Computer problem

[Minxy]

I know there are some computer wizards on here who might be able to help....might!!

I take it I have managed to pick up a virus or similar on my desktop heres what happened;

I was searching for images (no not that sort) on google. I went into one site and was scrolling the images when up popped a screen titled 'PCeU' underneath it says Police Central e-crime Unit. It goes on to say I have been downloading everything from porn to terrorist motives. It says the computer is locked and that I need to pay £100 forfeit to unlock it. It then gives options to pay such as 'Ukash' and 'Epay' and many more I have never heard of.

Now clearly this is not what its pretending to be and I assume Something has gotten into the computer. I do have Mcafee protection although, ironically enough, a computer repair man was only saying the other day what rubbish Mcaffe was - I thought he was just trying to sell me something else but it looks like he may have been right. Anyway this 'PCeU' image comes onto the screen every time I start the computer, I get the desktop screen with icons etc briefly then it goes to the libraries screen very briefly and then the 'PCeU' screen.

So am I faced with an expensive trip to the PC repair man does anyone know??

[Paul240480]

Interestingly enough, my father-in-law had a very similar thing on Friday. Totally locked his pooter up like you. Not sure what anti-virus he has. His claimed to be from MetPol and said he had committed offences online that we're being investigated, he could pay £xx to PayPal to clear it.....
He had to have his hard drive 'cleaned' only cost about £30 . Of course he did lose some stuff, including saved passwords and bookmarks.
Not sure if Macafee is rated or not .
My daughters boyfriend works in computer programming, handy chap to have onboard.
For years he rated Avast, ( I never copped a virus with it) more recently he has put Microsoft Security Essentials on to my PC apparently a stronger AV than Avast. Also I have Malware Bytes to prevent Trojans and the like. I do a regular scan with both.
Not saying these are the best & I'm sure others will add there faves, but these ones seem to work for me.
Out of interest what images site did you get the 'virus' from? Wondering if it was the same as dad-in-law?
Hope this helps.

[TerryG]

Windows Defender should be able to sort that out for you (you get it from Windows Update)
or you can use a free anti-spyware program such as adaware (http://www.lavasoft.com).
Clearing malware can be an arse but that one i have seen lots of times and it plugs itself in to ie, it's fairly easy to remove and adaware will kill it stone dead.
If it is refusing to let you download anything (which i have seen before) then you will need to download adaware on another PC, boot the infected one in to safe mode and copy adaware over with a USB stick then run it from there.
feel free to send me an email if you are having trouble and i can arrange to do a remote support session with you and beat it in to submission.

[Paul240480]

^^^^ I had the adaware from Lavasoft , 'son-in-law' put it on a couple of years back he recently replaced it with Malware Bytes.
I suggested that father-in-law ran his AV to clear the matter, but HE reckoned he could do nothing with his PC as it locked onto the page like the one Minxy describes, so no way to run an AV.
He even just unplugged and then left it a while, plugged back in and it came back to the same , so called MetPol page .
Just re-read yours Terry, getting father in law into safe mode over the phones not an option

[Minxy]

Hi Terry
Thanks for that I may take you up on your offer. At the moment I am not near the desk top but it does as you say - goes almost immediately to that screen so there is no time to start anything else. If I take you up on the remote support session what will I need at this end? I'm typing this on my Apple note book which is the only other computer I have to hand (the other laptop is at the menders for warranty work)
Also I must warn you I know nothing about computers so I can be hard work when it comes to things like this

[TerryG]

If it is booting directly in to that screen i suggest you do the following:
Boot in to safe mode
Depending on your windows version go start, run OR start, accessories, run
type: msconfig
press OK

go to the startup tab and untick everything
press OK
look in your startup group (start, all programs and look for a folder called startup. anything strange in there right click on it and press delete)
restart

That should allow you to restart normally, at least once so you will be able to download adaware / malware bytes anti malware. They are both good products and i have used them both to good effect.
If it works in safemode but after that still won't start normall you can start in "safe mode with networking" and try downloading your file from there.

If it refuses to do that then i go back to my origional suggestion of booting in to safe mode and running an anti-mwalware tool you have downloaded elsewhere and copied on via USB.

[ajmin]

My guess would be that this isn't a virus spy ware as such as it got round McAfee which isn't as bad as it's made out, what you are probably seeing is a jpg or png file downloaded from the website along with a url that gets stored in your startup group which runs when your computer boots. All the url is going is loading up the screen you see on your desktop, have you tried alt - tab bing to get rid of it from immeadiate view.

The idea is you pap yourself when you see the screen and think the thought police are coming to get you and you send some chancer $100 via paypal etc they take your money and you are still left with a image on your screen that probably means nothing

[Minxy]

Hi
Certainly didn't pap myself as the site I was on seemed perfectly innocent - had it have been a porn site it may have had the desired effect

Excuse my ignorance 'alt-tab-bing'? I see the alt and tab but bing?

.....and 'boot in safe mode'?

Sorry I really am hopeless with these things

[ajmin]

if you press alt key and the tab key it should scroll you though your open windows, your desktop window will be one or should be one. My guess is what you see is made to fill your desktop space so you can't see the bottom windows task bar shortcuts bar. Alternatively if you can do Control Alt Delete and access Task Manager you need to find the iexplore process and select it and then click on end task. Basically your screen will go blue, well it will depend upon your desktop back ground colour. Still in Task Manager select new task and type iexplore and either run or ok, your desktop should now load up without running the startup group. Hopefully this will get you to where you can use the computer to track down what filling the screen.

I think when you alt Tab through your screen it tells you what the executable is that running the screen it will give you an idea of what to look for.

[TerryG]

to start your computer in safe mode, power it on and start pressing the F8 button until a menu appears. one of the options is "safe mode" you can use the cursor keys to select it then press return and it will start windows in a more basic mode.