HELP ME

[Muhammad47]

Hii guys,,

i’m facing a very big and unique problem for the first time after 15 yrs using windows 

all my media files (pictures and videos mp3 etc) changed to FORMAT extension even after I scanned my pc and deleted all suspicious activity or files and rename some files it’s look like corrupted,,please, i need help it’s about 300 gb of my memories ,,.

thanks in advance 

[Maurice Naggar]

Hello,   

I regret very much what sounds like a ransomware encryption case.   We can help you to see if anything is now active  as a malicious threat.

Do be aware, in most cases the ransomware has Deleted itself by this point, where you are seeing changed Filename Extensions.

We can help you to remove the notes for ransom.    We cannot repair or recover any corrupted user files.

If you have a old backup of this machine, then you may recover from the backup.

 

Note this type of infection disables and erases old system restore on the disc.

 

Please run the FRST report like listed on this pinned topic

https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

 

FRST is just a report.  It does not make changes.

 

[Maurice Naggar]

Hello,

Please look on the Desktop and also on your "Documents" folder looking for files with the extension .format

pick 2 of them.   I would like you to go to a special resource sire called ID Ransomware & upload the 2 files and then save the resulting reports, and then post those logs here in a reply.

Read over the write-up  here https://www.bleepingcomputer.com/forums/t/608858/id-ransomware-identify-what-ransomware-encrypted-your-files/

Do the Upload to this site link   https://id-ransomware.malwarehunterteam.com/

 

It is quite possible this variant of ransomware is a new variant of the STOP ransomware.

It may be possible that at some point soon, you may be able to use the Stopdecrypter.    But that is not for sure at this time.

Lets first get a report from IDRansomware.

Please know that at Malwarebytes there is no decrypter.   Malwarebytes cannot fix  ( decrypt) files that are encrypted by any ransomware.

 

N.B.   Please be sure you also run the FRST report as per my post above  ( and attach the FRST reports)

Regards,

[Maurice Naggar]

Hello.   Did you see my last 2 replies?   Ara you still with us ?

As far as situations where files are encrypted by ransomware, we cannot cure or fix those files.

[Maurice Naggar]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks