Spora Ransomware for Dean Smith

[dsmithappraisals]

I went to a website that said that I had to download a chrome font to read it. After downloading I had chrome open with a ransom note from Spora Ransomware stating that all my work and personal files have been encrypted and only they could restore my files. Their website is at httpx://spora.biz and their email is admin@spora.bz. I have a copy of the html that they put on my computer. After searching the internet I have found that it sounds like the english version is a newer virus and it is discussed on bleeping computer.com. It has made multiple file formats unreadable such as jpeg, pdf, xls, and psd. There are more on the list at bleeping computer.com that I have not tried yet. They do not show up in thumbnails or my windows login icon at windows startup. I have been trying to figure out what to do over the last week and have installed and run multiple free virus programs hoping for some help.
https://www.bleepingcomputer.com/news/security/spora-ransomware-works-offline-has-the-most-sophisticated-payment-site-as-of-yet/

[Gary R]

If you're wanting to recover any encrypted files, then I'm afraid we can't help you, as far as I'm aware there is no current decryptor for files encrypted by Spora.

Bleeping Computer have a support topic for people infected with Spora ... https://www.bleepingcomputer.com/forums ... elp-topic/ ... and probably have the most up to date information on this infection.

If you're just wanting help in cleaning your machine of infection, then we can help you do that, but what I'd personally recommend you do, is to first take copies of any encrypted files you have and save them to detachable media (in case a decryptor becomes available at a later date), and then I'd reformat my hard drive and re-install Windows.

[dsmithappraisals]

Thanks for your response. I was kind of thinking that that would be the end result. I have only had this computer since July, so the damage is limited to about 1/2 a year. I have been wondering what I can save off of my computer, but I do not know the extent of the infection and I don't want to spread it to anything else. I was wondering if I could save my pst file, because there are some things in outlook that I would like to keep. They would probably re download off of my servers if I re installed outlook and set up the email accounts. I just got a warning from AVG stating that it blocked a threat "We've stopped this threat from spreading. Win32:SuspAttach [Susp] in....uue#176625856\TTcopy#10122800.exe ..Microsoft Office\root\Office16\Outlook.exe" I wasn't at my computer when it came up, but Malwarebytes was running a scan at the time and I don't know if that was the cause. Any advice on cleaning the infection would be appreciated.

[Gary R]

The problem with cleaning an infection of this sort, is that if you miss anything, then there's a very real chance of re-infection, and then you're right back where you started from.

Although it is a right royal PITA, I still recommend a reformat and reinstall as the best way to ensure you do not have a recurrence of this problem once you've re-installed any backed up files that you might have.

However, if you're determined to try and clean your machine, please let me know and I'll give you instructions for what to do next.

[dsmithappraisals]

is there anyway to make sure that outlook is clean?

[Gary R]

Only by scanning it with an AV scanner, the one I use most often is ....

ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

• Please go HERE then click on Run ESET Online Scanner

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked.
• Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology
• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed click on Start to start the scan.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed you will be presented with a list of found threats ....
  
  • Click on the List of found threats link
  • Click on Export to text file
  • Save as ESET.txt to your Desktop
• Exit out of ESET Online Scanner.
• Post me the contents of ESET.txt please.

[dsmithappraisals]

Here is the results of the Eset scan. 13 infections

[Gary R]

There's nothing in your e-set log to suggest that your Outlook files are infected, so they should be safe to backup before you reformat your hard drive, and you can then re-install them after you've reinstalled your new clean copy of Windows.

Obviously your computer is infected, but then we knew that before we ran the e-set scan.

[Gary R]

This topic is now closed