Ransomeware

Hello, shredwood

Go to this webpage and follow the section Disinfection
https://support.kaspersky.com/viruses/disinfection/8547?_ga=1.212101331.678557144.1476491888#block1

Let me know the outcome, please.

 

You're welcome.

There is a known vulnerability with DellSystemDetect. Please go to the below link and update your software immediately.
https://blog.malwarebytes.com/threa...detect-vulnerability-now-classified-as-a-pup/

Re-run RogueKiller.exe. (Vista/Windows7/8/10 users should right-click and select "Run as Administrator")
After it finishes the scan, select the following tabs and then select any of the below that exist and then click the Remove Selected button.
Registry

• PUP] [HKEY_USERS\S-1-5-21-2218850325-2354704155-503931897-1000\Software\YahooPartnerToolbar -> Found
• [Tr.Generic|Suspicious.Path|VT.Unknown] HKEY_USERS\S-1-5-21-2218850325-2354704155-503931897-1000\Software\Microsoft\Windows\CurrentVersion\Run | Crypted : C:\Users\admin\AppData\Local\Temp\a.txt [-] -> Found

Files

• [Suspicious.Path|VT.Unknown][File] C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\38130139.lnk [LNK@] C:\Windows\System32\cmd.exe /C start "" "C:\Users\admin\AppData\Roaming\17dfc4e1\3f788349.6c8316cc7" -> Found
• [Tr.Generic][File] C:\Users\admin\AppData\Local\Temp\a.txt -> Found
• [PUP][Folder] C:\ProgramData\APN -> Found

Then immediately reboot your PC. Now run a new scan with RogueKiller, save a log as in the original instructions and upload that new log.

Now copy the bold text below to notepad. (Do not include any space above the word "REGEDIT4"). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" . Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me whether or not you receive a success message about adding the above to the registry. If you do not get a success message, it definitely did not work.

Go here ==> https://www.eset.com/us/online-scanner/ and click on the SCAN NOW radio button > save the esetonlinescanner_enu.exe Binary file to your Desktop > then right-click and choose "Run as Administrator". *Be patient! The scan can take 2 hours or more. Please upload the results log if one is generated.

Now run the C:\MGtools\GetLogs.bat file by right-click and select "Run As Administrator"). Upload the updated C:\MGlogs.zip.

 

Uninstall the below outdated software using
GeekUninstaller 1.4.0.88, a portable appl.

• Java 8 Update 31

Now install the current version of Sun Java from:

• Go here for 64 bit OS = Sun Java 64 bit Runtime Environment
• Go here for 32 bit OS = Sun Java 32 bit Runtime Environment

*These files concern me... what do you know about them? Please submit them to VirusTotal for testing. *If they test out okay, check their File Properties to gather additional information about them.

Are you having any problems with the PC?

 

Ok, I believe that we're finished.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase it, it provide no protection. It do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. Go back to step 6 of the READ ME and re-enable your Disk Emulation software with Defogger if you had disabled it.
3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
5. If running Vista, Win 7/8/10 - it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
6. Go to add/remove programs and uninstall HijackThis.
7. Go to the C:\MGtools folder and find the MGclean.bat file. Double-click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
8. If you are running Win 7/8/10, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 6 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work through the below link:
   • How to Protect yourself from malware!

Safe surfing! http://i268.photobucket.com/albums/jj5/drmoriarty/Emoticons/char145.gif

 

Let's double-check, shredwood.

Please download Malwarebytes Anti-Rootkit 1.09.3.1001 Beta to a new folder on your Desktop.

• Then open the folder, extract its contents and double-click on the mbar.exe to start the program.
  • If you receive a DDA driver message like could not load DDA driver, click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer and will start automatically.
• Follow the prompts and be sure to update the definitions when it asks. When the update has finished, click on the Next button.
• Make sure the Drivers, Sectors, and System scan targets are selected before you click on the Scan button.
• Allow the program to remove any infections and reboot your computer when prompted.

 

Please run mbar.exe a second time to see if the scan is clear.

 

Good!

 

You're very welcome!