[SOLVED] Malware + CSI Payload corrupt

Soor,
  • Click on the Start button and in the search box, type Command Prompt
  • When you see Command Prompt on the list, right-click on it and select Run as administrator
  • Enter the command below and press on Enter;
    Code:
    Dism /online /Cleanup-Image /StartComponentCleanup /ResetBase
  • Let the scan run.
  • After this, try again the DISM command here and let me know the result.
 
May I know whether I should use the internet or not?

Your computer is clean from malware now, so you can use the internet, but please be careful this time!

You run DISM with internet connection, right?
 
Your computer is clean from malware now, so you can use the internet, but please be careful this time!

You run DISM with internet connection, right?
Yeah, I did use the internet connection.
 
wLPkDda.gif


You made my day, Soor!

This is excellent news!!!
 
If you want to make a try to decrypt your documents, upload samples of encrypted files, ransom notes and any contact email addresses or hyperlinks provided by the cyber-criminals to ID Ransomware (IDR). This service is strictly for identifying what ransomware may have encrypted your files. It will attempt to point you in the right direction, and let you know if there is a known way of decrypting your files.

At this point, I have to ask you: Is there any remaining issue/question/concern, regarding this computer?
 
wLPkDda.gif


You made my day, Soor!

This is excellent news!!!
Ah, thank you! But I couldn't have done this without you and this forum😇. Many many thanks! It can't be expressed in words.

10 days ago, I was so scared that I didn't even sleep well for a couple of days. Now, I'm so happy. Thank you so much! :D

I wish to make some donation, but it doesn't allow me to make payment using card, and I don't have PayPal either.
If you want to make a try to decrypt your documents, upload samples of encrypted files, ransom notes and any contact email addresses or hyperlinks provided by the cyber-criminals to ID Ransomware (IDR).
I tried this, and I was asked to download Emsisoft Decryptor for STOP Djvu. On trying to decrypt, I got this message:
Notice: this ID appears to be an online ID, decryption is impossible.
At this point, I have to ask you: Is there any remaining issue/question/concern, regarding this computer?
I guess there are no issues as of now. I'll wait and watch how my laptop behaves (for a week or so). I'll update this thread in a week.
 
Hi, Soor.

Your computer had a very bad/nasty infection which also caused system corruption. I wouldn't sleep as well if I were you 10 days ago! And you are really lucky you don't have more files encrypted.

Now, I can say that it is clean and I'm giving you the green pass!

The following tool will remove the tools we used as well as reset system restore points:


Download KpRm by kernel-panik and save it to your desktop.
  • Right-click kprm_(version).exe and select Run as Administrator.
  • Read and accept the disclaimer.
  • When the tool opens, ensure all boxes under Actions are checked.
  • Under Delete Quarantines select Delete Now, then click Run.
  • Once complete, click OK.
  • A log will open in Notepad titled kprm-(date).txt.
  • Please copy and paste its contents in your next reply.
 
Hi, Soor.

Your computer had a very bad/nasty infection which also caused system corruption. I wouldn't sleep as well if I were you 10 days ago! And you are really lucky you don't have more files encrypted.

Now, I can say that it is clean and I'm giving you the green pass!
Yeah, only the files present in the C drive (C:\) were encrypted. All other files under sub-folders were/are safe. But the ransom notes "_readme.txt" were present in many folders and sub-folders. That was why the ESET scan took a very long time to complete.

Thank you for the green pass!
The following tool will remove the tools we used as well as reset system restore points:

Download KpRm by kernel-panik and save it to your desktop.
I wish to restore the pre-installed applications. May I know when should I restore them? Before or after running the KpRm tool?
 
I wish to restore the pre-installed applications. May I know when should I restore them? Before or after running the KpRm tool?

I guess, I didn't convince you to let that as it is... 🙄

EDIT TO ADD: You can do that now, before we remove AdwCleaner.
 
Very well! (y)

And now the lecture comes, Soor. Yes, yes, this is a necessary part of the process. :-)

As I already said, you had a very bad infection in your computer. This is not just because you downloaded, extracted and ran ONE crack software. There were many pirated programs installed, a P2P program and who knows what else. That means that you caused that with a careless behavior. I believed you got your lesson with the hard way, and I really hope you are going to be much much more careful now. Probably, you won't be so lucky next time.

So...

Now your computer is clean, here are some final tips about your computer's security from now on:

Some of the following, are from Klein's (2005) article, So how did I get infected in the first place. Since then, the article has been reproduced or linked to in dozens of locations. As a result, many malware experts have continued updating it, to include current operating systems and software program information. My source is Security Garden, and I marked for you the following:

1. Keep your Windows updated!
It is important always to keep current with the latest security fixes from Microsoft. This can patch many of the security holes through which attackers can infect your computer. And here comes the question: is there any reason you are still running Windows 8.1? This is a security risk you know.

2. Update 3rd Party Software Programs
Third Party software programs have long been targets for malware creators. It has been stated that "Adobe’s Reader and Flash and all versions of Java are together responsible for a total of 66 percent of the vulnerabilities in Windows systems exploited by malware.'' It's important to keep everything updated.

3. Update the browsers you use
Many malware infections install themselves by exploiting security holes in the Internet browser that you use. So... Keep them updated.

4. Be careful about what you download and what you open!
  • Many "freeware" programs come with an enormous amount of bundled spyware that will slow down your system, spawn pop-up advertisements, or just plain crash your browser or even Windows itself. Watch for pre-checked options such as toolbars that are not essential to the operation of the installed software.
  • Peer-to-peer (P2P) programs like Kazaa, BearShare, Imesh, Warez P2P, and others, allow the creation of a network enabling people to connect with other users and upload or download material in a fast efficient manner. BUT even if the P2P software you are using is "clean", a large percentage of the files served on the P2P network are likely to be infected.
  • Cracked or pirated programs are not only illegal, but also can make your computer a malware target. Have this in mind.
  • Do not open any files without being certain of what they are!
5. Avoid questionable web sites!
Visit web sites that are trustworthy and reputable. Many disreputable sites will attempt to install malware on your system through "drive-by" exploits just by visiting the site in your browser. Lyrics sites, free software sites (especially ones that target young children), cracked software sites, and pornography sites are some of the worst offenders. Also, never give out personal information of any sort online or click "OK" to a pop-up unless it is signed by a reputable company and you know what it is.

6. Registry cleaners/driver boosters/system optimizers
I do not recommend registry cleaners, system optimizers, driver boosters and the like. It is your computer and certainly your choice. However, please consider that modifying registry keys incorrectly can cause Windows instability, or make Windows unbootable. With registry cleaner and system optimization software programs, the potential is ever present to cause more problems than they claim to fix. Do note, however, that Microsoft does not support the use of registry cleaners. See Microsoft support policy for the use of registry cleaning utilities.

7. PC means personal computer!
Don't give access to your computer to friends or family who appear to be clueless about what they are doing.

8. Back-up your work!
Make back-ups of your personal files frequently. You never know when you'll have to reformat and start from scratch. You can always reformat and reinstall programs, but you cannot replace your data if you haven't made backups.

9. Must-Have Software
An anti-virus and an anti-spyware program is a necessity for the security of your computer. Be sure that you keep them updated, and that real time protection is enabled. You have now the built-in Windows 8.1 antivirus, Windows Defender. Together with Malwarebytes, if you run it occasionally, depending on how often you use your computer, can keep you safe.

Happy safe computing.
ZZZQehw.gif



I'm glad I was able to help you.
 
Last edited:
Very well! (y)

And now the lecture comes, Soor. Yes, yes, this is a necessary part of the process. :-)
Alright, I'll be careful:-)
1. Keep your Windows updated!
It is important always to keep current with the latest security fixes from Microsoft. This can patch many of the security holes through which attackers can infect your computer. And here comes the question: is there any reason you are still running Windows 8.1? This is a security risk you know.
Do you mean it's better to upgrade to Windows 10? Or updating current OS Windows 8.1 using the updates in the "Windows Update"?
Happy safe computing.
ZZZQehw.gif



I'm glad I was able to help you.
Thank you so much :-)

By the way, Dell SupportAssist isn't working now. It says, "We ran into an unexpected error. Please restart your PC and try again". Tried restarting, but it didn't help.
 
Last edited:
Do you mean it's better to upgrade to Windows 10?

Of course. I said above that it is a security risk, but this is not the case actually, since the extended support for Windows 8.1 ends in a year from now. But Windows 11 are already around and you are two versions behind. It's up to you, of course.

If you ever decided to do that, backup everything, just in case and then:
  • Go to this Microsoft page and under the title Create Windows 10 installation media press on Download tool now.
  • Save the tool on your Desktop and double click to run it.
  • On the License terms page, if you accept the license terms, select Accept.
  • On the What do you want to do page, select Upgrade this PC now, and then select Next.
  • Follow the instructions and select Keep personal files and apps, when you are asked to.
  • It might take a couple of hours, depending on your wifi speed connection, to install Windows 10. Your PC will restart a few times. Make sure you don’t turn off your PC.
  • After downloading and installing, the tool will walk you through how to set up Windows 10 on your PC.
Thank you so much :)

You are welcome.
 
Of course. I said above that it is a security risk, but this is not the case actually, since the extended support for Windows 8.1 ends in a year from now. But Windows 11 are already around and you are two versions behind. It's up to you, of course.
Oh, thank you for the information (about the support for Windows 8.1).
  • It might take a couple of hours, depending on your wifi speed connection, to install Windows 10. Your PC will restart a few times. Make sure you don’t turn off your PC.
May I know how much data will the update consume?
 
May I know how much data will the update consume?

You need at least 20GB available storage on your disk.
 
You need at least 20GB available storage on your disk.
Oops, I should have been more specific. My actual question is "How much data (internet) will it take for downloading the update?" And should that be a continuous process?

And another doubt: Do I need an Activation Key? Since I'm upgrading from original OS Windows 8.1 to Windows 10, will I get the Activated version of Windows 10?

Thanks.
 
Oops, I should have been more specific. My actual question is "How much data (internet) will it take for downloading the update?" And should that be a continuous process?

Sorry, I can't answer this question.

And another doubt: Do I need an Activation Key? Since I'm upgrading from original OS Windows 8.1 to Windows 10, will I get the Activated version of Windows 10?

Yes, normally the update won't ask for a key. However, it's good to have it with you, just in case.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top