Question How to remove Windows Defender scam from locked pc?

[mikehende]

Hey guys, I searched the for instructions but every article and video I am seeing is showing to do this, that or the other thing in Windows but on my HP Stream machine, I can only see the mouse in the square window so I cannot navigate around the desktop to attempt anything at all, help please?

 

[rgd1101]

control-alt-delete

what did you download to get this malware?

 

[USAFRet]

At this point....

You recover from the full drive backup you made before this happened (thats what I would do)
or
Boot from a Windows recovery USB and try to fix it from there
or
Full wipe and reinstall


But DO NOT contact them. That is the real problem. They will do all sorts of nasty things to you, your data, and your system.

 

[mikehende]

Nice, thank you! I used car-alt-delete, task manager closed google with end task

am trying to fix this for an older guy who is not all that tech savvy. he said he got a pop up and clicked on it then this happened.

So I am guessing that this is Ransomeware, is this correct please? Whether or not, what should I do make sure this problem is totally cleaned of this whatever it is please, run something like Malwarebytes?

 

[DSzymborski]

Nice, thank you! I used car-alt-delete, task manager closed google with end task

am trying to fix this for an older guy who is not all that tech savvy. he said he got a pop up and clicked on it then this happened.

So I am guessing that this is Ransomeware, is this correct please? Whether or not, what should I do make sure this problem is totally cleaned of this whatever it is please, run something like Malwarebytes?

For a known virus, especially with someone who isn't tech-savvy enough to deal with it themselves, you fully wipe the drive and reinstall Windows.

 

[USAFRet]

Nice, thank you! I used car-alt-delete, task manager closed google with end task

am trying to fix this for an older guy who is not all that tech savvy. he said he got a pop up and clicked on it then this happened.

So I am guessing that this is Ransomeware, is this correct please? Whether or not, what should I do make sure this problem is totally cleaned of this whatever it is please, run something like Malwarebytes?

No, it is NOT ransomware.

That popup makes you THINK there is a problem.
You call the number, and then the fun begins.
They ask from remote access to your system.
Show you all sorts of "problems". (that are not really problems)
Meanwhile, they are cruising through your system, looking for passwords and usernames (bank accounts, etc)
Also, installing a backdoor trojan.

 

[USAFRet]

Nice, thank you! I used car-alt-delete, task manager closed google with end task

am trying to fix this for an older guy who is not all that tech savvy. he said he got a pop up and clicked on it then this happened.

So I am guessing that this is Ransomeware, is this correct please? Whether or not, what should I do make sure this problem is totally cleaned of this whatever it is please, run something like Malwarebytes?

Given this....full wipe and reinstall.
No question.

Not to be harsh, but you are only slightly less clueless than your friend.

 

[DaleH]

Given this....full wipe and reinstall.
No question.

Not to be harsh, but you are only slightly less clueless than your friend.

That is harsh. Computer intelligent people tend to look down on those who are not so tech savvy. This was not a helpful comment. If one possessed all knowledge, they wouldn't need to be on this forum.

 

[Tac 25]

@mikehende

you need to wipe all files, reinstall windows.

this kind of malware is dangerous.

 

[rgd1101]

you said you close google? you mean google chrome the browser?

 

[sitehostplus]

This is one of those times I wish I could use profanity on this board to get my point across.

Whatever you do, do not call that number!!!

Here's what I would do. You don't have to, but this may be your only shot at fixing this without a full wipe and restore.

You will need:

1. A 'clean' uninfected computer (if you don't have one, wait and grab a cheap chromebook in the morning).

2. A clean (preferrable new and unopened) USB drive (just use the biggest one you can get)

What you need to do, is on your 'clean' computer, surf here and 'pick your poison' of the links on this page to a USB antivirus rescue utility (don't worry, the link I provided is a google search).

After you download it, plug in your clean USB drive into the clean machine, and follow the instructions given to you by the antivirus provider to unpack that utiltiy onto your USB drive.

The next part is tricky, so be careful so you don't infect the USB drive by accident!!!

1. Turn off the infected machine. And I mean completely at the power supply if you can.

2. Plug in the USB drive into the infected machine and turn the infected machine on.

3. When you start seeing it do it's POST test, push the appropriate keys to enter the bios immediately.

4. Once you get to the bios, set it up so it only boots off the USB stick.

5. Do an exit and save of the bios, and it should boot to the USB stick.

6. Follow the on screen directions the utility tells you to have the rescue utility scan and repair your infected hard drive.

7. Turn off the computer, remove the USB stick. Now re-enter the bios, set it to boot off the local drive again, save and restart. Now use the machine a bit (while praying of course) to ensure the malware is actually gone.

At this point, it should either be clean and your ransomeware is gone, or you will need to wipe and and reinstall from either a backup, or a fresh OS install.

 

[mikehende]

@mikehende

you need to wipe all files, reinstall windows.

this kind of malware is dangerous.

Done, works , thanks.

 

[Tac 25]

@mikehende

glad to know your friend's pc is ok.

I hope he would be more careful about ads from now on.