Hi heyoka05,
Try again today to see if you can upload the last 3. If not I will think of something.
wbg
Try again today to see if you can upload the last 3. If not I will think of something.
wbg
Malware Removal Forums
infected with the cryptowall
123 min read
No ....sorry .....apparently the quota is a limit for the thread and not just a particular day
Just let me know how you'd like to proceed
thanks
Just let me know how you'd like to proceed
thanks
Hi heyoka05,
See if you are able to upload the last 3 files here:
http://www.zippyshare.com/
If you are able, post the links for download.
See if you are able to upload the last 3 files here:
http://www.zippyshare.com/
If you are able, post the links for download.
http://www76.zippyshare.com/v/22011075/file.html
http://www76.zippyshare.com/v/62012709/file.html
http://www76.zippyshare.com/v/58933255/file.html
There you go ... Thanks and hope you are doing well
http://www76.zippyshare.com/v/62012709/file.html
http://www76.zippyshare.com/v/58933255/file.html
There you go ... Thanks and hope you are doing well
Hi heyoka05,
I downloaded the last 3 parts and will need a few days for research. If it takes longer I will let you know.
wbg
I downloaded the last 3 parts and will need a few days for research. If it takes longer I will let you know.
wbg
no worries ....thanks again for the help
Hi heyoka05,
Something is wrong with the compressed files other than the first one. They will not chain to a single file. Would you be kind enough to upload the 28mg compressed file to http://www.zippyshare.com/ please and then post a link to it? They have a 200mg file size limit.
wbg
Something is wrong with the compressed files other than the first one. They will not chain to a single file. Would you be kind enough to upload the 28mg compressed file to http://www.zippyshare.com/ please and then post a link to it? They have a 200mg file size limit.
wbg
http://www26.zippyshare.com/v/55805073/file.html
Hopefully this will work for you
Hopefully this will work for you
Hi heyoka05,
I have been looking at the data in the HKLM hive from your registry and cannot tell if what I see is from the fake cryptowall infection or from the CryptoPrevent you have installed. You did state that you can see your files but are not able to access them.
What I would like you to do is based on a hunch so it is a bit speculative in nature. I would like you to try a normal fix using FRST in the following paragraph. We do have a copy of the HKLM hive from your registry on the outside chance that things go awry. I will also have you make a backup copy of your registry prior to running the fix.
Again, understand that this fix is speculative in nature and it could possibly make issues worse.
The choice is yours to continue.
Step 1.
Registry Backup (TCRB)
TCRB should still be on your desktop. If it is, skip to #1. Otherwise;
Please download tweaking.com_registry_backup_setup.exe
Choose a download site for the installer... download and save it to your desktop.
Double click on the "...setup.exe" program and install the program. Let the install use the default installation. How to tutorial here.
Once the program is installed...
< STOP > If you did not successfully complete this step. < STOP > Do not continue with any other steps, post back and let me know!
Step 2.
NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
Also, be sure to check your files and see if they are accessible.
I have been looking at the data in the HKLM hive from your registry and cannot tell if what I see is from the fake cryptowall infection or from the CryptoPrevent you have installed. You did state that you can see your files but are not able to access them.
What I would like you to do is based on a hunch so it is a bit speculative in nature. I would like you to try a normal fix using FRST in the following paragraph. We do have a copy of the HKLM hive from your registry on the outside chance that things go awry. I will also have you make a backup copy of your registry prior to running the fix.
Again, understand that this fix is speculative in nature and it could possibly make issues worse.
The choice is yours to continue.
Step 1.
Registry Backup (TCRB)
TCRB should still be on your desktop. If it is, skip to #1. Otherwise;
Please download tweaking.com_registry_backup_setup.exe
Choose a download site for the installer... download and save it to your desktop.
Double click on the "...setup.exe" program and install the program. Let the install use the default installation. How to tutorial here.
Once the program is installed...
- Right mouse click the Tweaking.com Registry Backup icon, select "Run As Administrator" to run it... if UAC prompts, please allow it.
- It should open with the Backup Registry tab selected and all file options checked. Check any that are not already checked.
- Click on Backup Now to create a backup of your Registry.
You'll see "Waiting for Volume Shadow Copy snapshot..." this may take a few moments, just be patient. - When completed you should see a message saying something like ... Successful ??/?? Registry Files Backed Up ... ?? is total number of files, both numbers should match.
- Close and exit the program.
< STOP > If you did not successfully complete this step. < STOP > Do not continue with any other steps, post back and let me know!
Step 2.
- Click Start
- Type notepad.exe in the search programs and files box and click Enter.
- A blank Notepad page should open.
- Copy/Paste the contents of the quote box below into Notepad.
- To make this easy, click the "select all" button then hover over the highlighted text and right mouse click to select copy.
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %programfiles(x86)%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Appdata\Roaming\Microsoft\Windows\IEUpdate\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.pif <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.com <====== ATTENTION
HKLM Group Policy restriction on software: *:\$Recycle.Binscr <====== ATTENTION
HKLM Group Policy restriction on software: %programfiles%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *:\$Recycle.Binexe <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: lsassvrtdbks.exe <====== ATTENTION
HKLM Group Policy restriction on software: vssadmin.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %systemdrive%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.com <====== ATTENTION
HKLM Group Policy restriction on software: *:\$Recycle.Bincom <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *?* <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.pif <====== ATTENTION
HKLM Group Policy restriction on software: scsvserv.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.exe <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: lsassw86s.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: cipher.exe <====== ATTENTION
HKLM Group Policy restriction on software: *:\$Recycle.Binpif <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.com <====== ATTENTION
HKLM Group Policy restriction on software: syskey.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\arceee2.tmp\sstinstaller.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\arc713a.tmp\sstinstaller.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\arc713a.tmp\sstinstaller.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\arc713a.tmp\sstinstaller.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\arc713a.tmp\sstinstaller.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\arceee2.tmp\sstinstaller.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\arceee2.tmp\sstinstaller.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\arceee2.tmp\sstinstaller.exe <====== ATTENTION
GroupPolicyUsers\S-1-5-21-3725795197-1872689522-2498876610-1271\User: Group Policy restriction detected <======= ATTENTION
- Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt
NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
- Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
- Press the Fix button once and wait.
- FRST will process fixlist.txt
- When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
- Please post me the log
Also, be sure to check your files and see if they are accessible.
Just to be clear .....The files are accessible , in that you can open them , it's just that they are all encrypted ......With text based files it's obvious as you can see the encrypted text .....with pdf or pic files etc. , the appropriate program will try to open them and then state that it is an incorrect file type or is corrupted ...hence unable to view
I'm fine with proceeding if you still would like to go it that direction
I'm fine with proceeding if you still would like to go it that direction
Hi heyoka05,
Would you please upload this file: C:\Users\Public\Documents\DECRYPT_INSTRUCTION.HTML
And then one of the encrypted text files to http://www.zippyshare.com/
Then post the links.
wbg
Would you please upload this file: C:\Users\Public\Documents\DECRYPT_INSTRUCTION.HTML
And then one of the encrypted text files to http://www.zippyshare.com/
Then post the links.
wbg
http://www66.zippyshare.com/v/19458172/file.html
http://www66.zippyshare.com/v/87552825/file.html
http://www66.zippyshare.com/v/18126455/file.html
http://www66.zippyshare.com/v/87552825/file.html
http://www66.zippyshare.com/v/18126455/file.html
Hi heyoka05,
I am sorry but you do have the CryptroWall infection. Since we have no method to decrypt the files we are unable to help.
Since the scanning program from Bleeping Computer had not identified the CryptoWall infection, I presumed that it was a Group Policy Issue blocking you from accessing your files. Such is not the case.
Since this is not a malware issue we are able to deal with, I have no choice but to close the thread.
I did all I could and hope the best for you.
wbg
I am sorry but you do have the CryptroWall infection. Since we have no method to decrypt the files we are unable to help.
Since the scanning program from Bleeping Computer had not identified the CryptoWall infection, I presumed that it was a Group Policy Issue blocking you from accessing your files. Such is not the case.
Since this is not a malware issue we are able to deal with, I have no choice but to close the thread.
I did all I could and hope the best for you.
wbg
Gary R
We're sorry that we've been unable to help you get your machine back to a usable form. It appeared at first from your logs as if that might have been possible, but subsequent investigation has indicated that it is not really a viable option, and that the swiftest and most pragmatic way for you to get back a usable machine is for you to reformat your hard drive, and re-install a clean copy of Windows.
We apologise for any inconvenience you might have been put through, but as I said, early indications were that you may have had a copycat infection, and at that point your helper believed that he may not have been dealing with a true case of Cryptowall, in which case there was some hope that we may have been able to recover some of your "lost" files.
Sadly such was not the case, and so we recommend you recover what you can from your machine, and then restore it back to factory condition.
To prevent you being held hostage in this way again, we also recommend that you adopt a policy of backing up your files to some detachable media, so that if you get attacked in this way again, you can simply wipe your machine, and then recover from your backup with minimal loss of time and data.
Do not backup your data to the cloud, as Cloud backups are usually linked to the files on your disk, and therefore would get encrypted along with the files on your disk. Similarly, do not leave any backup disk you might use, connected to your computer. It should only be connected while you are making a backup (or recovering from one), at all other times it should be detached.
Once again, we apologise for any inconvenience you have experienced, or any false hopes we might have given you that the condition of your machine was recoverable.
We apologise for any inconvenience you might have been put through, but as I said, early indications were that you may have had a copycat infection, and at that point your helper believed that he may not have been dealing with a true case of Cryptowall, in which case there was some hope that we may have been able to recover some of your "lost" files.
Sadly such was not the case, and so we recommend you recover what you can from your machine, and then restore it back to factory condition.
To prevent you being held hostage in this way again, we also recommend that you adopt a policy of backing up your files to some detachable media, so that if you get attacked in this way again, you can simply wipe your machine, and then recover from your backup with minimal loss of time and data.
Do not backup your data to the cloud, as Cloud backups are usually linked to the files on your disk, and therefore would get encrypted along with the files on your disk. Similarly, do not leave any backup disk you might use, connected to your computer. It should only be connected while you are making a backup (or recovering from one), at all other times it should be detached.
Once again, we apologise for any inconvenience you have experienced, or any false hopes we might have given you that the condition of your machine was recoverable.
Thanks so much for all your effort and hard work wannabeageek .....it is most appreciated . No worries , I was backed up on the majority of my critical files ....I guess my main concern was that this thing was running in the background , possibly doing some bad things ....Since none of my anti virus programs have found any thing ......I guess a reload is the only way to be totally sure ....Just for my own knowledge , Do you think that the changes made by CrytoPrevent would stop this type of exploit in the future?
Once again can't thank you enough and Malware removal . com either ...you're all a great bunch of folks
Once again can't thank you enough and Malware removal . com either ...you're all a great bunch of folks