HELP VIRUS!!! Can anyone please advice urgently

embalse · 24 Oct 2016 at 13:46

My wife opened an email this morning and without thinking clicked on an attachment without thinking.
The computer has been completely infected all the files now end in .sh#t and are either corrupted or password protected.
The desktop has this message which is self-explanatory.

Normally in this scenario I would either do a system restore or a complete clean install.
The problem is it has not only corrupted all the files on my O/S drive, but also all the other drive with all her work.

Having scanned with windows defender I do not want to proceed further without advice. Hopefully someone here has had this same virus.

embalse · 24 Oct 2016 at 13:54

Hutchy said:
No coming back from this one I'm afraid. Fresh start.

Have they just corrupted the files or taken uploaded info?

embalse · 24 Oct 2016 at 15:09

Given that human error was involved (opening and attachment) and Windows Defender did not protect the computer, would having any other anti-virus software installed have prevented this?

.

embalse · 24 Oct 2016 at 17:21

Thanks for all the suggestions. It is a Locky extension and as everyone has said there is no ideal solution. I have disconnected my document HD and am storing it in the hope at some point in the future someone breaks the code. Until then its a clean install and back up my files on a separate system everyday.

.

embalse · 24 Oct 2016 at 17:22

KIA said:
Unlikely.

Who is your wife's email provider?
Is she using a desktop client or web browser to access her mail?

http://www.computerworld.com/articl...ows-pcs-from-malicious-email-attachments.html

She was using Mailbird.

.,

embalse · 24 Oct 2016 at 17:29

t-rex said:
Did it also encrypt all of your dropbox files?

Yes..

.

embalse · 25 Oct 2016 at 19:10

Just looked at Google Drive. Store 15gb for free!!

.

embalse · 26 Oct 2016 at 15:47

Ok just thinking out load.... .

If I set up a Gdrive/Dbox and sync my work folder on my desktop to it. What happens if I get infected with ransomware on my work desktop?
Won't all my files on the Gdrive/Dbox also get changed as they are are synced to the desktop folder?

.

embalse · 28 Oct 2016 at 22:59

ic1male said:
So to start this process off, wouldn't the wife have had to open the attachment and allow it to run through the Windows User Account Control popup box?

Yep, and to be fair to her she called me and told me there was an issue with the computer, but I was busy and I assumed one of her programs was playing up, so an hour later I finally went to check her screen, by that time every file was encrypted.

.