CryptoWall - why isn't Avast removing the files?

system · 2015-06-17T16:38:05.000Z

I have a computer infected by CryptoWall. Obviously I lost my encrypted files and my question doesn’t concern that. I now have Avast installed on my infected computer. I installed it for the sole purpose of removing this ransomware but I still see the CryptoWall files (decrypt instructions txt and html files) still showing up everywhere. I also think CryptoWall might be affecting my wireless network connection and/or causing continuous prompts to “update” my Adobe Acrobat. Either way, I just want to know what to do in order to remove all effects of CryptoWall.

Thank you.

essexboy · 2015-06-17T17:15:47.000Z

Hi there, most will need manual removal

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.

https://dl.dropboxusercontent.com/u/73555776/frst.JPG

[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please attach both logs generated.

Pondus · 2015-06-17T17:16:58.000Z

No security program have 100% detection, and new malware versions is released evry day

statistic http://www.av-test.org/en/statistics/malware/

system · 2015-07-08T20:19:29.000Z

Greetings,
I have a Windows 2008 server that just got infected with CryptoWall.

I see you have the Farbar Recovery Scan Tool to assist with removing. Can I just run this program to remove the virus or do I have to send you the logs after I run the program?

Thanks,

Todd

essexboy · 2015-07-08T20:52:26.000Z

I would need the logs to remove any remaining infectors. However, you have probably lost all the files that were encrypted

Announcements