25/04/2016

RemovingransomwareusingtheAntiRansomwareTool|TrendMicro

(/enus/home/ti10sitesurvey.aspx)

Home&HomeOfceSupport

DownloadingandusingTrendMicroAnti
RansomwareTool(forHomeUsers)
Ransomwareisatypeofmalwarethatpreventsorlimitsusersfromaccessingtheirsystem.This
Ransomwareisatypeofmalwarethatpreventsorlimitsusersfromaccessingtheirsystem.This
typeofmalwareforcesitsvictimstopaytheransomthroughcertainmethodsinordertogrant
accesstotheirsystems,ortogettheirdataback.Therearetwo(2)typesofRansomware:Lock
accesstotheirsystems,ortogettheirdataback.Therearetwo(2)typesofRansomware:
Lock
Screenwhichlimitstheusersfromaccessingthecomputerand
Screen
whichlimitstheusersfromaccessingthecomputerandCrypto(FileEncryption)
Crypto(FileEncryption)which
which
encryptsfilestolimitusersfromaccesstheirfiles.AntiRansomwaretoolisdesignedtoeliminate
LockScreenransomwarefromyourinfectedPCintwodifferentscenarios:
LockScreen
ransomwarefromyourinfectedPCintwodifferentscenarios:
Scenario1:LockScreenransomwareisblockingnormalmode,butsafemodewithnetworking
isstillaccessible.
Scenario2:LockScreenransomwareisblockingbothnormalmodeandsafemodewith
networking.

DownloadTheTrendMicroAntiRansomwareTool(Scenario1)

Scenario1:LockScreenRansomwareisblockingnormalmodebutSafeModewith
Scenario1:LockScreenRansomwareisblockingnormalmodebutSafeModewith
networkingisstillaccessible
1.GotoSafemodewithNetworking.
GotoSafemodewithNetworking.
2.DownloadtheAntiRansomwareToolandsaveittoyourdesktop.
DownloadtheAntiRansomwareToolandsaveittoyourdesktop.
DownloadAntiRansomwareTool
(http://solutionfile.trendmicro.com/solutionfile/1105975/AR20_build14.exe)
3.Doubleclick
DoubleclickAR20_build14.exe
AR20_build14.exetorunit.
torunit.
Note:ThistoolcanbeinstalledonSafeModewithNetworking.AlsothroughUSBon
RegularSafeModeandSafeModewithCommandPrompt.
4.Click
ClickInstall
InstalltostartextractingtheAntiRansomwaretool.
tostartextractingtheAntiRansomwaretool.
Note:ForWindowsXPusers,makesuretouncheckProtectmycomputeranddatafrom
Note:ForWindowsXPusers,makesuretouncheck
Protectmycomputeranddatafrom
unauthorizedprogramactivitybeforerunningthetool.
unauthorizedprogramactivity
beforerunningthetool.

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1105975.aspx

1/5

25/04/2016

RemovingransomwareusingtheAntiRansomwareTool|TrendMicro

5.OnceAntiRansomwarehasbeeninstalled,restartyourcomputerandgotonormalmode
OnceAntiRansomwarehasbeeninstalled,restartyourcomputerandgotonormalmode
wherethescreenislockedbytheransomware.
6.TriggertheAntiRansomewareToolbypressingthefollowingkeys:Left
TriggertheAntiRansomewareToolbypressingthefollowingkeys:LeftCTRL+ALT+T+
CTRL+ALT+T+
I.
Note:Thekeypressshouldbedoneontheclientskeyboardandnotfromsupportside
(RemoteControl/LMI).Insomecases,thekeypressmayneedtobedonemorethan
once.
7.ThescreenlockshouldterminateandtheAntiRansomwarescreenshouldappear.
ThescreenlockshouldterminateandtheAntiRansomwarescreenshouldappear.

8.Click
ClickScan
Scantoscanthecomputerforanyransomwarefiles.
toscanthecomputerforanyransomwarefiles.
9.Reviewandselectthethreatsthatyouhaveverifiedtobemaliciousthenpress
ReviewandselectthethreatsthatyouhaveverifiedtobemaliciousthenpressClean
Clean..
10.Click
ClickReboot
Reboottorestartthecomputer.
torestartthecomputer.

DownloadTheTrendMicroAntiRansomwareTool(Scenario2)

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1105975.aspx

2/5

25/04/2016

RemovingransomwareusingtheAntiRansomwareTool|TrendMicro

Scenario2:LockScreenRansomwareisblockingbothnormalmodeandsafemodewith
Scenario2:LockScreenRansomwareisblockingbothnormalmodeandsafemodewith
networking
1.Onaworkingornoninfectedcomputer,downloadAntiRansomwareTool(USB)andsave
Onaworkingornoninfectedcomputer,downloadAntiRansomwareTool(USB)andsave
ittoyourdesktop.
DownloadAntiRansomware3.0(USB)
(http://solutionfile.trendmicro.com/solutionfile/1105975/AR4USB_build11.rar)
2.ExtractthecontentsofAR4USB_build11.rar.
ExtractthecontentsofAR4USB_build11.rar.
3.InsertaUSBdrive.
InsertaUSBdrive.
4.Doubleclick
DoubleclickARUSBMaker.exe
ARUSBMaker.exetoinstallthepackage.
toinstallthepackage.

5.Click
ClickYes
YeswhentheUserAccountControlwindowappears.
whentheUserAccountControlwindowappears.
6.SelecttheUSBdrivethenclick
SelecttheUSBdrivethenclickCreate
Create..
Important:ThiswilleraseallthecontentsoftheUSBdrive.
Important
:ThiswilleraseallthecontentsoftheUSBdrive.

7.InserttheUSBdriveontheinfectedcomputer.
InserttheUSBdriveontheinfectedcomputer.
8.BoottheinfectedcomputerfromtheUSBdrive.
BoottheinfectedcomputerfromtheUSBdrive.
https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1105975.aspx

3/5

25/04/2016

RemovingransomwareusingtheAntiRansomwareTool|TrendMicro

IftheUSBdriveisdetected,youwillseethistextonyourscreenwhilethecomputeris
restarting:

IftheUSBdriveisnotdetected,doanythefollowing:
InserttheUSBtoanotherUSBportandrestartthecomputer.
MakesurethattheUSBisproperlyinserted.
TryusinganotherUSB.
9.LogintotheinfectedcomputerandwaitfortheAntiRansomwareTooltosuspendthelock
LogintotheinfectedcomputerandwaitfortheAntiRansomwareTooltosuspendthelock
screenandopentheconsole.
Note:Thetoolwillautomaticallyinitiatebyitself.Thereisnokeytriggerimplementedtocall
outthetool.
10.Continueusingthetoolfortroubleshooting.
Continueusingthetoolfortroubleshooting.

11.Click
ClickScan
Scan..
https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1105975.aspx

4/5

25/04/2016

RemovingransomwareusingtheAntiRansomwareTool|TrendMicro

12.Thescanresultswillbedisplayed.Click
Thescanresultswillbedisplayed.ClickFixNow
FixNow..

AppliesTo:Antivirus+Security
AppliesTo:
Antivirus+Security2015Antivirus+Security
2015Antivirus+Security2016InternetSecurity
2016InternetSecurity2015InternetSecurity
2015InternetSecurity
2016MaximumSecurity2015Ma
2016MaximumSecurity
2015Ma...
...More
More
LastUpdated:Dec.16,20153:23AM
LastUpdated:
Dec.16,20153:23AM(PST)
(PST)
SolutionID:1105975
SolutionID:
1105975

PrivacyPolicy(http://www.trendmicro.com/us/aboutus/legalpolicies/privacy
PrivacyPolicy(http://www.trendmicro.com/us/aboutus/legalpolicies/privacy
statement/index.html)
TrendMicro(http://www.trendmicro.com/)
TrendMicro
(http://www.trendmicro.com/)
Feedback
Copyright20142015TrendMicroIncorporated.Allrightsreserved.
Copyright20142015TrendMicroIncorporated.
Allrightsreserved.

https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1105975.aspx

5/5