Solved

get rid of ICE Cyber Locker Windows 7

Posted on 2014-11-19
10
109 Views
Last Modified: 2014-11-29
I have been infected with the ICE cyber crime center malware.
I am running Windows 7 Pro 64 bit
I am unable to get into safe mode
I downloaded Bleeping computer's Hitmanpro, created a boot USB drive, but when I boot from it, I can never get to the point where hitmanpro  will run.
I cannot go back to a restore point (because I cannot get to c:\windows\system32\rstrui.exe before ICE Cyber runs again on me.

I have been working on this for 4 hours.  Can someone help me please!!
Feel free to ask any questions you need for clarification.
0
Comment
Question by:jhillbos
  • 6
  • 4
10 Comments
 

Author Comment

by:jhillbos
ID: 40452908
As to hitmanpro, when I boot from the USB drive, I select option #1 'Bypass master boot record'.
Windows runs, I login, and hitmanpro does not run, but ICE Cyber locker does and hangs me up
0
 
LVL 26

Expert Comment

by:Thomas Zucker-Scharff
ID: 40452925
0
 

Author Comment

by:jhillbos
ID: 40453020
I am afraid not.  I get to the point where I can actually load restore points.  The first restore point that displays works, but the infection must have already been there, because it is still there after the restore is complete.  When I display previous restore points, I can try to restore back to 11/11/14.  It starts to work, It starts with preparing, goes to initializing, then goes to restoring files, then crashes with rstrui.exe application error.  "The instruction at 0xfb1bca referenced memory at 0c062c50bc.  The memory could not be read.  Click OK to terminate."  I have tried this on several restore points.

Are there specific files I could try to delete using the command prompt?
0
 

Author Comment

by:jhillbos
ID: 40453073
Also, according to the instructions from the youtube video, when I try to open the 'hive' and I find the 'software' key, it tells me the file is in use.

This is a real bugger!!
0
 
LVL 26

Expert Comment

by:Thomas Zucker-Scharff
ID: 40453106
Have you ruled out a fresh reinstall?  Better yet do you have either an image to re-image the computer or you could combine a fresh install with recovering using a versioning file backup tool (assuming you were using one - like crashplan - not dropbox).  Dropbox is not a backup, but if that is all you had contact them and they will restore your files from an older version, although it takes them longer.
0
Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

 

Author Comment

by:jhillbos
ID: 40453117
That is the last thing I want to do.  It will take quite a while to get things back to where they were.  No more suggestions?  I do not have an image from the original install.
0
 
LVL 26

Expert Comment

by:Thomas Zucker-Scharff
ID: 40453152
I don't have more suggestions at this point for your current dilemma.  I do suggesst you invest in versioning backup in the future.  Like I was saying, it is much easier to recover from this type of problem, when you can go back as many versions as you wish.  We have successfully done this using CrashplanPROe. and I have done the same using Crashplan home version.  Note that with a tool like crashplan you can do this for free as long as you don't use the CrashPlan server (cloud) as a backup destination.  You can even designate multiple other destinations.

www.crashplan.com

Disclaimer:   I am not in any way affiliated with anything mentioned in this post - just a happy user.
0
 

Accepted Solution

by:
jhillbos earned 0 total points
ID: 40462338
We paid them
0
 
LVL 26

Expert Comment

by:Thomas Zucker-Scharff
ID: 40462385
Sorry to hear.  For our information - how much did it end up costing and did you get the decryption key?
0
 

Author Closing Comment

by:jhillbos
ID: 40471444
I tried multiple suggestions.  I guess by the time I got to the PC, it was to late to go back.  Could not accomplish anything.  Could not revert back to system restore points at all.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

One of the features I've come to appreciate about Windows 7 and Windows Server 2008 R2 is the ability to pin applications to the task bar. As useful a feature as I've found this, it does have some quirks.  For example, have you ever tried pinning an…
OfficeMate Freezes on login or does not load after login credentials are input.
This Micro Tutorial will teach you how to change your appearance and customize your Windows 7 interface to your unique preference. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now