Virtual machine Windows 10 KMSPico encrypted disk - affected on mac photos

[Bosman]

Let me first describe the situation:

Macbook pro of 4~5 years old, running macOS Mojave 10.14.1 - only pictures encrypted
Using VMware i'm running (if needed) windows 7, to make PCB designs. - no problems noticed here
Recently installed: Parallels with windows 10, to make PCB designs - here is where the problem started.

Since i was facing some problems on the W7 machine (newer versions are not supported that well), i decided to play around with a new virtual machines, i installed parallels and Windows 10.

This worked out well, but i was not done with the complete journey and was still facing some problems. I thought it could be caused by the non-activated version of windows, so i decided to download KMSPico. 

I saw some suspicious thing happening on my screen, but i was under the assumption that nothing could happen since i'm working in a virtual machine.
The KMSPico installation took way too long, and accidentally i saw something similar to encrypted disk of a friend: a textfile with a weird name, and text about decryption in it. Not good.
The mac partition was accessible by the windows, via the build-in functions of parallels, i think this is the way it also partially infected my mac.

Next i shut down the parallels W10 machine, but Finder in max was also very very busy. So i killed finder, and started to look if there was any damage on my mac: the pictures folder appear to be encrypted.

 

As suggested by this website, i have done a malware bytes scan, and farbar scan. The scan is done by the OTHER, NOT INFECTED W7 virtual machine, since i'm afraid the damage will be worse if i startup the W10 again. It could be the case that the found infections have nothing to do with the infections in the other virtual machine, but i'm not sure. See attachments.

The infected folders all have a text file with the following filename: OUMELYEOCA-DECRYPT.txt - also added in attachments.

If i have to do the scan in the infected virtual machine, i might unlink the drive, but i would like to know if it is really needed.

2018-12-14 Malwarebytes scanlog W7.txt

OUMELYEOCA-DECRYPT.txt

Addition.txt

FRST.txt

[AdvancedSetup]

Hello @Bosman and

Please see the following post and see if this helps with recovery of your data.

https://www.bleepingcomputer.com/news/security/free-decrypter-available-for-the-latest-gandcrab-ransomware-versions/

I would not re-enable the Windows 10 VM with it connected to data on the Mac.

 

[Bosman]

Thank you for your reply.

I have downloaded the grandcrab decryption tool, and executed it on the non-infected virtual machine. After i started the scan it sais: initialization failed.

The log files are attached in this post. What should i do next? Thanks in advance.

BDRansomDecryptor4556.log

BitdefenderLog.txt

[AdvancedSetup]

I would say go back and follow their directions closely and have the sample unmodified file they say to use. The log indicates the key was not found to decrypt.

 

 

[Bosman]

Dear Malwarebytes,

This message does noet realy help me. What do you mean with: "follow their directions and have the sample unmodified file"? i believe i did what i should do:

I have followed the directions of the link that was posted above, this does not work because the key was not found, In the infected folders is the textfile with the key clearly mentioned. I have tried both a specific search and a full search, i just have tried it again with a fresh downloaded version of the decryptor, but still no succes.

How can i make the decryptor point to the key, that this tool cannot find himself?

Thanks in advance

 

[AdvancedSetup]

Normally it would find it if you had that specific version of the infection. It's very possible that the encryption was corrupted during its operation and why it does not work. I really wish there was more we could do for you, but there is no magic pill to undo encryption.

You might be able to take the computer into a local repair shop that specializes in security and see if they're able to find, or correct enough of the documents to get the decrypter working. 

 

[AdvancedSetup]

Since this issue is resolved the topic will now be closed to prevent others from posting here.

If you need assistance please start your own new topic and someone will be happy to assist you.

Thanks