new ransomware
just got hit.  file extension is mole02had a user walk to my door saying they could not open an excel file.  went to her desk and she showed me the directory.  noticed right away the help***.txt file.  ran back to my desk, located the owner of the file and unplugged that computer.caught it early enough that only about 7 gb of data was encrypted on the file server.  out crm and erp have not been hit.  restoring from backups and wiping the offending computer.now to investigate how it came in.i will not pay the ransom!!!
another prevention method i use = fsrminstructions can be found at: http://jpelectron.com/stopcrypto
the problem has been solved.

i got in contact with our provider and they were able to apply the proper access to the folder for verification.

thank you for all of your help and patience. this thread can now be closed. The file is spyware releated ,download the spyware programs at the bottom of my post and update them and run them ,do not remove anything with hijsckthis ,copy and paste the log in here , have you tried entering safe mode? Let us know if it is the same.



It could be corrupt files and not startup programs. You have some minor problems to remove. This first batch is useless paid-search listings to make money for **HP**:



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)  

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)  

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default\_Page\_URL = [http://qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fqus9.hpwis.com%2F)  

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default\_Search\_URL = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)  

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [http://qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fqus9.hpwis.com%2F)  

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)  

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)  

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default\_Page\_URL = [http://qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fqus9.hpwis.com%2F)  

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default\_Search\_URL = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)



This is a problem BHO:



O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)



That's all I see for now. Are you running **DSL**? ignore it. it's an ad for a company that is trying to sell you software. the ad will tell the same thing to everyone. do not download it - it's likely spyware or adware. cheers. this issue is now confirmed fixed by a large percentage of our user base. if you're still having issues, please make sure you on the latest version of malwarebytes (at the time of this article, it's malwarebytes 3.5.1.2522 with component package version 1.0.441).
 


 


 if you continue to have issues after that, please make a new post using the following as a guideline You can post a hijackthis log and i can take a look at it for you. Malware might be the cause. virustotal shares their data with antivirus vendors or never upload there to check. i m no expert on malware writing but veil evasion payload + cryptor is fud most of the time however if you are trying to learn malware coding i ve seen some good courses, check one of em out see the attached file: [extractnumberregex.xaml](/uploads/short-url/qbznpruo2eviur9srhj8qzzs7yn.xaml) (5.1 kb)

[image]

[image] Is there any method or ways you can tell me to recover my files.. please!! : (( it matters a lot...