FBI Bitcoin Trojan virus, BSOD, and NTLDR missing Win 10 new install

Morgana · 03 Jan 2016

Hi- frustration is running pretty high.

Purchased a Dell XPS in November and installed Windows 10. While browsing Facebook last week, I tried to watch a video but got a message saying my flash drive needed updating. I went to Adobe and downloaded and installed the latest version, only to restart my computer and find that Firefox would no longer run due to a firewall issue (can't remember the exact wording). So we turned off the firewall and got Firefox working again. All seemed well. This morning I awoke to the blue FBI screen demanding payment in Bitcoin to unlock the computer. I wasn't terribly concerned, as we have had this happen before, and the hubs found the fix online and all was made right.

This time however, we cannot even access a boot screen. We have the BSOD and the error message that says

NTLDR is missing
press ctrl+alt+delete to restart

....which is an endless cycle leading to the same error message each time.

Any online instructions for fixing this all assume we have performed an online upgrade from an older OS, which isn't the case here. This is a brand new install of Windows 10.

Any ideas?

Sumit Dhiman · 04 Jan 2016

You would need to trigger a startup repair:
Option 5 would do this for you.
When you click repair your computer, click Startup repair.
https://www.tenforums.com/tutorials/2...dows-10-a.html

Morgana · 04 Jan 2016

Sumitdhiman said:

You would need to trigger a startup repair:
Option 5 would do this for you.
When you click repair your computer, click Startup repair.
https://www.tenforums.com/tutorials/2...dows-10-a.html

Thanks so much for your reply.

So you think this will work even though our hard drive is locked?

Morgana · 04 Jan 2016

My husband said that he tried the repair protocol that you suggested, but said that when he got to step 3. he got a message saying that the hard drive is locked.

csun · 04 Jan 2016

Windows 10 Forums - Search Results

The above previous threads may be of help.

simrick · 04 Jan 2016

Morgana said:

Hi- frustration is running pretty high.

Purchased a Dell XPS in November and installed Windows 10. While browsing Facebook last week, I tried to watch a video but got a message saying my flash drive needed updating. I went to Adobe and downloaded and installed the latest version, only to restart my computer and find that Firefox would no longer run due to a firewall issue (can't remember the exact wording). So we turned off the firewall and got Firefox working again. All seemed well. This morning I awoke to the blue FBI screen demanding payment in Bitcoin to unlock the computer. I wasn't terribly concerned, as we have had this happen before, and the hubs found the fix online and all was made right.

This time however, we cannot even access a boot screen. We have the BSOD and the error message that says

NTLDR is missing
press ctrl+alt+delete to restart

....which is an endless cycle leading to the same error message each time.

Any online instructions for fixing this all assume we have performed an online upgrade from an older OS, which isn't the case here. This is a brand new install of Windows 10.

Any ideas?

Hi.
I would try running the Kaspersky Rescue Disk to try and clear out the infection first. This would need to be downloaded to a clean computer, and burned to disk. Then you would boot the infected system from the disk and run the scan.

After successful cleaning, you can try the Startup Repair mentioned earlier.

If all else fails, you can invoke the recovery partition of the system, and restore the computer to factory condition. Keep in mind that any files/programs added since you got the computer would be lost.

p.s. Never turn off the firewall. Never believe notices from FB that your system needs updating. Never click on update links-instead, go directly to the manufacturer of the software and download from there.

EDIT:
This is a very similar infection; the instructions may work for you as well.
Remove the FBI MoneyPak Ransomware or the Reveton Trojan

mrgeek · 04 Jan 2016

"I tried to watch a video but got a message saying my flash drive needed updating. I went to Adobe and downloaded and installed the latest version"

This 'update your flash player' pop up is common ruse. I take it you used the 'Adobe' download link in the window vs typing adobe.com and getting your download there ? Once you're sorted out, bookmark this link from Adobe which incl a test as to whether your version is up to date and a link to download latest version -
Flash Player Help