Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Ransomware Found

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Ransomware Found

Unread postby caotuan » September 7th, 2021, 6:31 am

Malwareremoval Team:

I received notice from Windows Defender of threats found. Upon receipt of the notice, I ran a scan with Windows Defender which reported clean. I tried to run FRST64 to post to this forum, but the application would immediately close. I ran Adaware, which reported a fraud-click trojan, powelik. I cleaned through Adaware. I ran SpyBot Search & Destroy 2.0, which uncovered Win32.Ransomware.loc. I clean, quarantined, and purged the Ransomware through Spybot.

Upon startup, I receive a Script Error notice. It reports the following:

Line: 1
Char: 78
Error: Invalid root in registry key "HKCU\software\jqaf\jxkm".
Code: 0
URL:

When I click No to continuing the scripts, I receive another popup with a title concerning javascript, ActiveXObject("WScript.Shell.") for the same registry key above.

The FRST.txt and Addition.txt logs are attached.
Attachments
Addition.txt
Addition.txt
(52.54 KiB) Downloaded 5 times
FRST.txt
FRST.txt
(57.77 KiB) Downloaded 3 time
caotuan
Active Member
 
Posts: 1
Joined: September 7th, 2021, 6:19 am
Advertisement
Register to Remove

Re: Ransomware Found

Unread postby Gary R » September 7th, 2021, 10:35 am

You have not attached your FRST.txt and Addition.txt to your post.

To attach them in your next reply ....

  • Click on Full Editor button to open the forum's post editor.
  • Click on the Upload attachment button and browse to your Frst.txt file.
  • Click on the Add the file button to attach the file.
  • Click on the Upload attachment button again and browse to your Addition.txt file.
  • Click on the Add the file button to attach the file.
  • Click on the Submit button to complete things.

PS .... if you did have a Ransomware infection on your machine, then you should not have tried to remove it, as by removing it you will have removed any potential decryption key, which means that any files it has already encrypted are not likely to be recoverable.
User avatar
Gary R
Administrator
Administrator
 
Posts: 25888
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 276 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware