.Adame malware problem

[Azeem160]

[Azeem160]

Hello everyone! The C drive of my computer is working fine. But all the files and folders in the D and E drive are infected. I cannot open or access any file in these two drives. I will appreciate any Help.

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

You have been infected by yet another variant of high-risk ransomware called Phobos. Read about it. 
https://id-ransomware.malwarehunterteam.com/

You can follow the instructions and submit a sample of the file for verification.

You will be informed accordingly.

The only way to restore your files is from a Backup, if you  have one.

We can help you clean any remnant items from your computer but unfortunately there is nothing else we can do.

I you want run this tool and post the logs.

Download the Farbar Recovery Scan Tool (FRST).
Choose the 32 or 64 bit version for your system.
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.

Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.
Click Attach this file.
Click the Add reply button.
===

Please post the logs  for my review.

Wait for further instructions
====

[Azeem160]

Addition.txt FRST.txt

[Azeem160]

the complete files are attached in this comment.

Addition.txt FRST.txt

[Azeem160]

[nasdaq]

Hi,

ATTENTION: System Restore is disabled
Turn System Restore ON for Drives in Windows 10 - Immediately.
https://www.tenforums.com/tutorials/4533-system-protection-turn-off-drives-windows-10-a.html
<<<>>>

This fix will delete all the compromised file ending with .Adame

If you wish to make a backup of the files do it before you execute the fix.

You should save all the files with this format.
Open the Fixlist.txt file attached with Notepad

The files if you want to save them are listed from 

2019-09-10 22:59 - 2019-09-10 22:59 - 000175266 _____ C:\Users\Azeem\tetin_emergency.tin.id[68F4DBA1-2275].[recovermyfiles2019@thesecure.biz].Adame

to 

2019-08-28 13:38 - 2019-09-10 22:59 - 014613923 _____ C:\Users\Azeem\Downloads\YouTube By Click 2.2.112.rar.id[68F4DBA1-2275].[recovermyfiles2019@thesecure.biz].Adame

====

Close Notepad otherwise the fix will not work if the fixlist is opened.

===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know if you have issues with this computer.

fixlist.txt

Edited September 11, 2019 by nasdaq

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks