Eimulis Posted June 26, 2017 ID:1138355 Share Posted June 26, 2017 My friend got a PC LOCK ransomware, it encrypted some files and it looked like this one: https://www.symantec.com/security_response/writeup.jsp?docid=2015-041313-2527-99&tabid=2 I've used Malwarebytes to remove this and other malware (~2000 entries). After that I found Emsisoft decrypter but it doesn't detect PCLOCK and doesn't start so I can't restore the decrypted files. How can I revert Malwarebytes scan and restore PC LOCK in order to start Emsisoft decrypter? Link to post Share on other sites More sharing options...
nikhils Posted June 26, 2017 ID:1138369 Share Posted June 26, 2017 Hi @Eimulis Moving this post from the Malwarebytes 3.x section to the Malware removal section. One of our Malware removal expert will help you answer your question. Thank you. Link to post Share on other sites More sharing options...
Aura Posted June 26, 2017 ID:1138373 Share Posted June 26, 2017 Hi Eimulis, Can you upload an encrypted file and a ransom note to ID-Ransomware, and copy/paste the result it gives you here? https://id-ransomware.malwarehunterteam.com/ Link to post Share on other sites More sharing options...
Eimulis Posted June 27, 2017 Author ID:1138597 Share Posted June 27, 2017 It shows: Unknown Ransomware Unable to determine ransomware. There is the note Link to post Share on other sites More sharing options...
Aura Posted June 27, 2017 ID:1138598 Share Posted June 27, 2017 Weird. Can you follow the instructions in the thread below and provide me the FRST.txt and Addition.txt files? https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/ Link to post Share on other sites More sharing options...
Eimulis Posted June 27, 2017 Author ID:1138642 Share Posted June 27, 2017 Here they are Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Aura Posted June 27, 2017 ID:1138646 Share Posted June 27, 2017 Alright. After running the fix below, a file called "DATE-TIME.zip" (where DATE and TIME are the date and time on which the FRST fix was ran) will be on your desktop. Upload it to the link below. http://www.bleepingcomputer.com/submit-malware.php?channel=194 Farbar Recovery Scan Tool (FRST) - Fix mode Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply. Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located); Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users); Click on the Fix button; On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad; Copy and paste its content in your next reply; fixlist.txt Link to post Share on other sites More sharing options...
Eimulis Posted June 29, 2017 Author ID:1139196 Share Posted June 29, 2017 Should the fix take long? It took more than 4 hours already Link to post Share on other sites More sharing options...
Aura Posted June 29, 2017 ID:1139197 Share Posted June 29, 2017 No it shouldn't. You can kill the FRST process if needed. You should have a fixlog.txt file on your desktop. Open it, and copy/paste its content here. Link to post Share on other sites More sharing options...
Eimulis Posted June 29, 2017 Author ID:1139215 Share Posted June 29, 2017 (edited) it looks like it made this zip file: https://drive.google.com/open?id=0BwTeHnZg8xyidDAwTEdEdW9GT1k I've tried to sumbit it to the http://www.bleepingcomputer.com/submit-malware.php?channel=194 but I've got the message "The size of your file is greater than maximum file size of 10 MBs." so I'm not shure if it uploaded Edited June 29, 2017 by Eimulis Link to post Share on other sites More sharing options...
Aura Posted June 29, 2017 ID:1139219 Share Posted June 29, 2017 Got it. Do you have the fixlog.txt file I mentionned in my previous post too? It should be on your desktop. Link to post Share on other sites More sharing options...
Eimulis Posted June 29, 2017 Author ID:1139233 Share Posted June 29, 2017 It's not there, maybe because the fix process didn't ended Link to post Share on other sites More sharing options...
Aura Posted June 29, 2017 ID:1139242 Share Posted June 29, 2017 Alright. Follow the instructions to run the FRST fix again, but this time, use the fixlist.txt attached below. fixlist.txt Link to post Share on other sites More sharing options...
Aura Posted July 2, 2017 ID:1139975 Share Posted July 2, 2017 Hi Eimulis, Are you still with me? Link to post Share on other sites More sharing options...
Eimulis Posted July 3, 2017 Author ID:1140150 Share Posted July 3, 2017 I'm here, my friend will do it later today Link to post Share on other sites More sharing options...
Aura Posted July 4, 2017 ID:1140310 Share Posted July 4, 2017 Alright I'll be waiting Link to post Share on other sites More sharing options...
Aura Posted July 7, 2017 ID:1141187 Share Posted July 7, 2017 Hi Eimulis, Are you still with me? Link to post Share on other sites More sharing options...
Aura Posted July 10, 2017 ID:1141570 Share Posted July 10, 2017 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts