Received: by 10.66.84.41 with SMTP id v9mr1014112pay.43.1348747039317;
        Thu, 27 Sep 2012 04:57:19 -0700 (PDT)
X-BeenThere: 091labs-public@googlegroups.com
Received: by 10.68.237.161 with SMTP id vd1ls9481620pbc.3.gmail; Thu, 27 Sep
 2012 04:57:18 -0700 (PDT)
Received: by 10.66.84.168 with SMTP id a8mr1004893paz.25.1348747038953;
        Thu, 27 Sep 2012 04:57:18 -0700 (PDT)
Received: by 10.66.84.168 with SMTP id a8mr1004891paz.25.1348747038944;
        Thu, 27 Sep 2012 04:57:18 -0700 (PDT)
Return-Path: <domhn...@091labs.com>
Received: from mail-pb0-f44.google.com (mail-pb0-f44.google.com [209.85.160.44])
        by gmr-mx.google.com with ESMTPS id j3si1468620paz.2.2012.09.27.04.57.18
        (version=TLSv1/SSLv3 cipher=OTHER);
        Thu, 27 Sep 2012 04:57:18 -0700 (PDT)
Received-SPF: neutral (google.com: 209.85.160.44 is neither permitted nor denied by best guess record for domain of domhn...@091labs.com) client-ip=209.85.160.44;
Authentication-Results: gmr-mx.google.com; spf=neutral (google.com: 209.85.160.44 is neither permitted nor denied by best guess record for domain of domhn...@091labs.com) smtp.mail=domhn...@091labs.com
Received: by mail-pb0-f44.google.com with SMTP id ro8so3531083pbb.31
        for <091labs-public@googlegroups.com>; Thu, 27 Sep 2012 04:57:18 -0700 (PDT)
        d=google.com; s=20120113;
        h=mime-version:x-originating-ip:in-reply-to:references:date
         :message-id:subject:from:to:content-type:x-gm-message-state;
        bh=aWg825VQA0bhNe/h34x5h8be1USBJdhhMNo6n5TX0fc=;
        b=VykBJrIA9kCvo5fsYMhRvlsnC5Y59sf4HWnAyczqMu92BZGU8kSvfGjVyXN0zkIfci
         hh+DXbxN7GxjvRYzLD+rg8Ahmc9GgeIcQiSx6B3eH2t5RJpSKjwaibbxAsuup7HRoapQ
         qfFskuPMFPwEKfNTlDGSV5JZJp5VD45Y5N2JfV1sk0WqLK4krhUpZyhA/FCIuzBqJMHN
         kajtUbGcgu71MT0kMvDcZ57m1+6MCa7WEpaLfhJziPEjpNgsN6UpLUtFyrmCllQMgv7I
         7Np59OpEPeWuVl+edqj95nEo96fuYGt1hFqBsa0JFMWcQ6JiIcDnuvZp/u855wpWXs8Y
         QBvQ==
MIME-Version: 1.0
Received: by 10.66.83.129 with SMTP id q1mr8889556pay.4.1348747038812; Thu, 27
 Sep 2012 04:57:18 -0700 (PDT)
Received: by 10.68.29.66 with HTTP; Thu, 27 Sep 2012 04:57:18 -0700 (PDT)
X-Originating-IP: [46.7.216.36]
Received: by 10.68.29.66 with HTTP; Thu, 27 Sep 2012 04:57:18 -0700 (PDT)
In-Reply-To: <c61d8d9a-49a2-4e74-a108-df9aa5f084d7@googlegroups.com>
References: <c61d8d9a-49a2-4e74-a108-df9aa5f084d7@googlegroups.com>
Date: Thu, 27 Sep 2012 12:57:18 +0100
Message-ID: <CADekp5QiHA-BX025kcnQNyevGENdq9Ke-e9aOoU74mzsRfQ...@mail.gmail.com>
Subject: Re: [091labs-public] ransomware in Irish
From: Domhnall Walsh <domhn...@091labs.com>
To: 091labs-public@googlegroups.com
Content-Type: multipart/alternative; boundary=f46d042ef43323ea7704caada45e
X-Gm-Message-State: ALoCoQmM+kTEXsqL2c2/PpPXItdSa6UNTitnfYAhv7AFBJ4Y07nbNJOyfmrwotp2+diFohV9T6Qp

--f46d042ef43323ea7704caada45e
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

Without seeing it, no. Get it to me, I'll sort it.
On 27 Sep 2012 12:55, "calcrea" <calc...@gmail.com> wrote:

> Hey guys, got phoned this morning by the old man, his laptop has been
> taken over by a virus that just displays an official looking Irish langua=
ge
> page. basically it demands =80100 to unlock the comp. Tried to remove it =
but
> cmd prompts and safe mode won't start so Im stumped. Anyone been hit by
> this or know how to remove it? Thanks :-)
>

--f46d042ef43323ea7704caada45e
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

<p dir=3D"ltr">Without seeing it, no. Get it to me, I&#39;ll sort it.</p>
<div class=3D"gmail_quote">On 27 Sep 2012 12:55, &quot;calcrea&quot; &lt;<a=
 href=3D"mailto:calc...@gmail.com">calc...@gmail.com</a>&gt; wrote:<br type=
=3D"attribution"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex">
Hey guys, got phoned this morning by the old man, his laptop has been taken=
 over by a virus that just displays an official looking Irish language page=
. basically it demands =80100 to unlock the comp. Tried to remove it but cm=
d prompts and safe mode won&#39;t start so Im stumped. Anyone been hit by t=
his or know how to remove it? Thanks :-)<br>

</blockquote></div>

--f46d042ef43323ea7704caada45e--