mc afee loaded up either

Matt ;(

The link I provided has an update at the bottom. This is the update information;

"I fixed this by the following:"

As well as starting explorer and regedit at the command line also start msconfig. Select the Startup tab. It can be difficult to spot although it stuck out for me as having an absurd name, there can be more than one entry. I think the best way is to look in the location column for any entry ending with something like a string of random letters/numbers.exe, mine also had a comma with a few letters after it as well to try to confuse me. Also look for any startup item with something similar in the 'Startup Item' column. Unticking these entries and applying should prevent it starting, and the entry should reveal the path to the .exe file which you can find and delete. Be warned you can stop important programs starting up, although they try to confuse you, mine was tagged as being from the IBM corporation!

You can't just delete startup entries from msconfig. You have to use regedit. In regedit I found the offending entries here:

HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Shared Tools \ MSConfig \ startupfolder

but they might also be here:

HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Shared Tools \ MSConfig \ startupreg

 

[pcmatty]

Thanz i will try tomw after work.
Will let u know.
Btw my laptop is brand new aswell
Alienware mx18
Matty