Ransomware Attack: Help Needed

[jwnova]

On 12/24 I picked up a full page lock/FBI ransomware. Couldn't do anything with PC (Win8). I closed down PC, restarted and ran a ful McAfee scan. I got use of my computer back in general. My Firefox email works fine but my IE email system only lets me access my Juno webmail but when I try to read any email all the emails disappear. Nothing happens when I click on Inbox or Junk mail.

 

The people at the Microsoft forum think my system is probably still infected and after saying they thought a reset "may" solve the problem they referred me to your forum.  Any thoughts on what I can do to solve this problem?  Thanks.

[MrCharlie]

Welcome to the forum, please start HERE

Post back the 2 logs here.....DDS.txt and Attach.txt

(please don't put logs in code or quotes and use the default font)

General P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

<====><====><====><====><====><====><====><====>

Next................

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

[jwnova]

I ran RogueKiller 64 bit scan on my Win 8 PC. Here is the report:

 

RogueKiller V8.8.0 _x64_ [Dec 27 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8 (6.2.9200 ) 64 bits version
Started in : Normal mode
User : Walsh [Admin rights]
Mode : Scan -- Date : 12/28/2013 11:33:54
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD10EZEX-75ZF5A0 +++++
--- User ---
[MBR] 3993fc2c533731fe333148491367403c
[bSP] ff40512fcd452d66e6b96be02dc468ca : Empty MBR Code
Partition table:
0 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 1 | Size: 2097152 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_12282013_113354.txt >>


 

[MrCharlie]

OK for W8 run this:

Please download Farbar Recovery Scan Tool and save it to a folder. (use correct version for your system.....Which system am I using?)

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

New window that comes up.

MrC

[jwnova]

I ran Farbar and attached the results in a reply but the results are gone. ?

 

Did the Rogue Killer scan show infection?

[MrCharlie]

I ran Farbar and attached the results in a reply but the results are gone. ?

 

Did the Rogue Killer scan show infection?

Post them again

 

RK didn't show anything bad

 

MrC

[jwnova]

Here  are the Farbar results again. BTW, I picked up a conduit virus as well. Since this is a new PC and have Carbonite I think it might be best just to reset my Win*. Is it likely that this infection could spread through my network to my laptop?  It is working ok.

 

 

FRST.txt

Addition.txt

[MrCharlie]

OK, go ahead and do that......MrC

[jwnova]

Thanks for your help.

 

In your experience will the Win 8 reset cure all my problems?

 

What if I just restore to an earlier date?

 

Also, what are the chances this infection will have spread through my network to my laptop?

[MrCharlie]

In your experience will the Win 8 reset cure all my problems?

Yes

What if I just restore to an earlier date?

You can try it, looks like you only have this restore point though:
24-12-2013 21:13:44 restorepoint


Also, what are the chances this infection will have spread through my network to my laptop?

It shouldn't spread.

MrC

[jwnova]

Thanks.

[jwnova]

Was the restore date in the information I sent you?

[MrCharlie]

Yes, it was in the Addition.txt from FRST.

 

There may be others.

 

MrC

[MrCharlie]

How are we doing??

Do you still need help or can I close this post??

MrC

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!