cottonball,, that was just the extension they use for the encryption of the files. we have found out that we are facing a cryptowall .. we dont have any more option, rather than reformat the computer, and put windows 7 on it since shadowcopy is not supported on Win XP's.
i believe it is a ransomware because on other blogsites and forums, i see those Cryptowall applications screenshot, same as what i see on our computers here.
The reason XP is not recommend for internet use you have found out.
XP does not meet todays needed security requirements.
Cottonball is very good at beating up on infections so I will get out of the way.
ShoTTaS,
Thanks for the info. I realize .blkpure was just an extension. Was trying to search the extension to get to the source of the infection.
If you are facing CryptoWall 3.0, at this time there is not much hope to recover the files.
Some info here > After a brief hiatus malware developers release CryptoWall 3.0 - News
You may also consider using CryptoPrevent > https://www.foolishit.com/vb6-projects/cryptoprevent/
Will you be able to provide the Malwarebytes report requested earlier?
I wasn't able to get the logs of malwarebytes.Will you be able to provide the Malwarebytes report requested earlier?
I Cant get my hands on the infected computers anymore, it was being quarantined out of sight. Infected users where given new computers for their daily reports.
If you can, you may want to suggest the use of CryptoPrevent to whoever is fixing the machines: https://www.foolishit.com/vb6-projects/cryptoprevent/
If the company you work for has taken charge of whatever actions are necessary to clean the affected machines, that is good.
Assistance at this type of forum is really not intended for a computer used in a business. Many of us are amateurs, have different knowledge levels, and it is not possible to anticipate any alterations or configurations made to business machines, or how they will interact with the tools we commonly used in the removal of malware.
Quote