So I'm not sure what my son downloaded but I think its from utorrent.
All our files have been encrypted and the attached document pops up every time we start the computer, for the last 3-4 days.
Is there any way to fix this?
I have done the aswMBR scan as mentioned in the Infected? instructions and the log is attached as well.
Any help would be appreciated.
I am not tech savvy at all and the only thing on this computer that I care about are my pictures.
Thanks in advance,
Rhonda
EDIT by paws:
One of the files shown,named "_how_recover_rvn.TXT" contains an active Trojan that executes malicious code… it has therefore been removed to protect our members…. the infection is identified as:
Ransom:HTMC/Tescrypt.C
Welcome to What the Tech. I am Marie Curie and will gladly help you with any malware-related problems.
I am currently in training at WhatTheTech and every post of mine will be approved by a teacher. This leads to a delay in my response time. I will return as soon as possible with instructions. Please familiarize yourself with the following ground rules in the meanwhile.
Read my instructions thoroughly, carry out each step in the given order.
Do not make any changes to your system, or run any tools other than those I provided. Do not delete, fix, uninstall, or install anything unless I tell you to.
If you are unsure about anything or if you encounter any problems, please stop and inform me about it.
Stick with me until I tell you that your computer is clean. Absence of symptoms does not mean that your computer is free of malware.
Your computer seems to have a newer variant of a Teslacrypt infection. We can try file recovery methods later to get your files back, but unfortunately there is not much more we can do. The files have been encrypted in a way that makes it impossible for us to decrypt them. The attackers are the only ones who have the key to do that.
In any case, we need to check your computer first for any malware on the system.
Please run the following diagnostic scans so I can ascertain the state of your computer. STEP 1 [external image: xlK5Hdb.png]Farbar Recovery Scan Tool (FRST) Scan
Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) andsave the file to your Desktop.
Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
Right-Click FRST.exe or FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the programme run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Attach both logs in your next reply.
