Remove Trojan.winlock Ransomware Virus Gendarmerie Bundespolizei by Britec

Remove Trojan.winlock Ransomware Virus Gendarmerie Bundespolizei by Britec

Trojan-Ransom.Win32.Blocker.bly
Trojan.Winlock.4367
Trojan:Win32/Ransom.FL

Trojan:Win32/Ransom.FL is a ransomware that targets people in several countries, including Germany and France. It displays a window that covers the entire desktop of the infected computer and demands payment for the supposed possession of illicit material.
--------------------------------------------
http://www.briteccomputers.co.uk/forum

---

Closed Caption:

which guys have been doing he stole it
this good enough a ransomware removal
video here for you this one's a French
police one and a it's not the french
police issue now is so so the criminals
trying to scam you at your money now as
you can see they have demanded 200 euros
to free from this ransom now placed on
hold people to ransom note that this is
just saw the criminals
trying to rip people off any strike
anoche it to remove it
am on a treadmill advice forum for the
actual sample
because that those guys are comedies
videos for your so their favor do this
get on
and remove this ransom
a case a few try to go to safe mode with
networking
you'll find eight runs there as well
okay so as you can see pretty much was
scuppered a week on news that
method so this reboot system and choice
ate my the command prompt
so in the Advanced Boot Options again
income then to safe mode the command
prompt here
and let this load up there this does
take a bit so I'm
with this so ransom on the system it
slows up a bit I'm
okay so it be a safe mode with command
prompt here
and got a couple options open to us here
we can actually
edit the registry we wanted to from here
and make some registry edits I guess is
an option to do things their
we can also and enter the
System Restore points if we had system
restore maybe
go back a couple a days if he wanted to
bit risky my opinion but
people say that he can do it so we can
do here is cut
St it and rst
are you I and into a XE
and this will open up the system restore
panel I've got no system restore points
on here
some that may be using that method can
everything you can do is type Explorer
the EXT and this is gonna allow us to
open up
at computer techy surf around and find
the actual file now I know the file was
on my desktop and that's the culprit
their
be cannot you can run programs like him
and pro he could you do need internet
access you don't have in command prompt
am but he does later but falls onto USB
drives from another computer
lucky in an acctg access those files
and run them there you can also run
programs inside here as well
which is seen and Malwarebytes here ok
that she remembered bites from this
location
if I have to instill days
okay if I do have instilled that means
I'll come running and that means would
be a to remove it
nada as long as you're pretty much up to
date you should see it
find the actual ransom itself
should be free files there and that's
the free files
a quickly stop this show your hashing
say be found
exploratory exceed has been corrupted
and also
and it's the win logon registry
that's been affected and also there's
the follow that was on the desktop
that was the infection okay so that's
one way of going about it now what
happens if you can get to say bye week
mom from swelling Shane other way
sis reboot the system and a you can use
live CDs
okay so we need to do teaser shot them
the system
case ever gonna put
any key on the keyboard with abuse in no
one boo boo recovery tool hey
be can use kasperski's rescue CD
windows unlock a or you can use
Microsoft standalone system sweeper
they would remove this ransom from the
system
now i'd like a kasperski's rescue CD
dots whips a.m. live CD is well should
be either remove it
I'm
okay so now we need to put an app in key
so if you have got no one you should
know what your pinkies
but it's not on going to be using all
the ex is here
and agree to that and what we wanna go
for you is no wanna dance
a recovery scan now what s gonna do is
he am removes fouls does so infected of
the system that the system won't boot so
drawn remove them now I've had as some
good success with this programmable so
bad
some bad results from it were as in done
it so pretty much
a car just say that's no one on its own
there is other programs that do that
kasperski's at the same issues so we're
gonna give this a go
and what we want to do here is click on
Scan
NASCAR update
the actual product protection
definitions if you look down a bomb here
when I first built this CD Desai so
image
it was the 23rd March 2012
is now going to update these and then
run that says was good keep this up
today if he can as best
as you can and that way saves all the
update in
okay so this now send the definitions
are up to date
and it's now start to scan and as you
can see it sir give us
tonight for a fateful now 2012
I'm just had a scan in I'm
finish and agencies found one already
okay said it schedules can now finished
so this have a look am what is detected
the city's
found to and its resolve those issues
says click on here
and as you can see I'm it's found on the
desktop the infection file
the exploratory exceeded Malwarebytes
said it was in cropped it
and this is found it also and its fixed
at and
when logon area show agency
I'm says fix for those areas
and is found another something else in
the Downloads folder
on this one here
again this is in the Downloads folder
which is just another
so don't take much notice this one base
may be the first one really
which is the actual ransom itself okay
so we're going to do he is reboot the
system in sierra goes
I'm
I'm
occasion saber back into their stop back
up to normal
which is a good thing
again you could run some other scans
just to make sure the system's clay know
the boys she to run
and TSS killer also hit man pro
and run a full scan with Malwarebytes
run these free programs as well just
make sure you got nothing else on the
system
i mean but if he is there and ransom
itself he's
all gone and now so you were not the way
that I would definitely still run
service Kansas to make sure K
so hope you enjoy these videos my name
is Brian from brought it to Cody cape in
Judy's videos guys please member
in a subscriber banish a support also
rain favorite all my videos if you enjoy
them
not be making more useful videos for
your in the future said thanks again for
watching
by step