View original (French)

Ransomware nuke.jse and Win32/Kryptik.FTUQ

Mél -  
 Mél -
Hello,

My computer had a virus: Variant of Win32/Kryptik.FTUQ Trojan. I think I managed to remove it, but all my files are locked, I can't open them at all and it says: Encoded JScript file.

Can someone help me?

Thank you very much

Configuration: Windows / Firefox 55.0

10 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello,

    It would be good if you could provide the detected files then:

    Follow the FRST tutorial. (take the time to read carefully - everything is well explained).

    Download and run the FRST scan,
    Wait for the scan to finish, a message will indicate that the analysis is complete.

    Three FRST reports will be generated:
    • FRST.txt
    • Shortcut.txt
    • Additionnal.txt


    Send these 3 reports to the site https://pjjoint.malekal.com/ to share them.
    In return, provide the 3 pjjoint links that lead to the reports here in a new reply so that we can consult them.

    --
    Please press a key to continue the disinfection...
    0
  2. Mél
     
    Here are the links:

    https://pjjoint.malekal.com/files.php?id=20171002_j12j6g10t7y8
    https://pjjoint.malekal.com/files.php?id=FRST_20171002_c11k7w14s14i12
    https://pjjoint.malekal.com/files.php?id=20171002_l7x11e15q12q10
    0
  3. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Uninstall:
    Google Toolbar for Internet Explorer
    Web Companion

    Provide the NOD32 scan report.

    --
    Please press any key to continue the disinfection...
    0
    1. Mél
       
      All right,

      What is the NOD32 scan report?
      0
      1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > Mél
         
        The analysis report that provides the detections with all the details.
        0
    2. Mél
       
      Okay, but how do I access the report? Thank you.
      0
      1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > Mél
         
        At the end of the scan, you should have the log that you can save.
        You send it to https://pjjoint.malekal.com
        and provide the link here
        Make sure to uninstall both programs mentioned in my previous message
        Web Companion is a pesky program.
        0
    3. Mél
       
      Alright, I'll redo the scan and send it to you.
      0
  4. Mél
     
    Hello,

    Here is the link:
    https://pjjoint.malekal.com/files.php?id=20171003_m12x9e5d11y9

    Thank you
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      No detection:
      Number of threats detected: 0
      Completion time: 18:45:52 Total analysis time: 5381 sec. (01:29:41)

      So everything is fine :)
      0
  6. Mél
     
    No, everything is going wrong lol

    I can't open my files at all, they're encoded: Encoded JScript file.
    0
  7. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Oh yes, my mistake, I missed it on FRST.

    You caught the Nemucod ransomware, likely after opening a poisoned email.

    At this time, there isn't really a method to recover the encrypted documents. If the data is very important, store it temporarily in a safe place because there might be a solution to recover it in the future.
    You can still try the previous versions with Shadow Explorer
    Keep the files for a few months and monitor this page for potential future solutions and a tool that can recover files: List of DecryptTools for ransomware

    To delete it:

    Here is the fix to perform with FRST. You can use this explanatory note with screenshots as a guide.

    Open Notepad: Press Windows + R,
    In the "Run" field, type notepad and press OK.
    Copy/Paste the following into it: 

    CreateRestorePoint:
    Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse [2017-10-02] ()
    RemoveProxy:
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Once the text is pasted into Notepad,
    Click on the "File" menu and then "Save As",
    On the left, go to the Desktop,
    In the field at the bottom, set the file name to: fixlist.txt
    Click "Save", this will create fixlist.txt on the Desktop.

    Restart FRST and click on the "Fix" button
    A restart may be necessary (not mandatory)
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    Please press any key to continue the disinfection...
    0
  8. Mél
     
    If I do this, what exactly does it delete?

    Sorry, I'm a bit lost.
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      The problem is that you provide no information about the name of the threat and especially the location (the detected file)
      so I don't know what you're talking about.
      Moreover, on the NOD32 analysis, there are 0 detections.

      It could be a trojan, or it could simply be the payment instruction file of the ransomware that is detected (harmless).

      In short, provide all the information about the detection.
      0
  9. Mél
     
    My computer keeps telling me that I have viruses.
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      This will finally remove the ransomware or render it inactive.
      0
  10. Mél
     
    Unfortunately, all I know is that it said: Variant of Win32/Kryptik.FTUQ Trojan Horse.
    0
    2. Mél
       
      An email with an attachment was opened, it was this email:

      Hello,

      Please find attached the PDF file containing the invoice for €782.21 including VAT for your contract 48512667.

      To view PDF files, you can use the Adobe Reader tool available for free download from Adobe's website.

      You have chosen payment by direct debit.

      We inform you that the bank account provided will be automatically debited for the amount of this invoice in the coming days.

      Note:
      If the invoice amount is negative, it means that it is a credit note that will be refunded to you via your payment method.

      Best regards,

      Customer Service 1&1 Internet SARL
      Sylvain Lebedel
      Customer Relations Manager
      0
  11. Mél
     
    Here is the link

    https://pjjoint.malekal.com/files.php?id=20171003_y8n5g11j915
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      ok good, it has been deleted :)
      0
    2. Mél
       
      ah cool that's already something :) thank you for your help.

      Now I don't know how we're going to manage our files.... it's a disaster. We are an association ..
      0
      1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > Mél
         
        Unfortunately, there is no solution.
        Hence the need to make backups.
        0
    3. Mél
       
      :(
      0