Terry92104

Virus Encrypted Files on my computer. How do I decrypt?

I had a virus attack on June 4, 2012 which took down my Microsoft Security Essentials and Microsoft fire wall. The virus encrypted files in the "mydocs" folder and a few in a directory on my C drive. I believe that the virus was the "setsyslog32" Trojan, but I had several attack me all at once so I can't be sure. Has anyone been experiencing this virus? Do you have any ideas on how I can decrypt my locked files? I've also recieved a ransom note in each folder. I've attached that note below. Oddly, files and folders on my desktop were not touched. I've removed the viruses from my machine at this point but I need help to recover the damaged files.

YOUR ID: NNNN

Your computer protection level was very low and your system was attacked by
trojan program which encrypts data.

All your documents, text files, databases, pictures and etc. were encrypted by
secure AES algorithm with unique password.

Random password entry attempt is imposible, all the data will be damaged
after first unsuccessful attempt.

Programs that can restore data wont help you as original files will be
destroyed without a possibility to restore them.
It is useless to ask someone for help. Only we can decipher your data.

We will create a decipher program if you really need your files.COST IS $50.
We accept payments through MoneyPak. ( you can find more information on
their website www.moneypak.com).

Enter MoneyPak number with $50 value as well as your e-mail and click Pay.
You will receive decipher program which will help you to retrieve your files
and remove malware from your computer in 24 HOURS.)

We provide 100% guarantee that your data will be restored in 24 hours after
receiving payment from you.
receive a decipher. Such actions may make your data restoration impossible.
ATTENTION: In case if MoneyPak number and/or e-mail is invalid it will make
restoration process more complicated. PRODUCT COST WILL RISE TO $150.
EMAIL: *** Email address is removed for privacy ***

This thread is locked. You can follow the question or vote as helpful, but you cannot reply to this thread.

Answer

Le Boule

Did you try a System Restore?

You might be still infected.

This type malware attack has been seen primarily in Canada and Europe and I'm curious. Where are you located and do you know how you were infected?

See the following guide by Brian- who is one of our forum users - I think this should apply to your situation: http://www.selectrealsecurity.com/remove-ransomware You'll need to "make" your bootable rescue disk on a non-infected PC.

If you're sure you're no longer infected see the following thread - your issue is similar to that reported in this thread so perhaps unhide.exe or the suggestion of Oberwald will help: http://answers.microsoft.com/en-us/windows/forum/windows_7-security/live-security-platinum-has-corrupted-document-and/a16c76ce-75f5-45b9-95a7-cb1032a1a726

Or since you are using MSE:

Start here - https://support.microsoftsecurityessentials.com/ and select the link that says - I think my computer is infected. Options will vary by region, but phone support leads you to Microsoft Answer Desk (http://www.answerdesk.com/) in the US at this time. After an initial free consultation, a fee may be charged for assistance, based on the details of the case.

In other regions not served by the link above, go here: http://Support.microsoft.com/security and go to the “assisted support” or contact us menu. For international information, see your local subsidiary Support site.

If you'd like some free options, consider this web site - http://www.bleepingcomputer.com - which contains details for many of the common infections, often immediately after they began to appear in the wild, and instructions are provided for how to remove the infections using their malware removal guides. They also have forums where you can seek help from people who specialize in malware removal.

Other free malware-removal forum options include:

http://discussions.virtualdr.com/forumdisplay.php?f=71

http://www.dslreports.com/forum/cleanup

http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/64

http://www.geekstogo.com/forum/forum/118-security/

Regards...

http://ask-leo.com/i_run_antivirus_software_why_do_i_still_sometimes_get_infected.html

MVP Consumer Security 2014-2016
Windows Insider MVP 2016-2018