help_decrypt on startup - Cryptowall 3.0 Removal

[bozo471]

I just noticed today starting up the computer a text file called help_decrypt.txt opens on startup. It is completely blank but when I check where it is saved I find several help_decrypt files.

These other files are an html file, shortcut, and a png.

I did a little research and the png looked exactly like what I found to be Cryptowall 3.0

I was suffering due low cpu performance due to several internet explorer applications attempting to startup but Malwarebytes blocked it every second. I have already preformed a scan and cpu performance is pretty normal but the files are still in %appdata% and I fear for the worst of this infection.

It looks like I have Cryptowall 3.0 and I need help completely removing this before the situation worsens even further.

 

The blank help_decrypt.txt still pops up whenever I boot the computer.

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
     
    
Before we start please read and note the following:

• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
• Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
 
 

Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[bozo471]

Here are the logs from the Farbar Recivery Scan Tool.

Addition.txt

FRST.txt

[TwinHeadedEagle]

Scan with Malwarebytes' Anti-Malware
 
Please download Malwarebytes Anti-Malware and save it to your desktop.

• Install the progam and select update.
• Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.
 
 
 
 
 

Scan with ComboFix
 
This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!
 
Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).

Include that log in your next reply.
If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

[bozo471]

After running Combofix and rebooting once I got the dialog box that said preparing log report do not run any programs until Combofix is finished.

I left the computer and when I had returned, the desktop was blank except for 3 icons my user folder, computer, and recycle bin. Many files had also been removed leaving me with an extra 80gb.

No log file showed up and I am stuck on what to do next.

[TwinHeadedEagle]

Did you try to restart your PC? What files are removed? Did you execute MalwareBytes scan first?

[bozo471]

Tried restarting pc. Now boot loops upon starting up.

 

The files that were removed were all non-program files (pictures, documents, etc) and some program were removed but not all.

 

I did execute the malwarebytes scan first and it detected no issues with the rootkit finder on.

[TwinHeadedEagle]

Your PC is Windows 8, right? How were you able to run ComboFix at all, I made a mistake by giving this to you, because it isn't working under Windows 8.

[bozo471]

Yes running windows 8.1(64-bit) and noticed that the guide said combofix does not support this OS but I ran it anyway. Note: Combofix did pop a few errors when I was running it but I disregarded them.

 

Computer still stuck in a boot loop.

[TwinHeadedEagle]

You should inform me about this, now we will try to restore your PC to working condition outside Windows.
 
 
Please download Farbar Recovery Scan Tool x64 and save it to a flash drive.

• Plug the flashdrive into the infected PC.
• Restart your computer and tap F8 to bring up the Advanced Menu, then click Repair your computer
• Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.
• In the Choose Recovery Tool menu select Command Prompt.
• You will see a big black window with a blinking cursor (command prompt).
   
   
   
  Access the notepad and identify your USB drive
   
  In the Command Prompt please type in:
  

  notepad

  and press Enter.
• When the notepad opens, go to File menu.
• Select Open.
• Go to Computer and search there for your USB drive letter.
• Note down the letter and close the notepad.
   
   
   
  Scan with Farbar Recovery Scan Tool
   
  Once back in the command prompt window, please do the following:
• Type in e:\frst64.exe and press Enter.
  You need to replace e with the letter of your USB drive taken from notepad!
• FRST will start to run. Give him a minute or so to load itself.
• Click Yes to Disclaimer.
• In the main console, please click Scan and wait.
• When finished it will produce a logfile named FRST.txt in the root of your pendrive and display it. Close that logfile.
   
  Transfer it to your clean machine and include it in your next reply.

[bozo471]

Here is the log.

FRST.txt

[bozo471]

I also checked for restore points and I have none.

[TwinHeadedEagle]

Your system seems too much damaged, I don't think we can save it now. You should reinstall it or recovery from recovery partition. I see you have one present.

[bozo471]

I tried using the recovery partition but after using it I realized it was a copy of the one for my HP computer and of course the system re-installation failed since it was attempted on my Dell.

I was just using it since the Dell's recovery partition disappeared after using ComboFix somehow.
 

Now I am stuck once again.

[TwinHeadedEagle]

Then only option left is to reinstall your Windows.

[Naathim]

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!