Malware Removal Instructions

  • Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg

Tuesday, 24 May 2011

Remove Die offizielle Mitteilung des Bundeskriminalamtes (Uninstall Guide)

Posted on 13:24 by Unknown
"Die offizielle Mitteilung des Bundeskriminalamtes" is a Trojan (ransomware) targeting Internet users in Germany. The Trojan replaces the Windows desktop with a fake warning from the German Federal Police claiming that child pornography has been found on your computer. The system will be unlocked on payment of 100 Euros in Ukash vouchers within 24 hours. And if you don't pay the ransom, your files will be deleted. Don't worry, the Trojan is not capable of doing this. Cyber criminals behind this Trojan want to scare you into paying the ransom. "Die offizielle Mitteilung des Bundeskriminalamtes" Trojan blocks pretty much everything on your computer, so you can't use Task Manager or any other Windows utility to disable this Trojan, at least in Normal Mode and Safe Mode. Thankfully, you can restart your computer in Safe Mode with Command Prompt and remove the "Die offizielle Mitteilung des Bundeskriminalamtes" Trojan manually. For more information, please follow the removal instructions below. Good luck and be safe online!



Related malware: BUNDESPOLIZEI Ransomware


Die offizielle Mitteilung des Bundeskriminalamtes removal instructions:

1. Reboot your computer is "Safe Mode with Command Prompt". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Command Prompt" and press Enter key. Login as the same user you were previously logged in with in the normal Windows mode. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm



2. When Windows loads, the Windows command prompt will show up as show in the image below. At the command prompt, type explorer, and press Enter. Windows Explorer opens. Do not close it.



3. Then open the Registry editor using the same Windows command prompt. Type regedit and press Enter. The Registry Editor opens.



4. Locate the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

In the righthand pane select the registry key named Shell. Right click on this registry key and choose Modify.



Default value is Explorer.exe.



Modified value data points to Trojan Ransomware executable file.



Please copy the location of the executable file it points to into Notepad or otherwise note it and then change value data to Explorer.exe. Click OK to save your changes and exit the Registry editor.

5. Remove the malicous file. Use the file location you saved into Notepad or otherwise noted in step in previous step. In our case, "Die offizielle Mitteilung des Bundeskriminalamtes" was run from the Desktop. There was a file called movie.exe.

Full path: C:\Documents and Settings\Michael\Desktop\movie.exe



Go back into "Normal Mode". To restart your computer, at the command prompt, type shutdown /r /t 0 and press Enter.



6. Download recommended anti-malware software (direct download) and run a full system scan to remove this virus from your computer.

7. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.


Associated Die offizielle Mitteilung des Bundeskriminalamtes files and registry values:

Files:
  • [SET OF RANDOM CHARACTERS].exe
Registry values:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell" = "[SET OF RANDOM CHARACTERS].exe"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\"CleanShutdown" = "0"
Share this information with other people:
Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest
Posted in Ransomware | No comments
Newer Post Older Post Home

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Popular Posts

  • What is wrtc.exe and how to remove it?
    wrtc.exe - by Perion Network Ltd. What is wrtc.exe? wrtc.exe is a part of IncrediMail software, digitally signed by Perion Network Ltd. This...
  • Remove ShopperReports (Uninstall Guide)
    ShopperReports is defined as adware or a potentially unwanted program that displays marketing related results in a side pane of the browser...
  • Trojan.MBRlock, Внимание! Ваш компьютер заблокирован
    Trojan.MBRlock is a very disturbing piece of malicious code which infects the master boot record (MBR) and prevents Windows from starting. ...
  • False Positive: Ikarus and Comodo detecting TDSSKiller as a Trojan horse
    This awkward moment when you realize that your favorite rootkit removal utility is detected as malware. I probably wouldn't even have no...
  • Remove RiskTool.Win32.BitCoinMiner (Uninstall Guide)
    RiskTool.Win32.BitCoinMiner is a risk tool or potentially unwanted application that may use your computer's resources to generate bitco...
  • Remove Rattlingsearchsystem.com (Uninstall Guide)
    Rattlingsearchsystem.com is a ZeroAccess/Sirefef rootkit-related browser hijacker that redirects users to shady websites while searching on...
  • Remove TR/ATRAPS.Gen2, removal instructions
    Cyber crooks and third parties that buy stolen data are increasingly using more and more sophisticated techniques, in a variety of different...
  • Remove Ask Search and Ask Toolbar (Uninstall Guide)
    Ask Search and Ask Toolbar are very often incorrectly classified as virus/spyware that may cause search redirects. The majority of us pref...
  • How to remove 'TidyNetwork' adware virus from your computer
    As internet users most of us have seen those irritating little pop-up windows that are advertising something that we normally have little or...
  • Remove Windows Attention Utility (Uninstall Guide)
    Windows Attention Utility is a rogue security application that generates misleading warnings about nonexistent viruses and attempts to lure...

Categories

  • Adware
  • Answers
  • Antivirus software
  • Browser Hijackers
  • Cloud Computing
  • Fake Alerts
  • Giveaways
  • Hoax
  • How-To
  • IaaS
  • Internet
  • Malicious websites
  • Malware
  • PaaS
  • Parental Controls
  • Passwords
  • Phishing
  • Process Information
  • Ransomware
  • Rogue programs
  • Rootkits
  • SaaS
  • Security Advisories
  • Spam
  • Spyware
  • Trojans
  • Viruses
  • Web Browsers
  • Worms

Blog Archive

  • ►  2013 (173)
    • ►  December (6)
    • ►  November (13)
    • ►  October (11)
    • ►  September (20)
    • ►  August (4)
    • ►  July (17)
    • ►  June (31)
    • ►  May (25)
    • ►  April (15)
    • ►  March (17)
    • ►  February (7)
    • ►  January (7)
  • ►  2012 (86)
    • ►  November (2)
    • ►  October (4)
    • ►  September (6)
    • ►  August (6)
    • ►  July (11)
    • ►  June (1)
    • ►  May (5)
    • ►  April (7)
    • ►  March (7)
    • ►  February (17)
    • ►  January (20)
  • ▼  2011 (239)
    • ►  December (8)
    • ►  November (18)
    • ►  October (21)
    • ►  September (24)
    • ►  August (28)
    • ►  July (32)
    • ►  June (16)
    • ▼  May (23)
      • How to Remove Mac Guard (Uninstall Guide)
      • How to Remove ScanQuery (Uninstall Guide)
      • Remove Die offizielle Mitteilung des Bundeskrimina...
      • How to Remove Security Solution 2011 (Uninstall Gu...
      • How to Remove Security Center (Uninstall Guide)
      • "Your Windows has been blocked" Ransomware Removal...
      • How to Remove Security Shield Pro 2011 (Uninstall ...
      • How to Remove Antivirus Pro (Uninstall Guide)
      • How to Remove Essential Cleaner (Uninstall Guide)
      • Remove Win32/Olmarik (Uninstall Guide)
      • Remove Apple security center (Uninstall Guide)
      • "System process at address 0xE4783995 have just cr...
      • Remove Windows Tasks Optimizer (Uninstall Guide)
      • Remove Windows XP Recovery (Uninstall Guide)
      • Remove Windows Attention Utility (Uninstall Guide)
      • Remove Mac Protector (Uninstall Guide)
      • How to Remove "Malware Protection" (Uninstall Guide)
      • Remove Windows Oversight Center (Uninstall Guide)
      • Remove Mac Security (Uninstall Guide)
      • How to Remove PC Security Guardian (Uninstall Guide)
      • Remove "Warning! Spyware detected on your computer...
      • Remove BUNDESPOLIZEI Ransomware (Uninstall Guide)
      • Remove MACDefender (Uninstall Guide)
    • ►  April (15)
    • ►  March (16)
    • ►  February (9)
    • ►  January (29)
  • ►  2010 (2)
    • ►  December (2)
Powered by Blogger.

About Me

Unknown
View my complete profile