Dell 2003 with RANSOM MALWARE

[Gabriel Peper]

thank you for reading my thread. this infection happened yesterday but i couldnt work on it until now. i left the computer in safe mode and now im here to stay until fixed. im going to the link to download the 3 softwares to generate logs mentioned above. I apologize ahead of time if i dont process this request the way the site intends as it is new to me. I will do my best to follow your instructions correctly. I should mention that im communicating via the same infected computer now. Only other device i have available is my iphone that has active data service if i need it. thank you
is there spell check on this site?

 

[Gabriel Peper]

in a previous post i was instructed to run 2 other tools, should run them or wait to hear about these reports?

 

[TwinHeadedEagle]

Hello,



They call me TwinHeadedEagle around here, and I'll be working with you.



Before we start please read and note the following:

• At the top of your post, please click on the "Watch thread" button and make sure to check Watch this thread...and receive email notifications. This will send an email to you as soon as I reply to your topic, allowing me to solve your problem faster.
• Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process. Please do not perform System Restore or any other restore.
• Instructions I give to you are very simple and made for complete beginner to follow. That's why you need to read through my instructions carefully and completely before executing them.
• Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
  
• All tools we use here are completely clean and do not contain any malware. If your antivirus detects them as malicious, please disable your antivirus and then continue.
• If during the process you run across anything that is not in my instructions, please stop and ask. If any tool is running too much time (few hours), please stop and inform me.
• I visit forum several times at day, making sure to respond to everyone's topic as fast as possible. But bear in mind that I have private life like everyone and I cannot be here 24/7. So please be patient with me. Also, some infections require less, and some more time to be removed completely, so bear this in mind and be patient.
• Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. If you solved your problem yourself, set aside two minutes to let me know.
  
• Please attach all report using
  
  button below. Doing this, you make it easier for me to analyze and fix your problem.
  
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

How is your problem manifested?

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[Gabriel Peper]

Hello, I hope i didnt mess things up but before reading this i ran sefveral of the tools which didnt execute well im attaching reports of them all. Actually I was following the guide which is called something like "Before Posting Read THis..." Everything ive done has been via Safe Mode. Lastly, i just ran RogueKiller which foumd a few items In tabs Regestry, Tasks, Hosts all which deleted but it also found about 30 repeats of Chrome@Default which only allowed 3 to be deleted all others said Error and remained. BTW I use Chrome as my browser and thought a problem was brewing because norton kept saying it was using alot of memory oddly. Please see attachments. If you work late so do i : ) as in right now. thank you

 

[TwinHeadedEagle]

Please run FRST Fix from my instructions and tell me how is your PC after, because I do not see signs of malware.

 

[Gabriel Peper]

i am going to run the 2 tools per your message but did you notice my second post that i sent before your message. I has 2 reports as well. Also you dont mention Safe Mode to use or no.

 

[TwinHeadedEagle]

I did noticed all reports, and I prepared fix by using them. I still didn't hear from you how is your problem manifested, because I do not see signs of ransomware on your system.

 

[Gabriel Peper]

the file you sent me doest seem to work, it just opens as notepad

 

[Gabriel Peper]

Im not sure how it is as i havent tried to run normally Here is the screen shot from Rogue I mentioned. do you want me to try to run as normal. Im a bit gun shy as i had this FBI ware once before and it got bad before it got better to put it mildly. But just let me know how to check and its done

 

[Gabriel Peper]

ok i figured what i was doing wrong and the tools ran fine and found nothing, then i restarted and the malware didnt come back. dont know how but ive managed to remove it

 

[TwinHeadedEagle]

RogueKiller doesn't gave very user friendly interface, and on the other side it has a lot of false detections, so you shouldn't always trust it.

You need to do FRST fix like I explained above.

 

[Gabriel Peper]

I ran FRST fix as u instructed. all clear

 

[Gabriel Peper]

I did get 1 request to reattach the norton tool bar in chrome home page but didnt do it

 

[Gabriel Peper]

heres the fixlog

 

[TwinHeadedEagle]

Very good. How is your PC now?

 

[Gabriel Peper]

Well not good im afraid , very very slow, i found 2 jepgs with long numerical names that fluttered onto my desktop while i was closing chrome, I deleted them without opening; everytime i start HItmanPro does a search but hasnt found anything, im very suspicious of chrome i wondered about removing and reinstalling but i wanted your advise

 

[Gabriel Peper]

Twinheadedeagle, are you there? malwares are running rampent on my computer. I found one called mbam.exe. can i simply delete it by highlighting

 

[Gabriel Peper]

I have to go now but I'll be monitoring via handheld. CPU keeps show maxed out usage and software is crashing. I'm afraid it's worse now than yesterday. Hopefully webcam discuss later on

 

[TwinHeadedEagle]

mbam.exe is legit process by MalwareBytes.

 

[TwinHeadedEagle]

Windows XP end of support warning!

As 8th of April 2014 has passed, this Operating System is not longer supported by the Microsoft.
Any patches, updates or security releases are ceased for this System.

• Windows XP end of support

This is just an information for you if not aware.
My recommendation would be to start thinking about replacing it with some newer edition, like Windows Vista, Windows 7 or Windows 8.