[Blood_Hawk]

How to remove a basic Ransomware virus on your Computer

I will providing multiple methods since there are multiple ways of doing this.

Method 1
1. Shutdown your Computer
2. Hit F8 when your computer is starting up, or access Safemode in any way your operating system supports.
3. Choose Safemode or Safemod with Networking
4. When the desktop appears then you know Safemode works, however, if safemode doesn't work then it's because the virus deleted a file essential to running in Safemode, skip this method.
5. However if Safemode does work, continue following the steps.
6. Open Task Manager, go to the start-up option and find the virus name and then disable the virus from running again on next re-boot. Or you can find the virus location and delete it from there.
7. When the virus is disabled then re-boot and then you should be all fine.

Method 2
1. Start your browser then access your browsing source and type in "procexp" and download it.
2. Run procexp while virus is running, however, if the virus blocks this then this method doesn't work for you.
3. When procexp is open then find the virus and kill it.
4. Usually viruses doesn't block this process.

Usually one of these 2 methods should work for the basic ransomware viruses.

[UnOriginalUsername]

Nice tutorial I guess but most ransomawre these days are a bit harder to get rid off.

Usually the ransomware I test can be removed from safe mode.

[Blood_Hawk]

You need to post sources because this was obviously stolen.

Dafuq? How? I've had experience with ransomware. I didn't steal this..

[Quest™]

He's just trying to be helpful don't bash him. Just teach him what he doesn't know.

[Null Byte]

Uh, just so you know task manager doesn't list all persistence locations. You could have a hijacked system file in which case you'd have to use a hash check to find it. Also, if it's installed as a driver, you're fucked with the first method too. Now lets look at the second method. What makes you think you'll have access to a web browser that can download files? That's a huge, inaccurate assumption.

This guide really needs some work.

[Quest™]

When you don't know what you're talking about, you don't post "tutorials". It's just false information and you're doing more harm than good.

Very true that's why I don't post tutorials.

[Blood_Hawk]

So what if the ransomware blocks safe mode?

It says "Basic Ransomware", the ransomware would have to delete a file that is essential to run in safemode, i guess most basic ransomware wouldn't do that. However if so, then you would have to restore windows and have a file backup service with your files.

[Null Byte]

He's just trying to be helpful don't bash him. Just teach him what he doesn't know.

What's worse then not helping someone? "Helping" them with false information. He's just wasting their time.

[Null Byte]

OP I think it would be in your best interest to close the thread. You're really lucky Corso isn't here or else you'd probably be crying in the shower right now.

[Blood_Hawk]

Are you dumb if you're infected with a Ransomware you won't even have access to a web browser ... do you know what a ransomware is ?

-.- Are you serious? Look up ransomware, of course you would have access to a web browser..

[Null Byte]

-.- Are you serious? Look up ransomware, of course you would have access to a web browser..

I don't see a webbrowser anywhere
http://spyware-removal-guide.net/images/...k-US-2.jpg

[Blood_Hawk]

Once again you're dumb.
Even "basic" ransomwares block access to your web browser so solution 2 is useless.

Facepalm... Look it up... How fucking stupid can someone be..

[Null Byte]

Or you could just to boot up from live cd, like hiren or kaspersky and edit the registery a little and delete few files.

THIS is the proper way to remove ransomware. The procedure recommended in the thread is egregiously false.

[Quest™]

How to Remove a basic Ransomware
Navigate to: http://www.bleepingcomputer.com/virus-removal/
And find the name of the ransomware.

[Blood_Hawk]

... You're a fucking idiot.
A RANSOMWARE LOCKS DOWN YOUR WHOLE COMPUTER, YOU DON'T HAVE ACCESS TO ANYTHING.
YOU'RE TALKING ABOUT A SCAMWARE, NOT A RANSOMWARE IDIOT.

Holy shit... A ransomware locks your computer until you pay a certain amount of money, god...