Eris Posted May 1, 2019 ID:1310541 Share Posted May 1, 2019 Got hit with GandCrab the other day. (Bitdefender's GandCrab removal tool didn't work, so I figure it was 5.2.) What I did: Deleted everything that it renamed. (Had file backups elsewhere.) Deleted the user local temp stuff. Ended some running progies and such. Ran Malware Bytes. Ran SpyHunter 5. Thought I was good but didn't realize GC was embedded. Found that out when a new folder with a long, nonsense name and lots of subfolders and essential Windows files appeared on C:/. Malware Bytes File Assassin could only unlock a few files but not everything and doesn't unlock folders, so I used UnLockIT successfully for that and got that crap cleaned off. Cleaned user/local/temp again and ran MB and SH again. Ran AdwCleaner which fixed an affected Windows task update and an affected Windows task registry key. Ran Windows Defender which found a few things in windows/temp. Ran Disk Cleanup. Am I clean and good to go now, you think, or should I still be worried? TiA. Link to post Share on other sites More sharing options...
Eris Posted May 1, 2019 Author ID:1310543 Share Posted May 1, 2019 I forgot to mention I tried to do as suggested elsewhere and download the Farbar progie from bleepingcomputer.com, but is it cool if it's unsigned? Link to post Share on other sites More sharing options...
Eris Posted May 1, 2019 Author ID:1310547 Share Posted May 1, 2019 Thanks, 1PW. Attached are my files. Addition.txt FRST.txt MWB-report.txt Link to post Share on other sites More sharing options...
Eris Posted May 4, 2019 Author ID:1311137 Share Posted May 4, 2019 Bump. Link to post Share on other sites More sharing options...
nasdaq Posted May 5, 2019 ID:1311261 Share Posted May 5, 2019 (edited) Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Your logs are clean of malware. This fix will only clean some inactive entries. Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Please post the Fixlog.txt and confirm that all is well. fixlist.txt Edited May 5, 2019 by nasdaq Link to post Share on other sites More sharing options...
Eris Posted May 5, 2019 Author ID:1311292 Share Posted May 5, 2019 Thank you for the help. I looked at the file but am not familiar with what it will do. Link to post Share on other sites More sharing options...
nasdaq Posted May 5, 2019 ID:1311297 Share Posted May 5, 2019 It will delete all those items. Your call if you want to or not. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 20, 2019 Root Admin ID:1313598 Share Posted May 20, 2019 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts