New
#1
Got hit with Ransomware Encryption Trojan
I got a Trojan or something because Microsoft Security Essentials was sounding alarm bells and a scan with Anti-Malware was bringing up stuff too. After some guaranteeing and rebooting I thought I had gotten rid of the problem.
But later when I started Firefox all my addons were missing, which was weird but restoring its Appdata folder to an earlier date fixed it. Then a couple text files looked like they had part of the text corrupted. Restoring those worked too. Then I saw that there were a lot of files that were Last Modified around the same time.
So I went and did a System Restore, upon rebooting the PC, Windows said System Restore failed because one file didn't restore correctly. But now there are no other System Restore points to pick (I know there was at least one extra) none of the corrupted files have previous versions available anymore, and my C: drive suddenly has 20 more GB of space (gulp)
It was after that I saw every folder in My Documents had a how_decrypt.gif and how_decript.html
Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software
Scan Date: 12/8/2014
Scan Time: 5:39:00 PM
Logfile: malwarebytes.txt
Administrator: Yes
Version: 2.00.4.1028
Malware Database: v2014.12.08.09
Rootkit Database: v2014.12.08.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Josh
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 470430
Time Elapsed: 2 hr, 33 min, 49 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Warn
PUM: Warn
Processes: 4
Trojan.Clicker, C:\Users\Josh\AppData\Local\Temp\conhost.exe, 46460, Delete-on-Reboot, [065fe57bb5c7e05692800be269987789]
Trojan.Agent.ED, C:\Windows\temp\A4F6.tmp, 62736, Delete-on-Reboot, [b8ad520ec6b6072f343230be36cbf20e]
Trojan.Zemot, C:\Windows\SysWOW64\owuhgyfu.exe, 18692, Delete-on-Reboot, [a9bcd28ee993cc6a5952b03a12ef6997]
Trojan.Zemot, C:\Users\Josh\AppData\Roaming\Hymyfi\rasyag.exe, 38488, Delete-on-Reboot, [73f2ff61b8c463d3ebc01cce3ec3be42]
Modules: 0
(No malicious items detected)
Registry Keys: 2
Trojan.Zemot, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SecurityCenterServer737721932, Quarantined, [a9bcd28ee993cc6a5952b03a12ef6997],
Trojan.Poweliks.B, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CLASSES\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}, Quarantined,
[85e02040c2ba60d6e188ef131de3bf41],
Registry Values: 3
Trojan.Zemot, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Cyecigruywgut, C:\Users\Josh\AppData\Roaming\Hymyfi\rasyag.exe, Quarantined,
[73f2ff61b8c463d3ebc01cce3ec3be42]
Trojan.Zemot, HKU\S-1-5-21-1096825299-2601053131-2088073329-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Cyecigruywgut,
C:\Users\Josh\AppData\Roaming\Hymyfi\rasyag.exe, Quarantined, [73f2ff61b8c463d3ebc01cce3ec3be42]
Trojan.Zemot, HKU\S-1-5-21-1096825299-2601053131-2088073329-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0
\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Cyecigruywgut, C:\Users\Josh\AppData\Roaming\Hymyfi\rasyag.exe, Quarantined, [73f2ff61b8c463d3ebc01cce3ec3be42]
Registry Data: 0
(No malicious items detected)
Folders: 0
(No malicious items detected)
Files: 18
Trojan.Clicker, C:\Users\Josh\AppData\Local\Temp\conhost.exe, Delete-on-Reboot, [065fe57bb5c7e05692800be269987789],
Trojan.Agent.ED, C:\Windows\temp\A4F6.tmp, Delete-on-Reboot, [b8ad520ec6b6072f343230be36cbf20e],
Trojan.Zemot, C:\Windows\SysWOW64\owuhgyfu.exe, Delete-on-Reboot, [a9bcd28ee993cc6a5952b03a12ef6997],
Trojan.Zemot, C:\Users\Josh\AppData\Roaming\Hymyfi\rasyag.exe, Delete-on-Reboot, [73f2ff61b8c463d3ebc01cce3ec3be42],
Trojan.Clicker, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\conhost.exe, Quarantined, [fb6a59076e0edb5b3bd77a73b051f808],
Trojan.GIFFU.ED, C:\Users\Josh\AppData\Local\Temp\UpdateFlashPlayer_97b76ed1.exe, Quarantined, [bca9243cdba15fd76d00f0fb69989e62],
Trojan.Agent.ED, C:\Users\Josh\AppData\Local\Temp\UpdateFlashPlayer_dd86d5a3.exe, Quarantined, [ee77c799b0cc4beb487704e0f60bf30d],
Trojan.Zemot, C:\Users\Josh\AppData\Local\Temp\UpdateFlashPlayer_f43266db.exe, Quarantined, [67fe5f018af296a02e7d1cce2dd4ae52],
Trojan.Clicker, C:\Users\Josh\AppData\Local\Temp\Low\SessionWin32k\3450\conhost.exe, Quarantined, [86df92ce106cae88ce447b72e21ffd03],
Trojan.Clicker, C:\Users\Josh\AppData\Local\Temp\Low\SessionWin32k\3900\conhost.exe, Quarantined, [3f26f46c3844b97d070bdc1116eb1de3],
Trojan.FakeMS, C:\Windows\temp\33.tmp, Quarantined, [4e1778e86715dd597d0a39995aa7cc34],
Trojan.Clicker, C:\Windows\temp\conhost.exe, Delete-on-Reboot, [ef76362a77050630b35fd914ef12cd33],
Trojan.Agent.ED, C:\Windows\temp\7942.tmp, Quarantined, [006564fc6a1238feab1493518d749d63],
Trojan.GIFFU.ED, C:\Windows\temp\7AFB.tmp, Quarantined, [ee773030df9d55e1e68778731fe2f808],
Trojan.Clicker, C:\Windows\temp\Low\SessionWin32k\7446\conhost.exe, Quarantined, [72f3e878e993b086987aa84538c93fc1],
CryptoDefence.Trace, C:\Users\Josh\Desktop\how_decrypt.gif, Quarantined, [84e15907245859dd786681d90cf709f7],
CryptoDefence.Trace, C:\Users\Josh\Desktop\how_decrypt.html, Quarantined, [ea7bc9972f4dc670518d3a20db2826da],
Trojan.Agent.RvGen, C:\Windows\Tasks\Security Center Update - 737721932.job, Quarantined, [d88dd68acdaf0b2b8ba31d6f48bc26da],
Physical Sectors: 0
(No malicious items detected)
(end)
I haven't noticed any more weird behavior yet, but can you help me rid my comp of this thing if it isn't gone for good, and is there a way to get my files back?