[ti]SOLVED[/ti]cryptowall removal needed

cricket
New Helpee

Posts: 14

[ti]SOLVED[/ti]cryptowall removal needed Jan 18, 2016 19:27:07 GMT -8 via mobile

Post by cricket on Jan 18, 2016 19:27:07 GMT -8

I need help with removing cryptowall from my PC, which is running Windows 7 Home Premium Service Service Pack 1. My antivirus software license had lapsed. What do I need to do to get rid of Cryptowall? Do I need to install/renew my antivirus SW as a first step to prevent reinfection before removing the malware? BTW,I am having some difficulty in keeping a browser up for long on my infected machine. I often get a message that Internet Explorer or Chrome is not responding and I have to shut it down.

Krusty Logging Assistant In Oz Posts: 2,330	[ti]SOLVED[/ti]cryptowall removal needed Jan 19, 2016 12:39:03 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Krusty on Jan 19, 2016 12:39:03 GMT -8 Please read the post at the following link and attach or upload the requested logs. qmalwareremoval.freeforums.net/thread/1665/2nd-infected Thanks.
	I do NOT do support by PM. Thank you.

cricket
New Helpee

Posts: 14

[ti]SOLVED[/ti]cryptowall removal needed Jan 19, 2016 20:06:43 GMT -8 via mobile

Post by cricket on Jan 19, 2016 20:06:43 GMT -8

I read the instructions and produced the FRST.txt and addition.txt files, but I could not reply to this post from my computer. Instead, I am responding from my phone. Whenever I tried responding from my computer, I could not type at all, or could just enter a few letters, before Chrome would stop responding. I tried several times, by reopening Chrome after shutting it down (using 'End Task' in the Task Manager)with no luck. I even switched from a wifi to an Ethernet connection, to make sure connectivity was not the issue. On one of the attempts I noted that the bottom of my screen said it was 'Waiting for a.scorecardresearch.com'. How can I send the files under the current circumstances? Thank you for whatever help you can offer.

dbrisen Malware Removalists Posts: 3,688	[ti]SOLVED[/ti]cryptowall removal needed Jan 19, 2016 23:04:45 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by dbrisen on Jan 19, 2016 23:04:45 GMT -8 Uninstall chrome and re-install it. That should let you upload the files. If you need to, use a USB drive to transfer the files to a different working and protected computer for upload to wikisend.com.
	I will not provide malware removal by PM; please post in your thread on the Malware Removal board. My help is always free but if you would like to help encourage me or show your thanks -----> *DONATE*

cricket New Helpee Posts: 14	[ti]SOLVED[/ti]cryptowall removal needed Jan 20, 2016 19:57:46 GMT -8 via mobile Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by cricket on Jan 20, 2016 19:57:46 GMT -8 Thank you - that worked. Here are the file locations: wikisend.com/download/648122/FRST.txt wikisend.com/download/528120/Addition.txt

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]cryptowall removal needed Jan 20, 2016 20:52:52 GMT -8

Post by dbrisen on Jan 20, 2016 20:52:52 GMT -8

Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-3416688855-2360746385-3535720592-1001\...\Run: [{7BF46F1D-9201-4B63-A809-E0197DDE0ABF}] => regsvr32.exe "C:\ProgramData\FerHiht\VomQitf.dll"
HKU\S-1-5-21-3416688855-2360746385-3535720592-1001\...\Run: [RSA1377544647] => C:\Windows\system32\rundll32.exe "C:\Users\Liz\AppData\Roaming\Microsoft\Crypto\RSA\RSA1377544647.dll",DllInitialize <===== ATTENTION
HKU\S-1-5-21-3416688855-2360746385-3535720592-1001\...\Run: [VjcYNwLh42A6] => regsvr32.exe /s "C:\PROGRA~3\VjcYNwLh42A6.dll"
C:\ProgramData\FerHiht
C:\Users\Liz\AppData\Roaming\Microsoft\Crypto\RSA\RSA1377544647.dll
C:\PROGRA~3\VjcYNwLh42A6.dll
Startup: C:\Users\Liz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_YOUR_FILES.HTML [2016-01-16] ()
Startup: C:\Users\Liz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_YOUR_FILES.PNG [2016-01-16] ()
Startup: C:\Users\Liz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_YOUR_FILES.TXT [2016-01-16] ()
C:\Users\Liz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_YOUR_FILES.HTML
C:\Users\Liz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_YOUR_FILES.PNG
C:\Users\Liz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_YOUR_FILES.TXT
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {3EB0396A-BEEB-485D-9BA7-66826B2E06E1} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKLM-x32 -> {3EB0396A-BEEB-485D-9BA7-66826B2E06E1} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-3416688855-2360746385-3535720592-1001 -> DefaultScope {244306D0-5935-4C5A-B974-A5EFA841A9D7} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3281675&CUI=UN11992226203578537&UM=2
SearchScopes: HKU\S-1-5-21-3416688855-2360746385-3535720592-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3416688855-2360746385-3535720592-1001 -> {244306D0-5935-4C5A-B974-A5EFA841A9D7} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3281675&CUI=UN11992226203578537&UM=2
SearchScopes: HKU\S-1-5-21-3416688855-2360746385-3535720592-1001 -> {3EB0396A-BEEB-485D-9BA7-66826B2E06E1} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3416688855-2360746385-3535720592-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File
C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR Extension: (Google Drive) - C:\Users\Liz\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-01-02]
CHR Extension: (Google Search) - C:\Users\Liz\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-01-02]
S2 PDIHWCTL; \??\C:\Windows\system32\drivers\pdihwctl.sys [X]
C:\Windows\system32\drivers\pdihwctl.sys
2016-01-16 00:57 - 2016-01-16 00:57 - 00025468 _____ C:\Users\Liz\Desktop\HELP_YOUR_FILES.HTML
2016-01-16 00:57 - 2016-01-16 00:57 - 00016444 _____ C:\Users\Liz\Desktop\HELP_YOUR_FILES.TXT
2016-01-13 23:09 - 2016-01-13 23:09 - 51386852 _____ C:\Users\Liz\Downloads\gdpvft3z.bot07
2016-01-13 23:09 - 2016-01-13 23:09 - 00756752 _____ C:\Users\Liz\Downloads\066did96vy.k5
2016-01-13 23:09 - 2016-01-13 23:09 - 00136860 _____ C:\Users\Liz\Downloads\a5156dt6l.9wa
2016-01-13 23:08 - 2016-01-13 23:09 - 335588508 _____ C:\Users\Liz\Downloads\537xlqs3.jj4b
2016-01-13 23:08 - 2016-01-13 23:08 - 133624532 _____ C:\Users\Liz\Downloads\bcq4n.0z2
2016-01-13 23:08 - 2016-01-13 23:08 - 120837012 _____ C:\Users\Liz\Downloads\37wob5133.6w71
2016-01-13 23:08 - 2016-01-13 23:08 - 00164748 _____ C:\Users\Liz\Downloads\05vpawyou.0y
2016-01-13 23:08 - 2016-01-13 23:08 - 00115484 _____ C:\Users\Liz\Downloads\er63yw.a9gsv
2016-01-13 23:08 - 2016-01-13 23:08 - 00102524 _____ C:\Users\Liz\Downloads\32cy2qtxt8.9m7d
2016-01-13 23:08 - 2016-01-13 23:08 - 00054060 _____ C:\Users\Liz\Downloads\ie4i2wpb.r3
2016-01-13 23:08 - 2016-01-13 23:08 - 00052284 _____ C:\Users\Liz\Downloads\43oh8id96.8z4n
2016-01-13 23:08 - 2016-01-13 23:08 - 00047148 _____ C:\Users\Liz\Downloads\3d1oup5.dnbx1
2016-01-13 23:08 - 2016-01-13 23:08 - 00000492 _____ C:\Users\Liz\Documents\ztap8z.yy3
2016-01-13 23:07 - 2016-01-13 23:07 - 00013276 _____ C:\Users\Liz\Documents\7pgd79.ew9a
2016-01-13 23:07 - 2016-01-13 23:07 - 00011164 _____ C:\Users\Liz\Documents\1yyudnb.q4
2016-01-13 23:07 - 2016-01-13 23:07 - 00001740 _____ C:\Users\Liz\Documents\0h953h7kx.0u6f
2016-01-13 23:04 - 2016-01-13 23:04 - 00143360 _____ ( ConduIT ) C:\Users\Liz\AppData\Roaming\mpmnofo.exe
2016-01-13 23:04 - 2016-01-13 23:04 - 00014124 _____ C:\Users\Liz\Documents\ftcutw6zl.21
2016-01-13 22:57 - 2016-01-19 22:13 - 00000000 ____D C:\Users\Liz\AppData\Roaming\tor
2016-01-05 22:55 - 2016-01-05 22:55 - 00422259 _____ C:\Users\Liz\AppData\Roaming\ijsrkvq.exe
2015-12-28 23:24 - 2013-12-30 20:27 - 00189164 ____H C:\Windows\SysWOW64\mlfcache.dat
2016-01-13 23:03 - 2016-01-13 23:03 - 0045795 _____ () C:\Users\Liz\AppData\Roaming\HELP_YOUR_FILES.PNG
2016-01-05 22:55 - 2016-01-05 22:55 - 0422259 _____ () C:\Users\Liz\AppData\Roaming\ijsrkvq.exe
2015-10-26 21:24 - 2015-10-26 21:24 - 0005120 _____ () C:\Users\Liz\AppData\Roaming\jkrqfcb.exe
2016-01-13 23:04 - 2016-01-13 23:04 - 0143360 _____ ( ConduIT ) C:\Users\Liz\AppData\Roaming\mpmnofo.exe
2015-10-28 20:59 - 2015-10-28 20:59 - 0381952 _____ (Microsoft Corporation) C:\Users\Liz\AppData\Roaming\nslqhq.exe
2009-07-13 18:19 - 2009-07-13 20:52 - 0000238 _____ () C:\Users\Liz\AppData\Roaming\PBS1377544647.ini
2015-11-07 20:33 - 2015-11-07 20:33 - 0381952 _____ (Microsoft Corporation) C:\Users\Liz\AppData\Roaming\zudohoxw.exe
2016-01-13 23:03 - 2016-01-13 23:03 - 0045795 _____ () C:\Users\Liz\AppData\Roaming\Microsoft\HELP_YOUR_FILES.PNG
2016-01-13 23:02 - 2016-01-13 23:02 - 0045795 _____ () C:\Users\Liz\AppData\Local\HELP_YOUR_FILES.PNG
2015-10-26 21:24 - 2015-10-26 21:24 - 0004096 _____ () C:\ProgramData\dCgGX43942A6.dll
2016-01-13 23:02 - 2016-01-13 23:02 - 0045795 _____ () C:\ProgramData\HELP_YOUR_FILES.PNG
2012-12-16 11:06 - 2012-12-17 00:01 - 0000363 _____ () C:\ProgramData\hpzinstall.log
2015-10-26 21:25 - 2015-10-26 21:25 - 0004096 _____ () C:\ProgramData\VjcYNwLh42A6.dll
C:\ProgramData\dCgGX43942A6.dll
C:\ProgramData\VjcYNwLh42A6.dll
C:\Users\Liz\AppData\Local\Temp\ose00000.exe
C:\Users\Liz\AppData\Local\Temp\primosdk.DLL
C:\Users\Liz\AppData\Local\Temp\px.dll
C:\Users\Liz\AppData\Local\Temp\pxafs.dll
C:\Users\Liz\AppData\Local\Temp\PxCpyA64.exe
C:\Users\Liz\AppData\Local\Temp\PxCpyI64.exe
C:\Users\Liz\AppData\Local\Temp\pxdrv.dll
C:\Users\Liz\AppData\Local\Temp\pxhpinst.exe
C:\Users\Liz\AppData\Local\Temp\PxInsA64.exe
C:\Users\Liz\AppData\Local\Temp\PxInsI64.exe
C:\Users\Liz\AppData\Local\Temp\pxmas.dll
C:\Users\Liz\AppData\Local\Temp\pxsetup.exe
C:\Users\Liz\AppData\Local\Temp\pxsfs.dll
C:\Users\Liz\AppData\Local\Temp\pxwave.dll
C:\Users\Liz\AppData\Local\Temp\vxblock.dll
Task: {DF143984-5E30-4BC7-8FD4-0B811AB9D7CA} - System32\Tasks\{848A96C7-89C6-46C5-83F4-F1B2EF7F5514} => pcalua.exe -a "G:\Installation SW\Adobe Photoshop Lightroom 3\Extracted Installation Files\Install Lightroom 3.exe" -d "G:\Installation SW\Adobe Photoshop Lightroom 3\Extracted Installation Files"
2015-10-26 21:25 - 2015-10-26 21:25 - 00004096 _____ () C:\ProgramData\VjcYNwLh42A6.dll
2016-01-13 22:57 - 2000-01-01 00:00 - 00714452 _____ () C:\Users\Liz\AppData\Local\Temp\T1377544647\Tor\libevent-2-0-5.dll
2016-01-13 22:57 - 2000-01-01 00:00 - 00091026 _____ () C:\Users\Liz\AppData\Local\Temp\T1377544647\Tor\libssp-0.dll
2016-01-13 22:57 - 2000-01-01 00:00 - 00517814 _____ () C:\Users\Liz\AppData\Local\Temp\T1377544647\Tor\libgcc_s_sjlj-1.dll
2016-01-13 22:57 - 2000-01-01 00:00 - 00110592 _____ () C:\Users\Liz\AppData\Local\Temp\T1377544647\Tor\zlib1.dll
C:\Users\Liz\AppData\Local\Temp\T1377544647
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

cricket
New Helpee

Posts: 14

[ti]SOLVED[/ti]cryptowall removal needed Jan 21, 2016 20:30:31 GMT -8

Post by cricket on Jan 21, 2016 20:30:31 GMT -8

Although I reinstalled Google Chrome just the other day, it would not work at all today, even after uninstalling it and reinstalling it two more times, until after the Fix was run. Now it works! Another promising event was a message that the DLL with the Crypto malware could not be found.

Here is the link to the fixlog.txt file: wikisend.com/download/556060/Fixlog.txt

I have a couple of questions:
1. in the screen print you provided for running the Fix, I see that the Addition.txt file is checked off under Optional Scan, but it was not checked off when I opened FRST, so it was not included -- was this OK?
2. after I received the Cryptowall ransom note, but before registering with this blog, I saved some files that did not appear to be encrypted yet to a flash drive. Specifically, they were OneNote (*.one) and *.pst files. I am guessing they may have been encrypted during the copy to the flash drive, but I don't know (I know that the OneNote files were encrypted on my hard drive right afterwards). Is it safe to look at the flash drive in Windows Explorer? Will it be clear if they are encrypted, based on the names?
Thank you!

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]cryptowall removal needed Jan 21, 2016 22:05:24 GMT -8

Post by dbrisen on Jan 21, 2016 22:05:24 GMT -8

Answer to #1 => The picture is really for the scanning only; a Fixlist run does not look at any of the options.

Answer to #2 => You will be able to see if the files were encrypted by the name and extension; I doubt it was but you never know. Please protect your system from USB virus by running the following BEFORE attaching the USB to the system:

Download MCShield to your desktop and install
It will initially run a scan and show the result as a toaster by the system clock
Then in the control centre select scanner and tick unhide items on flash drives

Plug in the drive and McShield will start a scan
Select logs and then copy/paste it to your next post

I am actually going to jump my usual order of cleaning to see if there is a chance of getting your files back intact.

This next step may take a while (just to warn you) .....

ESET Online does not work with IE 11 (Internet Explorer) at the moment (a few weeks ago anyway) so if you have IE 11, Chrome or Firefox has to be used instead. ESET Online does work with IE 10 and earlier.

You can leave Norton Enabled even though ESET may warn about it. just makes the scan take longer. The pictures below showing what to click may be blue instead of green on the ESET website now, but the procedure is still the same

Please read carefully and Slowly, Notice all the settings listed below to check before starting the scan. Stop and ask if you have any questions.

Take note of the NO tick in the Remove found threats setting below at it needs to have the tick removed.

Hold down Control key and click on the following link to open ESET OnlineScan in a new window.

Link =>> ESET Online Scanner <<

Click the Run ESET Online Scanner located on the left side of the page (not the free trial).

For browsers other than Internet Explorer only: (Microsoft Internet Explorer users can skip this step)
Click on the esetsmartinstaller link in the popup window that opens. Save it to your desktop.

Double click on the icon on your desktop.

Check (accept) the Terms of Use.

Click the START button.
Accept any security warnings from your browser.

Now in the Computer scan settings window that appears:-
Make sure that the option Enable detection of potentially unwanted applications is selected.
Now click on Advanced Settings and configure the options as follows:

Remove found threats is Not checked
Scan archives is checked
Scan for potentially unsafe applications is checked
Enable Anti-Stealth Technology is checked

Now click on: Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan is finished, if any threats are found you will see the screen below. Click to view the found threats.

At the bottom of the listed threats, there is an option to save the results to a text file. Please do this so you can attach the results here for review and removal of the items that are not false positives (these will be scripted out so do not worry).

Once the log text file is saved, return to the Scan Finished screen by clicking "<<Back", then click on the uninstall button and click Finish.

Attach the saved log file in your next reply please. Thanks.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

cricket
New Helpee

Posts: 14

[ti]SOLVED[/ti]cryptowall removal needed Jan 22, 2016 22:24:06 GMT -8

Post by cricket on Jan 22, 2016 22:24:06 GMT -8

I ran the procedures you identified in your last post. I really appreciate how clear all the step-by-step instructions are.

I found I could no longer use wikisend.com now because it thinks for some reason that the text files don't exist (even though they were selected from a browser). I wasn't sure how to use pastebin.com, so I'm pasting the results in this message.

Here are the results of the MCShield scan (please note: I have deleted some of the blank lines):

------------------------------------------------------------------------------------------------------------------------------------------

>>> MCShield AllScans.txt <<<

-----------------------------

MCShield ::Anti-Malware Tool:: www.mcshield.net/

>>> v 3.0.5.28 / DB: 2015.12.6.1 / Windows 7 <<<

1/22/2016 8:43:03 PM > Drive C: - scan started (no label ~673 GB, NTFS HDD )...

=> The drive is clean.

1/22/2016 8:43:03 PM > Drive D: - scan started (Recovery ~22 GB, NTFS HDD )...

=> The drive is clean.

1/22/2016 8:43:04 PM > Drive E: - scan started (HP_TOOLS ~4 GB, FAT32 HDD )...

=> The drive is clean.

MCShield ::Anti-Malware Tool:: www.mcshield.net/

>>> v 3.0.5.28 / DB: 2015.12.6.1 / Windows 7 <<<

1/22/2016 8:44:29 PM > Drive G: - scan started (no label ~14900 MB, FAT32 flash drive )...

=> The drive is clean.

-----------------------------------------------------------------------------------------------------------------------------------------

Afterwards, when I looked at the files on the USB flash drive in Windows Explorer, they all seem to have been encrypted, so I'm assuming they cannot be salvaged.

The ESET Online Scan took just over 3 hours, scanned 246,536 files and detected 23 infected files.

Here are the results of the scan:

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir Win32/Toolbar.Conduit.Y potentially unwanted application
C:\AdwCleaner\Quarantine\C\ProgramData\Conduit\Multi\CT3281675\UninstallerUI.exe.vir a variant of Win32/Toolbar.Conduit.AJ potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Liz\AppData\Roaming\OpenCandy\AA39FCA0DB3741BEA4E946EBCCB11673\ConduitRBCB_e1v0.exe.vir Win32/Toolbar.Conduit.S potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Liz\AppData\Roaming\OpenCandy\AA39FCA0DB3741BEA4E946EBCCB11673\LatestDLMgr.exe.vir a variant of Win32/OpenCandy.A potentially unsafe application
C:\AdwCleaner\Quarantine\C\Users\Liz\AppData\Roaming\OpenCandy\AA39FCA0DB3741BEA4E946EBCCB11673\RAWinstaller.exe.vir Win32/Toolbar.Conduit.S potentially unwanted application
C:\Documents and Settings\All Users\FerHiht\VomQitf.dll a variant of Win32/Kryptik.EIOB trojan
C:\Documents and Settings\All Users\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\Wldap32.dll Win64/Bedep.D trojan
C:\FRST\Quarantine\C\ProgramData\dCgGX43942A6.dll.xBAD a variant of Win64/Tiny.B trojan
C:\FRST\Quarantine\C\ProgramData\FerHiht\VomQitf.dll a variant of Win32/Kryptik.EIOB trojan
C:\FRST\Quarantine\C\PROGRA~3\VjcYNwLh42A6.dll.xBAD a variant of Win64/Tiny.B trojan
C:\FRST\Quarantine\C\Users\Liz\AppData\Roaming\ijsrkvq.exe.xBAD a variant of Win32/TrojanDownloader.Blocrypt.AL trojan
C:\FRST\Quarantine\C\Users\Liz\AppData\Roaming\jkrqfcb.exe.xBAD Win32/Tiny.NBL trojan
C:\FRST\Quarantine\C\Users\Liz\AppData\Roaming\mpmnofo.exe.xBAD Win32/TrojanDownloader.Hancitor.G trojan
C:\FRST\Quarantine\C\Users\Liz\AppData\Roaming\nslqhq.exe.xBAD a variant of Win32/Kryptik.EDED trojan
C:\FRST\Quarantine\C\Users\Liz\AppData\Roaming\zudohoxw.exe.xBAD a variant of Win32/Kryptik.EDED trojan
C:\FRST\Quarantine\C\Users\Liz\AppData\Roaming\Microsoft\Crypto\RSA\RSA1377544647.dll.xBAD a variant of Win64/Rovnix.M trojan
C:\FRST\Quarantine\C\Users\Liz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_YOUR_FILES.TXT.xBAD Win32/Filecoder.CryptoWall.F trojan
C:\FRST\Quarantine\C\Users\Liz\Desktop\HELP_YOUR_FILES.TXT.xBAD Win32/Filecoder.CryptoWall.F trojan
C:\ProgramData\FerHiht\VomQitf.dll a variant of Win32/Kryptik.EIOB trojan
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\Wldap32.dll Win64/Bedep.D trojan
C:\Users\All Users\FerHiht\VomQitf.dll a variant of Win32/Kryptik.EIOB trojan
C:\Users\All Users\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\Wldap32.dll Win64/Bedep.D trojan
Operating memory a variant of Win32/PSW.Papras.EJ trojan

I have been meaning to ask about the attempts my computer has been making to check files when it is starting up. I've been cancelling the request because I didn't know if it would interfere with the clean up. Should I let my computer proceed with the check?

Thank you!

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]cryptowall removal needed Jan 23, 2016 11:03:55 GMT -8

Post by dbrisen on Jan 23, 2016 11:03:55 GMT -8

Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
C:\ProgramData\FerHiht\VomQitf.dll
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\Wldap32.dll
C:\Users\All Users\FerHiht\VomQitf.dll
C:\Users\All Users\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\Wldap32.dll
C:\ProgramData\FerHiht
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
C:\Users\All Users\FerHiht
C:\Users\All Users\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

[ti]SOLVED[/ti]cryptowall removal needed

Post by cricket on Jan 18, 2016 19:27:07 GMT -8

Post by Krusty on Jan 19, 2016 12:39:03 GMT -8

Post by cricket on Jan 19, 2016 20:06:43 GMT -8

Post by dbrisen on Jan 19, 2016 23:04:45 GMT -8

Post by cricket on Jan 20, 2016 19:57:46 GMT -8

Post by dbrisen on Jan 20, 2016 20:52:52 GMT -8

Post by cricket on Jan 21, 2016 20:30:31 GMT -8

Post by dbrisen on Jan 21, 2016 22:05:24 GMT -8

Post by cricket on Jan 22, 2016 22:24:06 GMT -8

Post by dbrisen on Jan 23, 2016 11:03:55 GMT -8