HomeGroup Encryption of Files

[Goldfish101]

I read somewhere that once a file is encrypted using EFS, it can only be accessed by the Windows login that encrypted the file. Although other users on the same computer might be able to see your files, they will be unable to open them – including Administrators.
The question I would have is it possible that a virus such as a Crypto type could hacks a pc and use the PCs encryption system via Homegroup, sort of tricking the pc that there is a group when in fact there is only one PC.
The reason I ask is that my pc has been hacked by a virus and a Homegroup account has been set up along with an Everyone user plus two others which was hidden with files encrypted and file user permissions set up which prove difficult to change. if I undo all the virus set up rubbish and get back to Owner only what will happen the encrypted files.

 

[Alejandro85]

EFS doesn't protects at all against those kind of viruses, at all. It's not even designed to do so. The reason of that is included in your own post:

once a file is encrypted using EFS, it can only be accessed by the Windows login that encrypted the file

If you encrypt files with your user account, only that account will have the decryption key, so you logically can use the files. Problem is that the vast majority of viruses will also run with your own user account too, as they usually are run though a web site or though a downloaded file. Hence, the virus will also have the very same access as yourself, including the encrypted files (this is also the reason why running with an admin account is so bad, the virus get access to everything).

The homegroup thing seems to be unrelated to anything like ransomware, it's not needed at all to capture all your data. It could be used however to further spread infection or to create a backdoor for more things to enter or re-infect the affected system.
That's why the usual recommendation after a system has been found infected is to simply reformat it. It's impossible to know for sure what the malware has been done exactly, and most important how to revert those changes.