Thanks to all the great responses.
SUMMARY OF RESOLUTION
The scenario I had ready to go was:
boot into safe mode
go back to the previous restore point (reboot)
define a new user and set admin privileges all via command line
login as the new admin user
install and run malwarebytes to completion (previously downloaded
to cd) (reboot)
install and run Search & Destroy, run to completion (previously
downloaded to CD) (reboot)
Once things were running, then ensure antivirus is there and running,
Install Microsoft Defender and run full scan.
Once arriving I did my scare tactic of asking user if they have
re-install media, if required.
Of course they don't, so I did warn, worst case we buy a new license
for his Windows 7 Pro x64.
Did the boot into safe mode, the restore point and reboot made it work.
Found their McAfee Antivirus wasn't working, so he renewed his license
and we re-installed that.
I also installed Microsoft Defender and got it set up to run regularly
(full scans daily).
By the time I left 1.5 hrs later, McAfee was running, and M$ Defender
was doing a scan.
Customer was happy. (I ask for no $$ but they gave me a nice check. I
have fixed his computer
before, but they are members of our church, and I don't ask for $$,
but accept any donations.)
He thought it was cheap especially to have it done on a Sunday evening.
><> ... Jack
--
Whatever you do, work at it with all your heart... Colossians 3:23
"If you are not part of the solution, you are part of the precipitate"
- Henry J. Tillman
"Anyone who has never made a mistake, has never tried anything new." -
Albert Einstein
"You don't manage people; you manage things. You lead people." -
Admiral Grace Hopper, USN
Life is complex: it has a real part and an imaginary part. - Martin Terma
“Our virtues and our failings are inseparable, like force and matter.
When they separate, man is no more.” - Nikola Tesla
I don't enjoy a massacre of ads. Hackaday.com says this should
slaughter their existance.
On Sun, Aug 18, 2013 at 7:51 PM, Howard White <[email protected]> wrote:
>>
>> On Aug 18, 2013, at 11:55 AM, Jack Coats <[email protected]> wrote:
>>
>>> What is the current 'best' ransomware remover.
>>>
>>> A bean counter at church has a bad case of ransomware. What is the
>>> latest tool to remove it.
>>>
>>> I would rather re-format and reload, but like many users he doesn't
>>> have his distro disks, and I don't buy winders unless being paid.
>>>
>>> Any help would be good.
>>>
>
>
> On 08/18/2013 04:00 PM, Chris McQuistion wrote:> Generally, if Windows Vista
> or later, j try to reboot into "repair
>
>> computer" mode and do a system restore to a point before the
>> infection. This actually works surprisingly well most of the time and
>> only rolls back system files, not user created files.
>>
>> After that, Malwarebytes + Spybot + MS Security Essentials.
>>
>> Chris
>
>
>
> My go to site for clearing such things is www.bleepingcomputer.com. They
> have a program in their downloads section called rkill which you need to run
> before you run Malwarebytes. You even have to rename rkill to something
> innocuous like jack01.[ exe | com | bin ] before you run it because the bad
> guys can block the programs you try to run.
>
> Do you have any idea what the [ name | class ] of malware you are dealing
> with?
>
> Howard
>
>
> --
> --
> You received this message because you are subscribed to the Google Groups
> "NLUG" group.
> To post to this group, send email to [email protected]
> To unsubscribe from this group, send email to
> [email protected]
> For more options, visit this group at
> http://groups.google.com/group/nlug-talk?hl=en
>
> --- You received this message because you are subscribed to the Google
> Groups "NLUG" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/groups/opt_out.
--
--
You received this message because you are subscribed to the Google Groups
"NLUG" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/nlug-talk?hl=en
---
You received this message because you are subscribed to the Google Groups
"NLUG" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
