Removal Instructions “Complete an offer to continue” virus (Survey Scam)

The “Complete an offer to continue” notification is a computer virus, that has locked down your desktop and is prompting you to complete an offer or survey to unlock your computer.

The “Complete an offer to continue” virus will prompt you to complete various surveys or promotions because for each one you finish, the cyber criminals behind this malicious program will receive a commission. Some of the offers and surveys that you may see include:

• Shop & Save with this free Toolbar download!
• Breakfast on Us with a Dunkin’ Donuts Gift Card!
• FREE pair of Studio Beats by Dr. Dre!
• Take a back to school shopping spree!
• Get FREE McDonald’s!
• Take this survey & get a Visa gift card!
• Win a voucher for drinks at Starbucks!

Each time you’ll click on any of these surveys, Internet Explorer will open and you’ll need to complete a short survey , and then this lock screen will be able to detect when you have properly completed the task and then unlock your computer.

In most cases, even after you have completed an offer or survey, you won’t get access to your desktop and whenever you start Windows you’ll see the following message:

Unlock this Page to continue!
This page will immediately unlock and restore normal access upon your participation in an offer below. Please use valid information!
Your desktop was locked. Complete an offer below to unlock your desktop.
Complete an offer to continue.

“Complete an offer to continue” is a scam and you shouldn’t fill out any surveys, promotions, or provide your real information.

“Complete an offer to continue” – Virus Removal Instructions

STEP 1: Remove “Complete an offer to continue” lock screen from your computer

“Complete an offer to continue” virus has modified your Windows registry and added its malicious files to run at start-up, so whenever you’re trying to boot your computer it will launch instead its bogus notification.To remove these malicious changes, we can use any of the below methods:

Method 1: Start your computer in Safe Mode with Networking and scan for malware

Some variants of “Complete an offer to continue” virus will allow the users to start the infected computer in Safe Mode with Networking without displaying the bogus lock screen. In this first method, we will try to start the computer in Safe Mode with Networking and then scan for malware to remove the malicious files.

1. Remove all floppy disks, CDs, and DVDs from your computer, and then restart your computer.
2. Press and hold the F8 key as your computer restarts.Please keep in mind that you need to press the F8 key before the Windows start-up logo appears.
   Note: With some computers, if you press and hold a key as the computer is booting you will get a stuck key message. If this occurs, instead of pressing and holding the “F8 key”, tap the “F8 key” continuously until you get the Advanced Boot Options screen.
3. On the Advanced Boot Options screen, use the arrow keys to highlight Safe Mode with Networking , and then press ENTER.
   
4. If your computer has started in Safe Mode with Networking, you’ll need to perform a system scan (as seen on STEP 2) with Malwarebytes Anti-Malware and HitmanPro to remove the malicious files from your machine.

IF the “Complete an offer to continue” virus didn’t allow you to start the computer in Safe Mode with Networking,you’ll need to follow Method 2 to get rid of its lock screen.

---

Method 2: Restore Windows to a previous state using System Restore

System Restore can return your computer system files and programs to a time when everything was working fine, so we will try to use this Windows feature to get rid of “Complete an offer to continue” virus.

1. Restart your computer, and then press and hold F8 during the initial startup to start your computer in safe mode with a Command prompt.
   Note: With some computers, if you press and hold a key as the computer is booting you will get a stuck key message. If this occurs, instead of pressing and holding the “F8 key”, tap the “F8 key” continuously until you get the Advanced Boot Options screen.
2. Use the arrow keys to select the Safe mode with a Command prompt option.
   
3. At the command prompt, type cd restore, and then press ENTER.
   Next,we will type rstrui.exe , and then press ENTER.Alternatively, if you are using Windows Vista, 7 and 8, you can just type : C:\windows\system32\rstrui.exe , and press ENTER.
   If you are using Windows XP, you will need to typeC:\windows\system32\restore\rstrui.exe, and then press ENTER.
   
4. The System Restore utility will start, and you’ll need to select a restore point previous to this infection.
   
5. After System Restore has completed its task, you should be able to boot in Windows normal mode, and perform a system scan (as seen on STEP 2) with Malwarebytes Anti-Malwareand HitmanPro to remove the malicious files from your machine.

IF the “Complete an offer to continue”  virus didn’t allow you to restore your computer to a previous point, you’ll need to follow Method 3 to get rid of its screen lock.

---

Method 3: Remove “Complete an offer to continue” virus with HitmanPro Kickstart

IF you couldn’t boot into Safe Mode with Command Prompt or didn’t have a System Restore point on your machine, we can use HitmanPro Kickstart to bypass this infection, and access your computer to scan it for malware.

1. We will need to create a HitmanPro Kickstart USB flash drive,so while you are using a “clean” (non-infected) computer, download HitmanPro from the below link.
   HITMANPRO DOWNLOAD LINK (This link will open a download page in a new window from where you can download HitmanPro)
2. Insert your USB flash drive into your computer and follow the instructions from the below video:
   
3. After you have create the HitmanPro Kickstart USB flash drive, you can insert this USB drive into the infected machine and start your computer.
4. Once the computer starts, repeatedly tap the F11 key (on some machines its F10 orF2),which should bring up the Boot Menu, from there you can select to boot from your USB.
   Next,you’ll need to perform a system scan with HitmanPro as see in the below video:
   
5. After HitmanPro Kickstart has completed its task,you should be able to boot in Windows normal mode,from there you’ll need to perform a system scan (as seen on STEP 2) withMalwarebytes Anti-Malware and HitmanPro to remove the malicious files from your machine.

---

STEP 2: Remove “Complete an offer to continue” malicious files from your computer

Run a computer scan with Malwarebytes Anti-Malware Free

---

STEP 3: Reset the Windows Hosts file back to its default settings

The “Complete an offer to continue” virus has modified your Hosts file, so that you’ll be redirected to those survey websites. To reset the Hosts file back to its default settings, we will run Microsoft Fix it 50267.

1. Download Microsoft Fix it 50267 from the below link.
   MICROSOFT FIX IT 50267 DOWNLOAD LINK  (This link will automatically download Microsoft Fix it 50267 on your computer)
2. Double click on MicrosoftFixit50267, then follow the prompts to reset your Windows Hosts file.