[Solved] Oh Terrific, now Power Locker Ransomware

Hi Fred,

Unfortunately the only way to get to the removal stage again is by running another scan.
But a quick scan will suffice.

It's best to be safe than sorry.

Step 1
Start Malwarebytes AntiMalware.
Click on the logs tab.
The logs are date stamped ... double click on the log that showed the infection items.



It'll open in notepad.

Please copy/paste the report in your next reply.


Step 2
Note:
There are both 32-bit and 64-bit versions of Farbar Recovery Scan Tool available. Please pick the version that matches your operating system's bit type.

If you are unsure what you're system bit type is..... click Here for help.

For x32 bit systems download Farbar Recovery Scan Tool and save it to your Desktop.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to your Desktop.

• Double-click the downloaded icon to run the tool.
  
  
  
• When the tool opens click Yes to disclaimer.
  
  
  
• Press Scan button.
  
  
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please copy and paste it to your reply also.

In your next reply, please submit:
MBAM scan report
Both reports from FRST


Thanks.

 

Hi Fred,

Apart from some small adware entries, there isn't much to worry about.
So just a few small things to clean up the report.
It may seem a lot to do, but the steps are quite small really.

Step 1

Windows Defender should have been disabled by Avast when it installed, due to possible conflicts.
Please disable Windows Defender.

• Click Start >> Programs >> Windows Defender or launch from the system tray icon.
• Click on Tools & Settings >> Options.
• Under Real-time protection options, uncheck the "Real-time protection" check box.
• Click Save.
• Go to Start >> Control Panel >> Security >> Windows Defender, at the bottom of the Window Defenders page uncheck under Administrator Options "use Windows Defender" and then Save.

Step 2
Please download the attached fixlist.txt file.
NOTE.
It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine.
Running this on another machine may cause damage to your operating system

Re-run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post this in your next reply.


Step 3
Let's make sure that all of the Adware has now been removed.

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin to scan your computer.
• After the scan has finished...
• Click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

Step 4
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. A malicious site could render Java content under older, vulnerable versions of Sun's software if the user has not removed them. Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) 7 Update 51 and save it to your desktop.
• Scroll down to where it says "Java SE 7 Update 51".
• Click the "Download JRE" button.
• Accept the license agreement.
• select 'Windows x64.exe' from the list.
• Save the file to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  .
  Java 7 Update 25
  Java 7 Update 45
  .
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on downloaded icon to install the newest version.

Step 5
Download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista/Win7, right-click on the file and choose Run As Administrator).
• It will close all programs when run, so make sure you have saved all your work before you begin.
• Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

In your next reply, please submit:
Fixlog.txt
AdwCleaner report



Thanks.

 

Hi Fred,

How's the system running?
Any problems?

 

Hi Fred,

To be honest, after a lot of searching i still can't find a definitive answer.
All i can do is offer what i suspect is the reason:
This is one of the entries from your MBAM report:
C:\Users\Fred\AppData\Roaming\Apple Computer\MobileSync\Backup\0a51249f1ad627097400a96f5640049639ebce2b\4331bbf652f169927d2d5fae961dfcf63863657b

These are typical Trojan.Lameshield entries:
C:\Users\booboo\AppData\Local\Apps\2.0\Y4ZW095D.5NN\CJR9JJ1V.64H\goog...app_f84b370c827b5c7a_0001.0002_3153a04d2ba1813d
C:\Users\Max\AppData\Local\Temp\wxv8rqnbiv1b58qmkq7ok4.exe

All of these entries are found in the Application Data folder and all finish with a long number.
I suspect that MBAM recognised the similarity and suspected it was caused by 'Lameshield'.
As you do have Apple Mobile Sync installed, this may well be a false positive, but i can't get any concrete confirmation of this even from the MalwareBytes site.

You could actually check this out for yourself if you wanted.
You know the path to the file in question.
MBAM will not have deleted this file, it will have put it into quarantine ( so you can easily move it back to the correct file position.
Once it's back in position you could check the file out at Jotti or Virus Total.
Here are some instructions if you want to check the file yourself:

Please click this link-->Jotti

When the jotti page has finished loading, click the Browse button and navigate to the following file and click Submit.

C:\Users\Fred\AppData\Roaming\Apple Computer\MobileSync\Backup\0a51249f1ad627097400a96f5640049639ebce2b\4331bbf652f169927d2d5fae961dfcf63863657b

If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/

 

Hi Fred,

If everything is ok we can finish off the cleaning procedure now.

Step 1
Restart MBAM.
Click on the Quarantine tab



If there are items in quarantine.....
Make sure everything is selected and then click Delete All.
Close MBAM.


Step 2
Double click on AdwCleaner.exe to run the tool again.

• Click on the Uninstall button.
• Click Yes when asked are you sure you want to uninstall.
• Both AdwCleaner.exe, its folder and all logs will be removed.

JRT and FRST can now be removed also. ( just right click on the icons and select delete. )

It's up to you if you want to remove TFC (right click and delete)
I personally run it once a week to keep the temp files, caches etc cleaned out.

Step 3
Now you should Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the Restore Point a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Then go to Start > Run and type: Cleanmgr
• Click "OK".
• Select the drive for cleaning then click OK (usually 'C' drive)
• Click the "More Options" Tab.
• Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

To find out how you may have been infected....read this topic:
How did i get infected?

Glad I was able to help.

Safe surfing.

 

We don't say that we rely on it.
It's also not up to us to say how a user should backup their system.
A lot do use the system restore to recover from recent changes to the system, so we give a blanket speech about the possibility of infected restore points.
If a user doesn't use System Restore then they just ignore that part.

None of the programs used will have removed the cookies.
TFC will clear out the temp files, but doesn't remove any cookies.
So i'm unable to say why they have been removed.