ransomware BUNDESPOLIZEI

**lds17pl** · November 26th, 2013, 05:46 PM

Today got this ransomware which is only spreaded at Germany (computers with German ID):

First of all:

NO PANIC! - KEINE PANIK!

DO NOT PAY! - KEINESFALLS ZAHLEN!

Origin of this ransomware is Bulgaria. Although Interpol and Europol know location and cyber criminals responsible persons at Bulgaria aren't able or willing to stop. (There are many other malewares and ransomwares from there, too.)

How to remove this ransomware:
- call-up task manager and terminate browser process
- go offline
- start malware cleaner like PrivaZer (see below)
- after done shut down your pc
- wait some minutes
- reboot

Of course you should have installed malware cleaner before you get attacted by ransomware/malware blocking your browser!

E.g. freeware pc cleaner PrivaZer 2.9. here
http://vintage-erotica-forum.com/sho...&postcount=211

Corvuscorax · November 27th, 2013, 02:55 PM

Thankfully this is a rather dumb malware specimen.
After terminating IE and restarting, nothing was found by the virus scanner, not even in the internet explorer and java caches. But this can change anytime. I once had an early version of the fake virus alert ransomware, was easy to get rid of. About two years later i had to struggle with an identically looking, but much harder to remove successor.

pigulici · November 28th, 2013, 07:14 AM

In my country, it have 1-2 years old this type of ransomware, ofcourse the "Romanian police" version, I think was spread more on est Europe, because it is more likely to find targeted victims(a lot of people are use pirated digital content), I think because now all est people already know it is a fake, so less victims, they are moving to more "civilized" countrys, maybe now it will close the cyber criminals...

slimOl55 · December 2nd, 2013, 07:28 PM

Had this same pop up block my firefox browser on mac system!

What a pain in the ass - its taken a few attempts to find and destroy.

The software is free and its called CCleaner from pirisoft

slimol55

**luddite** · December 2nd, 2013, 09:45 PM

Quote:

Originally Posted by slimOl55

Had this same pop up block my firefox browser on mac system!

What a pain in the ass - its taken a few attempts to find and destroy.

The software is free and its called CCleaner from pirisoft

slimol55

The free version of CCCleaner is good for deleting useless files and caches, but I wouldn't depend on it to look for malware, since it doesn't update often.
I recently ran a scan with Comodo and after it updated it found nothing. I then ran a scan with Malawares and it found a dozen bad entries in my registry, so my advice is to use more than one program to protect your computer.
My computer is protected by Windows Defender, and I don't see it finding many problems.

**lds17pl** · January 31st, 2014, 02:37 PM

Tonight got same attack by BUNDESPOLIZEI once more.

This time successfully tried other manner to remove (Windows 7, Firefox):

- if download in progress do nothing until finished or terminate, *)
- start Task Manager and terminate browser process,
- start AdwCleaner and remove detected malware.

*) Suggest to terminate any upload to avoid spreading malware.

Security Task Manager didn't detected any malware. Firefox starts without any trouble. (Btw: at closing my FF all cookies and others are removed.)

AdwCleaner http://vintage-erotica-forum.com/sho...&postcount=219

Security Task Manager http://vintage-erotica-forum.com/sho...&postcount=207

boneym · January 31st, 2014, 03:00 PM

Funny, if the link this OP provided wouldnt have linked to another VEF post, I could have bet my ass that it contained yet another virus! It has everything a good phishing mail has (just in a forum post), like bold letters in colors, etc..

**lds17pl** · January 31st, 2014, 03:07 PM

Quote:

Originally Posted by boneym

Funny, if the link this OP provided wouldnt have linked to another VEF post, I could have bet my ass that it contained yet another virus! It has everything a good phishing mail has (just in a forum post), like bold letters in colors, etc..

LOL - but it catched your attention...

November 26th, 2013, 05:46 PM	#1
lds17pl I got myself banned Join Date: May 2010 Posts: 509 Thanks: 5,978 Thanked 5,984 Times in 616 Posts	ransomware BUNDESPOLIZEI Today got this ransomware which is only spreaded at Germany (computers with German ID): First of all: NO PANIC! - KEINE PANIK! DO NOT PAY! - KEINESFALLS ZAHLEN! Origin of this ransomware is Bulgaria. Although Interpol and Europol know location and cyber criminals responsible persons at Bulgaria aren't able or willing to stop. (There are many other malewares and ransomwares from there, too.) How to remove this ransomware: - call-up task manager and terminate browser process - go offline - start malware cleaner like PrivaZer (see below) - after done shut down your pc - wait some minutes - reboot Of course you should have installed malware cleaner before you get attacted by ransomware/malware blocking your browser! E.g. freeware pc cleaner PrivaZer 2.9. here http://vintage-erotica-forum.com/sho...&postcount=211 __________________ Sorry, no re-up at dead links. Last edited by lds17pl; November 28th, 2013 at 08:14 PM.. Reason: cross link to post at useful programs

December 2nd, 2013, 07:28 PM	#4
slimOl55 Senior Member Join Date: Mar 2009 Posts: 845 Thanks: 24,267 Thanked 4,956 Times in 774 Posts	Ransomeware removal Had this same pop up block my firefox browser on mac system! What a pain in the ass - its taken a few attempts to find and destroy. The software is free and its called CCleaner from pirisoft slimol55

January 31st, 2014, 02:37 PM	#6
lds17pl I got myself banned Join Date: May 2010 Posts: 509 Thanks: 5,978 Thanked 5,984 Times in 616 Posts	Tonight got same attack by BUNDESPOLIZEI once more. This time successfully tried other manner to remove (Windows 7, Firefox): - if download in progress do nothing until finished or terminate, ) - start Task Manager and terminate browser process, - start AdwCleaner and remove detected malware. ) Suggest to terminate any upload to avoid spreading malware. Security Task Manager didn't detected any malware. Firefox starts without any trouble. (Btw: at closing my FF all cookies and others are removed.) AdwCleaner http://vintage-erotica-forum.com/sho...&postcount=219 Security Task Manager http://vintage-erotica-forum.com/sho...&postcount=207 __________________ Sorry, no re-up at dead links. Last edited by lds17pl; January 31st, 2014 at 02:47 PM..

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

November 27th, 2013, 02:55 PM	#2
Corvuscorax Junior Member Join Date: Jun 2008 Posts: 6 Thanks: 20 Thanked 70 Times in 5 Posts	Thankfully this is a rather dumb malware specimen. After terminating IE and restarting, nothing was found by the virus scanner, not even in the internet explorer and java caches. But this can change anytime. I once had an early version of the fake virus alert ransomware, was easy to get rid of. About two years later i had to struggle with an identically looking, but much harder to remove successor.

November 28th, 2013, 07:14 AM	#3
pigulici Senior Member Join Date: Apr 2007 Posts: 131 Thanks: 4,341 Thanked 787 Times in 125 Posts	In my country, it have 1-2 years old this type of ransomware, ofcourse the "Romanian police" version, I think was spread more on est Europe, because it is more likely to find targeted victims(a lot of people are use pirated digital content), I think because now all est people already know it is a fake, so less victims, they are moving to more "civilized" countrys, maybe now it will close the cyber criminals...

January 31st, 2014, 03:00 PM	#7
boneym Senior Member Join Date: Mar 2010 Location: Austria Posts: 140 Thanks: 10,407 Thanked 1,755 Times in 134 Posts	Funny, if the link this OP provided wouldnt have linked to another VEF post, I could have bet my ass that it contained yet another virus! It has everything a good phishing mail has (just in a forum post), like bold letters in colors, etc..