Solved ransomware and black screen upon start-up

Chameleon

New member
Local time
11:35 PM
Messages
17
Hi everyone. Not been on the forum for a while but need some help and figured this would be the best place to get it. Yesterday I experienced Ransom ware. I already had some removal instructions printed so followed those but I now have a black screen upon start-up.

What forum should I post onto please?
 

My Computer My Computer

OS
Win 7

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Custom Built
OS
Windows 10 Pro
CPU
AMD Ryzen 5 2400G Processor with Radeon RX Vega 11 Graphics
Motherboard
ASRock X470 Master SLI/AC AM4 AMD Promontory X470 SATA 6Gb/s
Memory
G.SKILL Ripjaws V Series 16GB (2 x 8GB) 288-Pin DDR4 SDRAM D
Graphics Card(s)
2047MB NVIDIA GeForce GTX 1060 6GB (EVGA)
Sound Card
Motherboard Built in
Monitor(s) Displays
Acer R240HY bidx 23.8-Inch IPS HDMI DVI VGA (1920 x 1080) Wi
Screen Resolution
1920 x 1080
Hard Drives
1TB Sandisk SSD PLUS (Main drive)
500 GB Seagate 7200 RPM (Games)
500 GB Western Digital 7200 RPM (Virtual Machines)
PSU
CORSAIR TX Series TX650M 650W 80+ Gold Modular Power Supply
Case
CORSAIR CARBIDE SPEC-02 Mid-Tower Gaming Case, Red LED Fan
Cooling
220mm, two 120mm, and four 60mm fans
Keyboard
Wired Dell keyboard
Mouse
Wireless Logitech mouse
Internet Speed
250mb down, 30mb up
Antivirus
Panda Cloud Antivirus
Browser
Chrome-ish x64
Other Info
Your awesome for reading this.
Hi everyone. Not been on the forum for a while but need some help and figured this would be the best place to get it. Yesterday I experienced Ransom ware. I already had some removal instructions printed so followed those but I now have a black screen upon start-up.

What forum should I post onto please?

What Ramsonware was it? Where did you get the removal instructions?
 

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Custom Built
OS
Windows 7 Professional x64
CPU
Intel i5 quad processor
Motherboard
DP67BG
Memory
16 GB
Graphics Card(s)
Radeon HD 5770
Sound Card
Realtek High Definition Audio
Monitor(s) Displays
Samsung SyncMaster
Screen Resolution
1920X1080
Hard Drives
WD 2TB (SATA Internal)
WD 1TB (USB External)
PSU
Corsair GS800
Case
Tower (Generic)
Cooling
3 Internal Fans
Keyboard
MS Wireless
Mouse
MS Optical Wired
Internet Speed
54 mbps
Antivirus
Emsisoft
Browser
IE-Version 9, Palemoon-Version 24.2.0
If you'd put the actual problem needing help in the title you'll get a lot more help from those who recognize the issue.

I'd run at least two of the bootable AV scans in Troubleshooting Windows 7 Failure to Start, try to get into Safe Mode with Networking at least to run Malwarebytes full scan, then try System Restore from the Win7 installation disk or System Repair Disk.

If this isn't enough run SFC /SCANNOW Run in Command Prompt at Boot from disk command line, then continue with all other steps from Troubleshooting Windows 7 Failure to Start leading up to if necessary rescuiing your files to do a perfect Clean Reinstall - Factory OEM Windows 7 which steps are the same for retail and will help you remember everything that needs to be saved, do a perfect install, then maintain it with everything that works best for Win7. Your "ransom" will then be the best install of Win7 one can have.
 
Thank you all for your advice, I'm most grateful. It was the Police/FBI type of ransomeware and the removal instructions I used came from (computerhope.com) I have removed the virus before using Malwarebytes. I should have stuck to that. During the time I was trying to sort my PC I was able to access the system via the Task Manager. Whilst doing so I discovered a brilliant piece of software called Registry Reviver, it sorted out my problem in seconds. Highly recommended.

Have a nice weekend.
 

My Computer My Computer

OS
Win 7
Google this software you are recommending so highly!!!!
You do not need third party registry cleaners with Windows 7 with the exception of Ccleaner!
 

My Computer My Computer

Computer type
PC/Desktop
OS
Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
CPU
Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
Motherboard
ASUSTeK COMPUTER INC. P8H77-M
Memory
8.00 GB
Graphics Card(s)
Intel(R) HD Graphics 4000
Sound Card
On Board
Monitor(s) Displays
Dell 24"
Screen Resolution
1920 x 1080
Hard Drives
(1) INTEL SSDSC2CT180A3 ATA Device (2) ST500DM002-1BD142 ATA Device (3) WDC WD3200AAKS-75L9A0 ATA Device (4) Generic- Compact Flash USB Device (5) Generic- MS/MS-Pro USB Device (6) Generic- SD/MMC USB Device (7) Generic- SM/xD-Picture USB
PSU
500w Corsair
Case
Cooler Master
Cooling
3 Fans
Keyboard
Logitech MK300
Mouse
Logitech WOM
Internet Speed
75Mb
Antivirus
Norton 360
Browser
Firefox, Opera, IE
Thanks for the pointers guys but it sorted me out very quickly.

Have a nice weekend.

Robert.
 

My Computer My Computer

OS
Win 7
If the Reg program merely backed up and restored reg then it may be survivable but I would uninstall it now. It's probably spying on you right now from System Tray?!

Glad you got it sorted. For the chronically infected I recommend Malwarebytes Real Time protection at $29 for life. It will block anything bad.
 
Hi again Greg. Thank you for your comments and yes, I will take your advice. What bothers me now is the fact that I have the full Malwarebytes programme on my PC and yet the Ransomware still got into my machine. Is there some way that it (ransomware) can be stopped before it gets a hold?

My best wishes.

Robert.
 

My Computer My Computer

OS
Win 7
This is the first I've heard of MBAM Real Time not being able to block malware. Did you click on something to allow the malware to download? This is how most malware gets in. I see users do this all the time allowing spyware during freeware installs due to not watching closely the checkbox choices. I'm not sure of the transmission method of ransomware but it may have presented itself at some point for you to choose or not. Do you remember this? If not and there was no action on your part that might be better safeguarded in the future, then I don't know what you can do except study the specific Ransomware via google to learn solutions which might offer prevention measures or avoidance techniques.

Be sure to also save externally an image when Win7 is working best, and keep your files backed up externally. Here is a free method to Sync, Backup and Store your Files to the Cloud with Skydrive - Windows 7 Forums
 
This is the first I've heard of MBAM Real Time not being able to block malware. Did you click on something to allow the malware to download? This is how most malware gets in. I see users do this all the time allowing spyware during freeware installs due to not watching closely the checkbox choices. I'm not sure of the transmission method of ransomware but it may have presented itself at some point for you to choose or not. Do you remember this? If not and there was no action on your part that might be better safeguarded in the future, then I don't know what you can do except study the specific Ransomware via google to learn solutions which might offer prevention measures or avoidance techniques.

Be sure to also save externally an image when Win7 is working best, and keep your files backed up externally. Here is a free method to Sync, Backup and Store your Files to the Cloud with Skydrive - Windows 7 Forums

+1 for MBAM real time monitoring never allowing any malware infection.
 

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Custom Built
OS
Windows 7 Professional x64
CPU
Intel i5 quad processor
Motherboard
DP67BG
Memory
16 GB
Graphics Card(s)
Radeon HD 5770
Sound Card
Realtek High Definition Audio
Monitor(s) Displays
Samsung SyncMaster
Screen Resolution
1920X1080
Hard Drives
WD 2TB (SATA Internal)
WD 1TB (USB External)
PSU
Corsair GS800
Case
Tower (Generic)
Cooling
3 Internal Fans
Keyboard
MS Wireless
Mouse
MS Optical Wired
Internet Speed
54 mbps
Antivirus
Emsisoft
Browser
IE-Version 9, Palemoon-Version 24.2.0
Once again Greg thanks most sincerely for your guidance. Unfortunately I don't have a clue how I picked up the ransomware, I'm usually most careful and cannot recall doing anything untoward with my PC. I tend not to download freeware but I'm sure some of it is good genuine and helpful stuff. I do back up regularly to an external HDD (Western Digital) but I've never tried the cloud. Maybe it's something I should look into. Thank you for the links.

Take care and thank you again.

Robert.
 

My Computer My Computer

OS
Win 7
No program is a silver bullet. Including malwarebytes.

I find that malwarebytes like most programs uses definitions and signatures, so it needs to be constantly updated. I would make sure malwarebytes settings are set to update in realtime every 30 minutes.

Here are (my) security recommendations:

I know this is a very long wall of text, But following the below will greatly reduce your chances of becoming infected again.

I advise you to install and use the following Free security programs/solutions so you do not get infected again:

-Panda antivirus -You can only have 1 antivirus installed at a time, I recommend using this one and uninstalling what you are using now.

-Malwarebytes

-Superantispyware

-Should I remove it

-Web of Trust

-Set up open dns

Run them/scan around once every 2 weeks. Unfortunately no program out there is a silver bullet-one program to protect you entirely. So due to this, it is necessary to have a couple of products to help keep you safe on all fronts.

Panda Cloud Antivirus: Panda cloud AV is a great free program that uses the cloud (the internet) to scan your pc for threats. This antivirus works very well at detecting the newest threats, as well as some unknown ones that have not yet been discovered. For information on how to use it, the manual is located here.


Malwarebytes: This is a great program to use to scan your pc for malware that your antivirus might possibly miss or not look for. A guide on how to use it can be found here.

Superantispyware: This is a great second opinion scanner which will scan for spyware and other types of PUPS. (Potentially unwanted programs.)


Should I remove it: This is not a malware scanner. What it does is it looks at all of the installed programs on your PC and gives you a percentage % of how many people uninstall the software. If the percentage % is high, I would remove it as it is most likely not a good program. It also gives a ton of information about what the program does and how it behaves.

WOT: (web of trust) is a very helpful browser addon that works with all web browsers and helps you to avoid nasty sites that have been known to host malware and the like. It uses a rating system by users as well as there own internal site investigations to place websites into categories and mark whether or not they are safe. It is a good tool to help you avoid clicking on a bad link in the first place.

Open DNS: is a service that helps you block known malware sites before they even reach your PC entirely. It also can be configured to block adult sites, and filter out other web sites based on categories. All for free. Not only does it protect your computers, but other devices as well.

For more information, see here:

https://support.opendns.com/entries/26514730-Web-Content-Filtering-and-Security

If it looks to advanced for you, it actually isn't very hard to set up. See the very first link above (set up open dns) which will take you to the setup page. You do not need to create an account if you wish not to. There is a link in the bottom right hand corner to avoid making an account if you do not want it. They have directions on how to apply it to your computer, or your router so that every device on your network can be protected.


Making windows security better for you and anyone using your PC:


I also suggest using a standard user account in windows, and only using an admin account when you need to install software. If you have family members sharing your pc, create standard user accounts for them. See this link below on how to do so:

http://www.sevenforums.com/tutorials/181024-user-account-create.html

When using a standard account and you make a change or install a program that affects the whole system, UAC will prompt you to continue. Make sure the setting or program you are tying to install is listed, then click yes to continue. If you are just browsing the web and the prompt appears with a program you have not heard of, or do not know what it is, it is much safer to click no then yes. No will block the action, and if you were trying to do something, you can always start it again and choose yes.

UAC makes this easy, see here:

What is user account control (UAC)?

I also suggest choosing always notify for UAC:

What are User Account Control settings?

I also recommend that you use bleeping computers suggestions which can be found here:

How to keep your computer safe online

So how Did I get Infected?


Those are my recommendations to you, and I Highly suggest you follow them.
 
Last edited:

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Custom Built
OS
Windows 10 Pro
CPU
AMD Ryzen 5 2400G Processor with Radeon RX Vega 11 Graphics
Motherboard
ASRock X470 Master SLI/AC AM4 AMD Promontory X470 SATA 6Gb/s
Memory
G.SKILL Ripjaws V Series 16GB (2 x 8GB) 288-Pin DDR4 SDRAM D
Graphics Card(s)
2047MB NVIDIA GeForce GTX 1060 6GB (EVGA)
Sound Card
Motherboard Built in
Monitor(s) Displays
Acer R240HY bidx 23.8-Inch IPS HDMI DVI VGA (1920 x 1080) Wi
Screen Resolution
1920 x 1080
Hard Drives
1TB Sandisk SSD PLUS (Main drive)
500 GB Seagate 7200 RPM (Games)
500 GB Western Digital 7200 RPM (Virtual Machines)
PSU
CORSAIR TX Series TX650M 650W 80+ Gold Modular Power Supply
Case
CORSAIR CARBIDE SPEC-02 Mid-Tower Gaming Case, Red LED Fan
Cooling
220mm, two 120mm, and four 60mm fans
Keyboard
Wired Dell keyboard
Mouse
Wireless Logitech mouse
Internet Speed
250mb down, 30mb up
Antivirus
Panda Cloud Antivirus
Browser
Chrome-ish x64
Other Info
Your awesome for reading this.
WOW! Andrew, what can I say. I am ever impressed by people's willingness to help. It must have taken you an age to compose and check your advsory message here. I will take time to carefully go through and check/try all of your suggestions. I do have already the paid-for version of MBAM and SASW and use them regularly. MBAM is updated automatically. Co-incidentally I've just emailled Malwarebytes customer support because today I have received the update reminder about every 10 minutes or so. I've asked them to help me to correct the problem.
Thank you very much for your kindness.

Best wishes.

Robert.
 

My Computer My Computer

OS
Win 7
I wonder what kind of performance hit running your AV (MSE?), MBAM and SAS real time all at once. I've had several users who get chronically infected install MBAM REal Time and they never got infected again. But I dont' think I would have gone the extra mile by buying SAS real time, but just use its scanner occasionally.

Don't forget to monitor your browser Add-Ons and Search to keep out everything except Flash, reader, Silverlight and Google in the stable search box where most won't let them spy.
 
Last edited:
Hi Greg. Hope you're having a good day. It's 2000hrs here in France (I'm English). Thank you yet again for taking time to communicate with me. As always your advice is duly and gratefully noted.
 

My Computer My Computer

OS
Win 7
I wonder what kind of performance hit running your AV (MSE?), MBAM and SAS real time all at once. I've had several users who get chronically infected install MBAM REal Time and they never got infected again. But I dont' think I would have gone the extra mile with SAS, but just used its scanner occasionally.

Don't forget to monitor your browser Add-Ons and Search to keep out everything except Flash, reader, Silverlight and Google in the stable search box where most won't let them spy.

Well, my combo is actually quite light.

But I do not have superantispyware paid edition. Only free. I don't think that the paid superantispyware would take much resources though. Maybe about 20-30mb.

Nowadays ram really is not much of a issue. So having these real time programs running should not effect anything, as long as you only have those starting up with your pc.

If you have 200 things at bootup plus all the security stuff, then ya.
 

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Custom Built
OS
Windows 10 Pro
CPU
AMD Ryzen 5 2400G Processor with Radeon RX Vega 11 Graphics
Motherboard
ASRock X470 Master SLI/AC AM4 AMD Promontory X470 SATA 6Gb/s
Memory
G.SKILL Ripjaws V Series 16GB (2 x 8GB) 288-Pin DDR4 SDRAM D
Graphics Card(s)
2047MB NVIDIA GeForce GTX 1060 6GB (EVGA)
Sound Card
Motherboard Built in
Monitor(s) Displays
Acer R240HY bidx 23.8-Inch IPS HDMI DVI VGA (1920 x 1080) Wi
Screen Resolution
1920 x 1080
Hard Drives
1TB Sandisk SSD PLUS (Main drive)
500 GB Seagate 7200 RPM (Games)
500 GB Western Digital 7200 RPM (Virtual Machines)
PSU
CORSAIR TX Series TX650M 650W 80+ Gold Modular Power Supply
Case
CORSAIR CARBIDE SPEC-02 Mid-Tower Gaming Case, Red LED Fan
Cooling
220mm, two 120mm, and four 60mm fans
Keyboard
Wired Dell keyboard
Mouse
Wireless Logitech mouse
Internet Speed
250mb down, 30mb up
Antivirus
Panda Cloud Antivirus
Browser
Chrome-ish x64
Other Info
Your awesome for reading this.
Thanks Andrew. Goiod advice is always welcome. I tend to print and store in a folder for future use.
Thank you for your time on my behalf.

Are you UK or elsewhere?

Best wishes.

Robert.
 

My Computer My Computer

OS
Win 7
Ah! Just noticed your country's flag.
 

My Computer My Computer

OS
Win 7
And what are you doing out of bed at 0400hrs???
 

My Computer My Computer

OS
Win 7
Back
Top