Notepad documents were fine. Now scrambled????

Ahh.. the CrytpoWall 3.0..my new friend

Thank you everyone for all the help in this unpleasant matter.
I updated (again) my malware bytes and ran a scan this morning and it detected a short list of threats that it dealt with.
I see a lot of information about programs that can prevent it from happening but not much about dealing with it.
I don't know if it's been stopped or not.

My idea at this time is to copy the (not backed up) video files I need to keep onto a new external drive and then erase all my drives.
Then with my disc clone machine remove and wipe my main drive by cloning it with my backup drive which will get my system up and running with most of my software already installed and licensed. Then take my external backup drive to the geek squad or someone to have a massive scan done on it before I try to use it.
The rest of the files that were encrypted will have to be a loss as it seems there nothing I can do.

Does anyone know how to find all these 4 files that it created and put in every folder on my system (HELP_DECRYPT.png, .txt, web links). I cannot manually go and delete all of them as there are too many. Windows search (at least in safe mode) is not letting me search for the file name HELP_DECRYPT.xxx
 
Last edited:
:thumbsup:Thank you. The Agent Ransack works great!
And I thank everyone who took the time to chime in and help.

This ordeal is kind of funny as I am the kind of guy that usually keeps backups on multiple external drives on and off location. Yet the last many months have been very hard. The other owner has stolen all the money I made and made a huge mess so I have been struggling non-stop dealing with endless problems and unable to perform my normal backup and organization methods. As luck would have it, the day the virus happened was the very day I had finally gotten to a point where I was going to be able to start organizing my libraries and make new backups.

Thankfully the attack was caught before my entire workstation was encrypted and ruined. I have run multiple virus programs now and it seems the virus is haulted. It will take a long time to salvage what can be salvaged and make up for lost time, but I will be able to continue working, thankfully.

I have a rule not to allow workstations to browse the internet (except DVXuser, pond5, B&H, videoblocks) but that day I was so worn out I was unable to continue working so I looked at the Ford Transit USA forum to learn more information and saw that it had a long list of strange looking threads so I left it immediately. The site had been compromised and I was infected. It's my fault for not following my own rule. Workstations stay off the internet!

You guys are great. Thank you :thumbsup:
 
I've been a computer programmer at a large company for a decade. It sounds like you have some good security habits. Here are a couple more:

1. Use Google Chrome instead of Internet Explorer. Or maybe Firefox.

2. Normally run as a Standard User, not an Administrator. In other words, you need two user accounts: one for normal use, named like firehawk, which is a Standard User; and one named like Admin which is an Administrator user account. Log in as Admin only to install something. Log in as firehawk to edit videos, surf the web, check email, etc. Viruses run as the logged-in user. If the user doesn't have the right to install something, the virus can't install itself. This simple rule is a central part of industrial-strength operating systems like Unix, Linux, and BSD. Some daring and I guess very smart computer guys use only this technique. They have no antivirus software installed, not even on their Windows computers, and they have never caught a virus.

If you're already doing these two things, and yet still got the virus, let me know. I would be curious.
 
Last edited:
Glad it worked out. Losing data sux.

combatentropy said:
They have no antivirus software installed, not even on their Windows computers, and they have never caught a virus.
Click to expand...

I actually do desktop support and while we have AV at my job, I do not run any on my computers at home. I can sense when I have a problem and run malwarebytes and that will clean whatever I may have picked up. Don't recommend for everyone of course but it works in my situation.
 
combatentropy said:
I've been a computer programmer at a large company for a decade. It sounds like you have some good security habits. Here are a couple more:

1. Use Google Chrome instead of Internet Explorer. Or maybe Firefox.

2. Normally run as a Standard User, not an Administrator. In other words, you need two user accounts: one for normal use, named like firehawk, which is a Standard User; and one named like Admin which is an Administrator user account. Log in as Admin only to install something. Log in as firehawk to edit videos, surf the web, check email, etc. Viruses run as the logged-in user. If the user doesn't have the right to install something, the virus can't install itself. This simple rule is a central part of industrial-strength operating systems like Unix, Linux, and BSD. Some daring and I guess very smart computer guys use only this technique. They have no antivirus software installed, not even on their Windows computers, and they have never caught a virus.

If you're already doing these two things, and yet still got the virus, let me know. I would be curious.
Click to expand...

Thank you kindly for that advice, combatentropy. I am embarrassed to say that I had never thought of that. I use Internet explorer more than chrome and firefox but that is changing immediately. I also am creating a standard user account to use. I wish I had done that before.

Looks like it will be faster to wipe my main drive and go back to my last backup drive. It will be faster to re-install the few missing programs and updates than to deal with all the little corrupted files that plague my c:>. For instance, any help file, or image is corrupt and the darn virus also gets 3ds max files (.max, .3ds), .zip, .pdf, .wav, and .psd.
Thankfully over half the space on my media drives wasn't affected yet when I caught it.

I am grateful to you guys.
 
Is it definitely the case that they were able to install this malware on your system, even though you did nothing more than open the forum in a browser? You didn't download anything or click "yes" to any pop-ups? That sounds like a pretty serious flaw in Internet Explorer. I didn't realise that it had got to the point where simply visiting a page permits the installation of malware capable of writing to the file system.
 
Hi
Some really good advice above this post. In addition to not using Internet Explorer for casual surfing have one browser configured for casual surfing. NO FLASH or any other add-ons installed. Set browser to delete history on closing. Be very suspicious. As mentioned above serious computer types rarely catch stuff because they intuitively can sense trouble.

Okay aside from using a different machine for browsing you can also create a virtual machine and install a robust Linux version. Then set the virtual machine to not save any changes and every time you start it you are clean and ready to go. This is how a lot of testing is done. Although with Windows installed if testing stuff on Windows. This creates a very difficult barrier to malware.

Even better... Have your drives removable and unlatch them and replace your C: drive with another drive for browsing. Then you do actually have another computer. I do this for places that I have set up video editing machines where it is part time video editing and used by other people the rest of the time. The other users seem to always mess over the video editing machine so I leave it set up with a single "casual use" C: drive and the video editors replace it and close the drawers of the other drives when they want to edit.

One last word. Even with a clean bill from the scans you mentioned the malware could still be present, even if in a partial damaged form. Many times a scan will partially get a malware but not totally resulting in essentially some sort of standoff. These newer malwares hide in many places and rejuvenate themselves in many ways. I don't rest until I know I have gotten all of it. In my experience the Geek Squad is not always up to something like you describe. Although like anywhere they are as good as the tech you deal with, which is to say sometimes not great and sometimes brilliant. I wish you the best with your computer and video business.
 
One way that a site might get infected is via a scanner app looking for a security lapse that permits a file to be uploaded or replaced. Another would be to find sites running software with unpatched vulnerabilities. Don't underestimate the degree to which companies will ignore security risks. Many won't act until notified that they might be the source of an infection.
 
I thank each of you for your help.

How can I really know it is killed? Just because the geek squad, etc.., or scanners say so, doesn't necessarily mean it isn't going to strike back..
Can't viruses hide in RAM too?
I'm a little perplexed in what to do next. Just because it seems fine now doesn't mean won't be a phase 2 to this later. I am now also running Norton and doing a full scan each day with Malware bytes and Norton.
I can physically replace my main C:/> with a backup, but if the virus still remains on my media drives or in RAM then it wont' do any good. I could format or replace my media drives but there is still good media I need to copy off my media drives. I think I can see trail the virus followed and see where it got before haulted.


Since you guys are far beyond me in this area, I'm going to post various things and listen to what anyone has to say.
I usually used Internet Explorer (Ver 9). Bad idea I see now.

I thought back and re-traced my internet steps that day. Before the attack, I had logged onto my business facebook account briefly to upload 2 photos. Maybe I got it there, but I usually use Chrome for that because uploading photos from IE usually doesn't work well. I read some on the DVX forum but I don't remember when and checked email but I didn't download anything nor click any ads.
Later I visited the Ford Transit USA forum and saw almost every thread on the forum page had similar strange titles and were all by the same person. I thought it strange so I left. Then like a dork, I went back to the forum and sure enough it was like I thought so I left suspecting trouble. I didn't open any threads but I was on there long enough to see that nearly the whole page had strange titles.

I then went to the Area Autodesk forum to ask a question about 3d, but couldn't log in or remember my password so I went to open my txt file that had my login and it was encrypted. Confused, I wondered if it got corrupted somehow. So I started trying to decipher the weird symbols and tried to open another txt document and it was encrypted too. I went to the DVX forum to ask the original question on this thread. In the meantime, I opened Microsoft Word and received an error saying it needed to do a fix of some sort. Strange. I opened a couple word .doc and they worked, but then it wouldn't save. And the next attempt wouldn't open.
I see now I actually opened that doc as that portion of my drive was being enrypted because later it was no longer accessible either. (Too bad I didn't print those docs while I had one last chance!) So I was searching and looking at .txt files while the virus was underway. Being very tired I almost gave up but knew something wasn't right and as I looked at my files I found the virus HELP_DECRYPT files stating the Ransom message.

As I browse though all my files and drives I can see the path the virus took as it worked it's way through my files. It was going fast. I am grateful it didn't get further.
On a fast machine with fast drives I suspect I got it from the Transit forum considering the time frame of how things played out. But I do not mean to speak ill of that forum. It is a great site with good, knowledgeable people.
Getting this virus is my fault. I was using an outdated browser without sufficient security and breaking my own rule of having a workstation connected to the internet. The fact that I have been too busy to backup my files recently means I shouldn't have used the computer on the internet.

Hopefully this will be the extent of the virus damage and I can press on being a bit wiser and continue fighting these other (worse) problems. Lots of work and files were lost but over half of each drive was not yet encrypted. I had a number of stock music, AEFX templates and footage libraries that I hadn't backed up yet and I am glad it didn't get there yet. I fortunately had hard copies of invoices and some saved in emails so all is not lost. My 3D files were almost all backed up but I can re-download the new ones lost.

I feel bad for those victims who lost their family photos and digital memories who had no backup plan at all. The folks that do these mean things need prayer.
 
If your NLE system is not connected to the internet, is a separate, dedicated laptop a safe way to get plugins, music, .zip packs etc. back onto the edit system through USB?
 
Final Solution

Final Solution

To avoid this kind of issue running Windows, I run 7 with no internet access and no AV in a VMWare virtual machine on a Mac. Another user mentioned running a virtual machine on Linux, which is fine for those fakirs who enjoy sleeping on a bed of spikes. No guarantees go with anything, but so far, so good. The only issue is if I unplug my Superdrive - Windows detects the hardware change and prompts to be activated. You can activate on a smart phone nowadays, and when I activated, I saved a screen shot of the activation code, so that reactivation takes less than a minute. If you go with this solution, be sure to read the VMWare Fusion documentation, which presents the different configuration options for the virtual machine. The default browser on the Mac is Safari which I run without he Flash player. For videos that must play on Flash, I run Firefox with maximum security settings. This solution requires a lot of RAM and processing power. I'm running with an I7 quad-core processor and 16GB RAM. I can tell no difference between running Windows on the virtual machine and running natively on the hardware.
Formerly, I was a network consultant supporting small business, and I later handled enterprise escalations at a major computer company. I have spent a lot of time on Windows, going back to 3.1. When I retired, I bought a Mac and never looked back.
 
Hi
I can't speak to this specific situation but I can offer some interesting advice on some common ways to catch malware.

When you load a web page from a legitimate site you almost always see places where ads also load. These spaces are sold by the legitimate web site to advertisers, like Google, for instance. In it's most advanced form as you load the web page this space goes out to an online auction where any advertiser may bid on showing you an ad on that specific page that specific time. The winner then gets to load their ad on the page you are viewing.

This all happens ideally in milliseconds and always without human intervention. The legitimate web site has no idea what is being displayed to you on it web page. Indeed it may contain malware.

I believe that the number one vector for malware is currently getting the user to say yes to some trickery and granting permission for the first load of malware to be loaded. Then off to the races as they say. I think maybe Flash is the second most common. It is being updated often but still seems to give malware new opportunities. I think it has become so bad that it is being replaced by HTML 5.0.

Just by not saying yes to free downloads, music, opening strange emails, not allowing pictures to download in emails automatically, keeping Flash off of most of my browsers I rarely catch malware.

The best anti malware programs I have not seen mentioned in this thread. They are usually for pros only because they can break the "do no harm rule" in a big way. To fix your machine they may also rip big nasty holes in your operating system, programs or data. Then the users blame the program. Pros usually can go back and clean up. I should note they do damage rarely, but users get REALLY upset.
 
Hi
To answer the question about virus hiding in system RAM. While a machine is running, yes. But once shut down, no. You do have nightmares like root kits, virus hiding outside allocated disk space, CMOS, BIOS and other exotic stuff. Some more imagined than real (and some very, very real). Some malware likes to hide on USB sticks. Some hide inside pictures or video! Remember a picture is just code, and within that code can be malware.

After an infection observe the machine carefully and check out its operation. Look carefully for any suspicious behavior. For complicated malware run any programs you can get your hands on against it. You will be surprised that the third time you run the fifth program you have tried, BINGO, it will find some more malware. this is one reason that it takes time to find and kill this stuff. Pros have better intuition and maybe have seen it before. Pros can work faster with better results. But it is the same for everyone. Look for symptoms and then cures.

Wish you best of luck, we have all pretty much been where you are.
 
A security report on my system showed 5 filtered threats in the past month, all coming from a subdomain on thesyndicationserver.co.uk.
 
rob norton said:
If your NLE system is not connected to the internet, is a separate, dedicated laptop a safe way to get plugins, music, .zip packs etc. back onto the edit system through USB?
Click to expand...

Yes I have a laptop running virus protection for those purposes. I used to not even connect an NLE to the internet at all, but it became such a pain with software/plugins that require internet. So I allow(ed) one NLE to use internet and it's the one that got hit of course. Though it took 2 years.
 
You must log in or register to reply here.
Back
Top