[khore]

Your identification number: 6456
E-mail to contact us: [email protected]

Your identification number: 6456

Your files with extentions (*.txt *.xls *.docx *.doc *.cer *.key *.rtf *.xlsx *.text *.ppt *.pdf *.cdx *.cdr *.js *.css *.asm *.jpg *.dbf *.mdb *.sql *.pgp)
and many othes have been blocked. To purchase unlock code please contact us: [email protected] Price 300 USD.If you attempt to remove the informer, you may lose all your files forever.


Q: How can I make sure that you can really decipher my files?
A: You can send one of ciphered file by email [email protected] (Indicate your ID in the message title),
in the response message you receive the deciphered file.



what should i do please help

Edited by khore, 13 June 2013 - 12:21 PM.

[Advertisements]

please help..

[khore]

please help..

[godawgs]

Hello khore, Welcome to the forums!
. My name is godawgs and I will be assisting you with your Virus / Malware issues.
We apologize for the delay in responding to your request for help. Here at GeeksToGo we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

I will start working on your Malware issues. This may, or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for this issue on this machine!

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.
If you have not, please adhere to the guidelines below and then carefully follow all future instructions:

You must reply to posts within four days. If you haven't replied within that time, the topic will be closed! If you need additional time to complete things, just let me know.
If you're not sure, or if something unexpected happens, Do NOT continue! Stop and ask!

This board can notify you when a new reply is added to a topic. Please read this topic to find out how to do that.

Please do not run any tools unless instructed to do so.

• We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability. Do as the instructions ask, nothing extra. Do Not run things twice unless instructed.
• Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
• If I ask a Question just answer it, don't run anything unless directed to.

Please read every post completely before doing anything.

• Pay special attention to the NOTE: lines, or anything in red. These entries identify an individual issue or important step in the cleanup process.
• Please make sure you are saving and printing the instructions out prior to each fix, this way you will have them on hand just in case you are unable to access this site. Some of the steps I will be asking you to do may require you to boot into Safe Mode and this process will be much easier for you to perform if the instructions are printed out for you to follow.
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post unless directed otherwise.

Logs from malware diagnostic or removal programs (OTL is one of them) can take some time to analyze.

• I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes )
• Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.

Lastly, Please be aware that removing Malware is a hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. Some infections are so severe that we might encounter situations where the only recourse is to re-format and re-install your operating system. Don't worry, this only happens in severe cases, but, sadly, it does happen.
In light of this be prepared to back up your data. Have means of backing up your data available.

IMPORTANT:Change your browser(s) to download any tools to the desktop.
Follow the directions here
For FireFox check the dot beside "Always ask me where to save files."
For Chrome, check the box beside "Ask where to save each file before downloading"
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

I am going to need some additional information but you should know up front that we may not be able to retrieve the encrypted files. Depending on what program was used to encrypt them and what has been done to remove the ransomeware to this point.

1.
Was the notification that you posted above he exact notification?
2.
Are you able to boot into Windows normally?
3.
If not, are you able to boot into Safe Mode?
4.
Have you run any removal programs or tools to try to remove the ransomware?

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. Answer my questions above please

[khore]

1. yes the msg i posted above was the exact
2 and 3.yes i am able to boot normally no safe mode required
4.yes i tried one software which i found on the net. also as said in the msg i tried to interact with the virus maker via given email and he also responded with one my files decrypted.

[godawgs]

4.yes i tried one software which i found on the net.

Can you tell me which one please?

also as said in the msg i tried to interact with the virus maker via given email and he also responded with one my files decrypted.

Well if we can't recover the files then it looks like the criminal can....question is whether or not it's worth $300.00
The earlier variants of the cryptor needed a password also but the malware left it on the system so it could be decrypted from there. The new version deletes the password from the system and stores it on a private secure server so if the password has been deleted from the system there won't be any way to recover the files as the encryption itself is so advanced it simply cannot be decrypted using brute force.


OTL
OTL is currently our primary tool for searching key areas of the registry and other system locations for the telltale signs of malware. It generates a comprehensive log, and offers an initial diagnosis.

• Download OTL to the Desktop. It is important that it is download to the Desktop. (FireFox users should right click the download link and click "Save File As". On the window that comes up, make sure the download location is the Desktop and click the Save button.)
• Double click on the OTL icon to run it. (Vista and 7 users:) right click on the icon and click Run as Administrator. Make sure all other windows are closed and let it run uninterrupted.
• You will see a console like the one below:
  
  
  
• Click the box beside Scan All Users at the top of the console.
• IF your operating system is a 64 bit OS, Click the box beside Include 64bit Scans
• Make sure the Output box at the top is set to Standard Output.
• Check the boxes beside LOP Check and Purity Check.
• Click the button. Do not change any settings unless otherwise told to do so.
• Let the scan run uninterrupted.
• When the scan completes, it will open two notepad windows, OTL.Txt will open on the desktop and Extras.Txt will be minimized on the taskbar. These are saved in the same location as OTL.
• Please copy the contents of these files, one at a time, and paste them into your reply. To do that:
• On the .txt file Menu Bar click Edit then click Select All. This will highlight the contents of the file. Then click Copy.
• Right-click inside the forum post window then click Paste. This will paste the contents of the .txt file in the in the post window.

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. Answer my question
2. The OTL log

[godawgs]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.