Executable files are created in HDD's and corrupts installers.

[Markitoo22]

Hello good afternoon. My name is Mark, I'm from Argentina, Buenos Aires. I happened to comment on my case. The issue is that took my pen drive to a graphics company to make some flyers advertising. He was inserted into the machine, and when I'm connected to my PC, I was infected with a particular virus ... The issue is that .exe files are created on the HDD of the machine, files that have the name " direct access to MS-DOS program, "and I can not remove anything, the .EXE that is created with the following names, all random," nhmu "-" faivv "-" LBGP "-... that is, pass any number of Anti-Malware, Anti-Rootkit, Anti-Spyware, whatever you want ... the eliminated, but after a certain time, reappear. Also, we must consider that damages me installers who are in the other Ruled disks, ie, installers programs, games, all kinds of things, giving me a message saying: "The setup files are corrupted, or are incompatible with This version of Setup. Please correct the problem or Obtain a new copy of the program. "... Please dedicate myself to the computer more than 10 years ago, and never happened to me something, honestly, I surfed by more than 500 pages, in order to find information, and nobody can fix ... I set in the Windows registry in the background processes, services of the machine, not quite find anything .. I use the machine for will work, and always take care, this time, it was a mistake to have "confident" the company display advertising ... If you need images, is the way, no problem. I hope answers thanks and greetings!

 

[samuria]

Welcome to the forum. This is a type of ransom ware which is encrypting all your files to exe if you try and run any they will add more infections. You need to look for svhost running from a strange directory and kill it in task manager you can try downloading rkill see if that kills it delete once you have killed it. We can then fun our scans

 

[Markitoo22]

Hello. Thanks for answering. The issue is this, I have a lot of processes are called svhost ... As I can realize that this is having problems? I think this has no solution, I can not give the key ...

 

[MoxieMomma]

Hi:

Unfortunately, in most cases, you either have to pay the ransom or your files are toast.
(Sometimes they are toast even if you do pay.)

If it's a ransomware variant for which no decryption key/solution is available now, some experts suggest the following:

• Remove the entire drive and save it for possible recovery in the future, if/when a key is released.
  • It's a long-shot, but if you have no data backups, it may be the only hope for ever recovering your files.
• Replace the hard drive with a new one and reinstall Windows from scratch on that new drive.

You can get expert help with general cleanup on the affected system, especially for other malware on it.
But, once the files are encrypted they are pretty much gone unless you have backups.
The ransomware itself is often "gone" once it has done its thing, as it cleans up after it encrypts your files.



Some of the more general computer fora and those that specialize in malware removal have entire sections devoted to ransomware and cryptovirology. You may find additional or more specific advice there, under the circumstances.


Sorry,
MM

 

[Markitoo22]

Hi:

Unfortunately, in most cases, you either have to pay the ransom or your files are toast.
(Sometimes they are toast even if you do pay.)

If it's a ransomware variant for which no decryption key/solution is available now, some experts suggest the following:

• Remove the entire drive and save it for possible recovery in the future, if/when a key is released.
  • It's a long-shot, but if you have no data backups, it may be the only hope for ever recovering your files.
• Replace the hard drive with a new one and reinstall Windows from scratch on that new drive.

You can get expert help with general cleanup on the affected system, especially for other malware on it.
But, once the files are encrypted they are pretty much gone unless you have backups.
The ransomware itself is often "gone" once it has done its thing, as it cleans up after it encrypts your files.



Some of the more general computer fora and those that specialize in malware removal have entire sections devoted to ransomware and cryptovirology. You may find additional or more specific advice there, under the circumstances.


Sorry,
MM

Good afternoon. These days I was rested, because honestly I was around 50hs trying to solve the problem, and I have not accomplished. From what I can understand it is that you tell me that there is no solution regarding the problem that I'm having, right? That is, by the evolution that had the virus on my PC, I can no longer recover the installation, that is a super powerful virus, and at the end of the account, I was working with more than 14 programs to clean the system, and it became impossible ... so the only alternative is to pay a remote service to an entity that is responsible for eliminating this type of virus, and if not, try to save all my personal information, and format the primary disk, am I Right? Please, if there really is no hope more, decimelo, so start formatting the system and everything back to normal, because I need the PC to work ... I am very grateful and I hope answers, greetings!

 

[RolandJS]

Do you have a local business-oriented computer fix-it shop; or a computer store with a fix-it department inside? If yes, and you trust the particular place:
-- print out your two or three posts, take your proof of ownership, and the computer to that shop, be prepared to pay them to:
-- clone the problematic hard-drive, so a ransomware solutions can be attempted on HD's data folders and files
-- purchase a replacement HD and get your Windows Prime installed; you will have to reinstall your 3rd party programs
-- if not purchasing a replacement HD, the original HD can be DBAN'd and the Clone HD can "operated" upon to attempt to rescue your data folders and files
I do not know if paying the ransom will get your data folders and files back.
Going forward, when all of this has been resolved, and you have your computer back safe & sound,
please begin making routine OS and data partition full image backups onto external media.

 

[samuria]

In most cases paying just means they demand more money or Rob you. Did you try rkill if you look for svhost running one will be in a none window's folder the longer you run the PC with it running the more it will encrypt it is slow running so you need to get any files that are on off quick. It doesn't effect windows so once you kill the file and delete it your OK

 

[MoxieMomma]

-- purchase a replacement HD and get your Windows Prime installed;

Just curious, @RolandJS: what is "Windows Prime"?
I've never heard of that.

<just trying to learn>

@Markitoo22:

Yes, as far as I know, your data files are likely lost forever if you did not have robust backups somewhere that was not hit by the encryption.
Otherwise, the only real (*faint*) hope, as was already suggested, would be to pull out the hard drive and save it for the future unlikely possibility that a decryption tool may someday be released for that particular ransomware variant.

Several of the busy, reputable computer fora that specialize in computer security have large sections devoted just to ransomware as its own, special topic.

Sorry about that,
MM

 

[RolandJS]

"...Just curious, @RolandJS: what is "Windows Prime"? I've never heard of that...." --MoxieMomma
I just got back onto the computer, my definition of Windows Prime means anything/everything that comes out of a Microsoft Windows install DVD and/or from a Microsoft web site [some but not all things].

 

[Markitoo22]

-- purchase a replacement HD and get your Windows Prime installed;

Just curious, @RolandJS: what is "Windows Prime"?
I've never heard of that.

<just trying to learn>

@Markitoo22:

Yes, as far as I know, your data files are likely lost forever if you did not have robust backups somewhere that was not hit by the encryption.
Otherwise, the only real (*faint*) hope, as was already suggested, would be to pull out the hard drive and save it for the future unlikely possibility that a decryption tool may someday be released for that particular ransomware variant.

Several of the busy, reputable computer fora that specialize in computer security have large sections devoted just to ransomware as its own, special topic.

Sorry about that,
MM

Hello good day! Well, I am absolutely grateful to everyone for giving me answers regarding this important issue ... It is incredible, as today, in the 21st century, we still have problems to eliminate this type of virus ... That is, perhaps Microsoft does not have the solution for these things? Perhaps the great companies of anti-virus, that fill the mouth of words, and in the end, can not solve this type of failure, considering that they are the most important failures to solve, in the life of a Technician Informatico ... Thank you very much, seeing that in the end, this has no solution, I will proceed to clean my system, file by computer, and then format the computer. I remain calm, that is not a failure, but this was a success, since now we learned, that when this virus makes contact with your machine, there is very little chance of recovering the system ... I was traveling more than 500 pages, and I invested more than 50 hours in trying to solve the problem, it was not achieved, anyway, I now have a lot of information, and I know that in the future, if I find the same case, I will be able to respond quickly and solve quick way. Imagine, if I had decided to speak in this forum, I would still be thinking about how to solve the problem, and spending TOO much time, trying to solve something, now that you, I clarified the panorama, things are totally different, that makes me happy! Thanks for everything! Greetings from Argentina, Buenos Aires!

 

[samuria]

It can be defeated as I have done it but files once tampered with are gone. The lesson to learn is one create regular system images two save docs, phots etc to one drive or Google drives then there safe with an image you can reinstall in 20 mins

 

[Markitoo22]

It can be defeated as I have done it but files once tampered with are gone. The lesson to learn is one create regular system images two save docs, phots etc to one drive or Google drives then there safe with an image you can reinstall in 20 mins

Hello, thanks for the answer. Exactly, I will take course with that type of tools, since I do not have an External Hard Drive ... I should have it, to have absolutely, everything separately, both important personal files, such as photos, images, videos, Installers of the programs and other files of the system .. Thank you very much for everything, they have really helped me to open my conscience on the subject. Greetings to all, I solve the issue, I hope it serves the other people in the community!