I need help with the Help_Decrypt virus

[jefflci]

I have attached the farbar recovery files FRST & Addition

Addition.txt

FRST.txt

[MrCharlie]

Welcome to the forum.

Here's the tutorial on that infection...please read through it.

Your files are most likely gone.

http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information

There's a slim chance you may recover some files by these methods:

http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#restore

================================

Make sure you have created a restore point and.....

Download Delfix from Here and save it to your desktop.

• Place a check mark in front of .......
• Create registry backup <---only!
• Uncheck the rest!
• Click the Run button.

  Close the tool out when it's done....we'll use it later.

  ======================

  Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.

  Run FRST.exe/FRST64.exe and click Fix only once and wait

  The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

  ==========================

  Download Malwarebytes Anti-Rootkit from HERE

  Run the file and follow the onscreen instructions to extract it to a location of your choosing (your desktop by default)

  Malwarebytes Anti-Rootkit will then open, follow the instruction in the wizard to update and allow the program to scan your computer for threats

  Click on the Cleanup button to remove any threats and reboot if prompted to do so

  Wait while the system shuts down and the cleanup process is performed

  Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process

  =====================

  Then...........

  Please download and run ComboFix.

  The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

  Please visit this webpage for download links, and instructions for running ComboFix

  http://www.bleepingcomputer.com/combofix/how-to-use-combofix

  http://www.bleepingcomputer.com/download/combofix/dl/12/<---ComboFix direct download

  Please make sure you click download buttons that look similar to this, not "sponsored ad links":

  

  Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  Information on disabling your malware programs can be found Here.

  Make sure you run ComboFix from your desktop.

  Give it at least 30-45 minutes to finish if needed.

  Please include the C:\ComboFix.txt in your next reply for further review.

  ---------->NOTE<----------

  If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

  ===============================

  Please re-scan with FRST and Make sure the Addition Box is checked.

  http://www.fixitpc.pl/picasso/images/malware/tools/frst/frst_win05.png

  Post or attach the 2 logs FRST.txt and Addition.txt

  MrC

fixlist.txt

[jefflci]

Here are the files after I ran combo fix

Addition after.txt

Combofix log.txt

FRST after combofix.txt

[MrCharlie]

Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.

Run FRST.exe/FRST64.exe and click Fix only once and wait

The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

 

==========================

 

Did you run MBAR???  Log???

 

How is it????

 

MrC

fixlist.txt

[jefflci]

I did run the MBAR and I attached the log.

 

Seems to be running good. could recover the files but that's Ok the ones I need can be recreated and the photos have backups.

 

Thank You 

system-log.txt

[jefflci]

Sorry,

meant to say I couldn't recover the file

[MrCharlie]

OK..........

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• If you get Unsupported operating system. Aborting now, just reboot and try again.
• A Notepad document should open automatically called checkup.txt.
• Please Post the contents of that document.
• If you can't post it, attach it

MrC

[jefflci]

This is from The Security Check Up

 

 Results of screen317's Security Check version 1.005  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

AVG AntiVirus Free Edition 2015   

 Antivirus up to date!   

`````````Anti-malware/Other Utilities Check:````````` 

 Adobe Reader XI  

 Google Chrome (43.0.2357.134) 

 Google Chrome (44.0.2403.89) 

 Google Chrome (plugins...) 

````````Process Check: objlist.exe by Laurent````````  

 AVG avgwdsvc.exe 

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 1% 

````````````````````End of Log`````````````````````` 

[MrCharlie]

That looks OK.....

A little clean up to do....

Please Uninstall ComboFix: (------->if you used it<-------)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter. (it may look like CF is re-installing but it's not)

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!