VIRUS has formatted hard drive

[emaraszek]

It probably just indicated it was an empty volume, I wouldn't worry about it

 

[dkny1221]

ok no worrys let me no how you get on with that file you told me download and once you find out let me know and follow your instructions also it still scanning on malwarebytes anti-malware now its on 79 objects infected

 

[emaraszek]

Do you have another computer you can use to recover files off the infected one?

 

[dkny1221]

nope only the 250GB storeage device that ive got

 

[emaraszek]

So you're using the infected one right now? Since using the computer that you want to recover data from can lower your chances of recovering data it's better if you use a different computer to make a bootable CD and use that CD to recover data.

But if you don't mind risking some of your data, you can run the program I linked to on your computer and see what it can recover

 

[dkny1221]

ok do you want me to post the log once ive finished the malwarebytes log once its finished same with that program you linked me up with??

 

[emaraszek]

Yes after Malwarebytes cleans whatever it finds off of your PC, post that log. Then run the program you downloaded and do a complete recovery.

Here is how you do that:

1. Open the program, select 'Complete Recovery'
2. Select your main partition where everything was stored (most likely C click 'Next'
3. Let it scan the partition, this may take a long time
4. On the next screen, be sure the drive you want to recover is selected and then click 'Next'
5. Check off everything you want recovered, click 'Next'
6. Choose where to save these files (pick your external drive), hit 'Next'
7. When the process is done your files will be where you selected to have them saved to

 

[dkny1221]

ok no worrys il do that what about if say images say invalid image or videos wont play what happens then also i cnt access my folderlock files and i typed right passwords in and says wrong password how can i open them

 

[emaraszek]

Unfortunately images/videos that you can't open are likely corrupt. Do you have a backup copy of these things?

For locked folders, there is software that can crack the passwords on them, but I don't know of any that is free

 

[dkny1221]

ok il run that program soon that you got me as soon as its finished with malware and post both log files be back as soon as possible

 

[dkny1221]

hey just ran that program and didnt manage to pick anything decent up yet that Undo Delete shows that they are there nut multimple files of them say 2 empty files and 1 full file only viewable on Undo Delete program

 

[dkny1221]

just to let you know ive done a full scan and managed to find all the files and folders but alot of them have got a red D on the files also my microsoft word files have all changed to EEïnnÿuuöqqðnnèjjãhhàggßff½WWÒ how to i change it and also found loads of system restore points but not touched anything or restored antthing yet

 

[emaraszek]

I think the next step would be to try running a system restore from your windows installation disc. Hopefully it will be able to restore from the data that is still on your drive. If not you may need to purchase undo delete if it appears to be working for you

 

[dkny1221]

ive just ran a virus scan and its found the following WinFL.drv.sys and i placed it in move to chest on avast is that the dangerious virus that has damaged my computer?? also is there a way to maybe get a full version of undo delete with out having to pay for it?? say a 60 day trial or something or maybe even a serial number or something please

 

[emaraszek]

I've never even heard of that program so I have no code to give you, you could see if anyone else has one to give you but I recommend you do the system restore from one of your restore points and see what happens

 

[GianniDPC]

ive just ran a virus scan and its found the following WinFL.drv.sys and i placed it in move to chest on avast is that the dangerious virus that has damaged my computer?? also is there a way to maybe get a full version of undo delete with out having to pay for it?? say a 60 day trial or something or maybe even a serial number or something please

That file is another rootkit.

 

[dkny1221]

well it told me to either delete it or send to virus volt which 1 should i do

 

[emaraszek]

Get rid of it

 

[Borg 386]

It sounds as though you picked up some kind of ransomeware, usually these programs scramble your files and offer to give them back to you once you pay up for the key. Did you get any kind of pop up or message requesting something like that? If so, what was the name of it?

Also, with all the steps you've taken so far, you've probably overwritten some of the files. Most of them are probably compromised or damaged. It might be time to cut your losses, migrate whatever personal files you can and do a clean re-install since at this point it's doubtful the PC can ever be trusted again. Not to mention that you can start anew with a clean system. Just be sure to make a system image at regular intervals so the next time something like this happens, you can restore it.

Your system may have come with a factory restore that will reset it to the the point of when you 1st got it. If you can still access it, you may want to consider using it. Although the safest way would be to format the HD & use the Windows disk to re-install everything.

 

[emaraszek]

It sounds as though you picked up some kind of ransomeware

After visiting the site for the software I'm compelled to agree. It seems like something that was hastily setup to scam people. If that EASUS software I linked to didn't do the trick, I'm afraid your files are likely gone