SPORA infection this morning on Win 7 laptop, guidance on effective removal please.

[Hannay]

Good afternoon.

This morning I found that my laptop had been infected by the SPORA Ransomware virus. I have googled it in order to discover what it is, where it might have come from, and how to deal with it.

I recognised comments from others who became infected after a normal website popped-up a bogus missing-font-in-Chrome report, as that happened to me last night just before I closed down and went to bed - obviously the cause.

I have now read of the various approaches that can be taken, all following the same general path: 1) Remove Spora either manually or with a removal tool, 2) Endeavour to replace/recover the encrypted files via recovery tools, backup options, shadow volume copies, 3) Verify the removal.

I am mighty angry because this nasty little process encrypts documents/files which presently can not be reversed other than by the decryption key itself, and also because the lowlifes that are doing this present a price-list of options for the money they are extorting!

"Would you like us to extort $79 Dollars for an unlock but no files back, or $50 for one particular file that your family treasures, $300 for the whole deal, and maybe just another $20 as a bargain offer so we don't include you all over again in the next round of extortions?"

Unbelievable!! Except that it is right there!!

Anyway ...

I am not computer-savvy enough to jump right in with confidence that I will have dealt with all the small-points along the way as well, which for example could leave a door open for it to return. So I should be very grateful if someone would take me through the steps of dealing with the infection.

I understand that decryption however is not an option, just removal.

I do backup however, usually monthly, so from an initial quick check I should be able to replace quite a lot of what is encrypted. In the almost-month since my last backup however there has been a lot of new stuff I can't get back .. all kinds of Christmas things/photos for the family, an amount of personal correspondence etc.

I am a writer and also a composer, and by far the biggest loss is whole sections of writing that will take me a lot of time and trouble to try redoing but I won't capture again precisely the same. Even more importantly still, there are pieces of music that I was very excited at having recently completed that it is simply impossible for me to capture again!

So would someone please help me to get this thing off my computer completely and reliably, and I will have to do the best I can to replace encrypted files from my backups.

I do have one very important question to ask: I keep my work separate by using different external drives for each project. SPORA has therefore infected not only my computer's hard drive but also the files/documents on the external drive that was connected at the time.

My question is, if I connect this portable drive to a clean computer to carry on, will the infection spread as a result and make that one the same? This is very important as I want to get back on and try rebuilding the lost music somehow, but don't know if the portable drive is safe or just waiting to burn whatever it is connected to ... please can you advise in that regard right at the start so I know if I can safely access the work in files there and quickly carry on? I'd be very grateful indeed to know!!

And finally regarding the portable drive, I know it is infected for three reasons:

- firstly because text files and photos on it are unopenable in the same way

- secondly because I have noticed random new files in various folders like the html file on the desktop

- and thirdly - because someone presumably thought it was funny - SPORA has also replaced the thumbnail image associated with a video (like the album-art that you see when playing an mp3) by a porn photo. I take videos of dance-practise for my ballet score, I also video performances and more to review with the dancers and musicians ... and every one of those and more is now represented by a porn picture on the player!

I have atached the required "FRST" and "Additons" documents, and any guidenace from here would be most kind, Thanks!

Howard

 

[TwinHeadedEagle]

Hello,


You were infected by executing fake font file provide by website.

It looks like this:




The fact that you don't have Antivirus on your computer made it much easier for malware.


As a first step, I would install proper antivirus. Before that, please uninstall following software:

Uninstall some programs

We need to uninstall some unwanted/unneeded programs.

• Press the
  
  + R on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time

The list of programs to uninstall:

• Advanced SystemCare Ultimate 10
• Driver Booster 4.1
• IObit Malware Fighter 3
• IObit Uninstaller
• Rocket Piano Bonus Software
• Smart Defrag 4

After completing uninstalls, please manually reboot your machine!

Note: If you get the message like: An error occurred while trying to uninstall, just press Yes.



Then:

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked.
  
  
  
  
  
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach report into your next reply.

 

[Hannay]

Hello, and thank you so much!

All done, and logfiles atached.

For your information, on reboot Chrome launched displaying the "All your work and personal files were encrypted" warning/ransom page. In case it is useful, the address bar reads: "file:///C:/Users/rd/ApData/Roaming/Microsoft/Windows/Start%20Menu/Programs/Startup/GB06F-23XOH-FTARH-TZTRX-TAZOY.htm"

That same file "GB06F ... etc" is also on my desktop and in a variety of folders on the laptop, as well as on the portable drive (WD Passport) that was attached to it at the time of the infection.

Can I still use that portable drive by connecting it to a clean computer, or will it infect it until it is cleaned? I would like to start to try to rebuild some work on another computer if possible, and need to access the portable drive to begin but I can't connect it to anything until I know whether it is infectious or not.

Will you be helping me to clean SPORA files off that portable drive as well?

Thanks again.

 

[TwinHeadedEagle]

There is no active infection anymore on your computer. Ransomware did its thing by infecting files and now it is no more active. All the is left is a html messages in every folder that has infected files.

You can use this utility to remove all ransom notes from your computer and all drives.

RansomNoteCleaner Download


Please uninstall Spybot - Search and Destroy and install proper Antivirus on your computer or you're risking reinfection.

 

[Hannay]

Thank you ...


I ran RansomNoteCleaner on the C: drive with SPORA selected as the Ransomware to look for, and there are some clear issues and I need to check further. I haven't yet run it on the portable drive.

On completion it reported:

"Searching for Spora Notes ... none found.
Finished search, found 42 ransom notes."

I assume that by "Ransom Notes" it means the .html files that take you immediately to the Ransom page.

I checked the ransom notes that it reported, and the file paths all led to legitimate files that then opened up quite properly when clicked - the Audacity ones for example open that Program's help-pages.

I had already discovered some of the SPORA-dropped .html files (the GB06F-23XOH-FTARH-TZTRX-TAZOY.htm files mentioned already), and their filepaths are not included among the 42 ransom notes reported.

I have attached RansomNoteCleaner's report doc. if you need to take a look.

**Note please ... to check this I ran RansomNoteCleaner a second time but with ALL Ransomewares selected not just Spora in case it threw up anything of further relevance, but it gave exactly the same 42 findings, nothing additional.

However, I then ran it one more time with just SPORA selected again, and this time it reported 0 Ransom Notes found!

I have added a screenshot of that report, which seems incorrect because firstly I have not deleted any yet, and secondly because right alongside it on the desktop is one of the (42?) links/notes that needs to be cleaned out ... it has been right there from the beginning.


There's one more thing that I have noticed now: Windows Explorer has lost some functionality - the folder tree does not show/can't find my desktop, and "Local Disc C:" under "Computer" has the normal arrowhead to open/expand its tree downwards but noithing shows there at all - no system folder, program folder, users folder, all those many other folders. They are obviously present, but they aren't shown so I can't access them to operate anything if needed, which is already a problem.

For example, I can not browse folders/files in order to attach documents to this reply, so I can't use this Forum's "upload a file" process. To post this reply with atachments I have had to transfer those documents on to a thumb drive and then add this reply from a different computer instead and add the attachments off the thumbdrive.


So then ....

I have not yet taken any action beyond Running RNC to find ransom notes to clean off the system, from which it firstly reported 42.

I am nervous that those findings were/are legitimate files and would damage the system if deleted, unless they are absolutely certain to be disguises?

However, I am very puzzled why on a re-run RNC is then saying there are zero Ransom Notes, when very clearly there are still many I can find in files myself including one right on the desktop as you can see in the partial-screengrab of RNC's subsequent "0 ransom notes" response.

I don't know if you might want another system report to see if that shows you anything, but I have prepared another FRST and Addition report anyway in case you do but you can just ignore them if not.

So please can you tell me what I should do now given these findings?

Thanks for your patience, sorry the time-difference is working against us a little.

 

[TwinHeadedEagle]

I really don't know how to help you on this anymore.

Ransomware isn't a joke and by having no antivirus on your computer I see you are not a experienced user to try and solve your problem on forums because some serious issues like this one can't be solved like thi. You are asking too much questions so I think it is the best to consult expert or PC repair shop to get your system reinstalled and to install proper antivirus. Later you can restore your files from backup.

This forum is dedicated for malware removal and it isn't present on your system.

If you have more questions, please open a topic here: Troubleshooting Software - Questions and Help!