MegaSource

I did find this one file. How can I know the server is "clean?" README.txt

Here is the MBAR Log File from one workstation. Still waiting on the other one. How can a ransomeware exist and not be seen by MBAR? mbar-log-2022-05-17 (12-44-59).txt

The MBAR Tool on the Server reported no malware. I am running the MBAR tool on the other two workstations.

This is a private office running medical billing software. I am their technical adviser. Last Friday, they were hit with a crypto (Ransom.crysis) virus, but did not receive a decryption message. I cleaned what I could and Malwarebytes cleaned the system. No notice of payment or ransomeware. I reinstalled the medical software and restored a backup. This morning, they reported the .anigma extension on all their data files.

Here is the Malwarebytes Log MalwarebytesLog.txt

Files primarily on the P: drive (Physical drive) have been changed by adding .anigma to the end of the files. Please advise FRST_17-05-2022 11.12.25.txt Addition_17-05-2022 11.12.25.txt