Stung by Spora Ransomware - Bastard!

[Hawkster]

So i was busy creating a link list in scrapebox, i decided i wanted to manually check a few. Opened up a link in chrome and the font on the page was all messed up, after a few seconds a box shows up (seemingly from google) saying something like 'font outdated' or some shit.

In a moment of dumbness i clicked the exe download and ran it. Now all my word files etc are encrypted. It opens a tab on the browser to tell you your files are encrypted

I did a system restore to yesterday but somehow that didnt work.

I also followed this video

but somehow the fucking virus is checking the box in the start up menu after i un-check it.

So yeah thats what im doing right now lol

Info:

https://www.pcrisk.com/removal-guides/10824-spora-ransomware
https://threatpost.com/spora-ransomware-offers-victims-unique-payment-options/123130/
https://www.bleepingcomputer.com/ne...he-most-sophisticated-payment-site-as-of-yet/

Newly written article: https://www.bleepingcomputer.com/ne...ry-20th-2017-satan-raas-spora-locky-and-more/

 

[ArtOfVaw]

Here are some tips to start surfing the interent securely:

- Don't rush.
- Check if the content is legit (through many ways).
- Don't use Microsoft Windows.

Shit, I've heard about another ransomware that offer you to decrypt your files for free as soon as you "invite" your friends (two of them) to download it. Forgot the name tho.

 

[bartosimpsonio]

Geez man sorry to hear you fell for this.

I haven't heard of this particular plague, but from other cases I've heard of 90% ended up paying ransom. Sucks.

 

[asap1]

Damn, that sucks.

 

[tymillz]

I recently got hit with Ransomware. Cleaned my server. Server was clean for a week or so and bang, go hit again. I ended up wipe the server and saying fuck it.

 

[datsunguy]

ouch thats terrible, i hope you have your files backed up.

whats the ransom they are charging?

 

[Deleted member 969102]

I recently got hit with Ransomware. Cleaned my server. Server was clean for a week or so and bang, go hit again. I ended up wipe the server and saying fuck it.

Sometimes they hide in the System files and are fully undetectable.

Last week I was installing something and after a minute or so I had a whole desktop full of shit. Every time my AV removed it and rebooted, it was there again.

Like you said, wiping windows is the best way to deal with this shit.

 

[Reaver]

Ouch.

Let us know how it goes honey bunch. You may have to wipe everything like @tymillz did.

I recently got hit with Ransomware. Cleaned my server. Server was clean for a week or so and bang, go hit again. I ended up wipe the server and saying fuck it.

I was wondering if you ever got that fixed. You in the clear now?

 

[Capo Dei Capi]

One of the best ways to prevent them is to build up a massive list of sites blocked in the hosts files in addition to using adguard in a chromium browser. So many sites are blocked using that combination.

I got one of those things a few years ago and I immediately turned off the pc and used a linux start up disk to delete the bad files and recover the important good files that weren't corrupted yet.

 

[tb303]

but somehow the fucking virus is checking the box in the start up menu after i un-check it.

I didnt see him do it in the video so sorry if you tried this already.
But you should also go to the services tab in msconfig. Select hide all microsoft services and disable everything you see that looks odd before reboot. If this stops if coming back. Then re-enable one by one until you find the culprit.
Also I had an infection recenty that kept being triggered by chrome's thumbnail view of most visited. I had to delete the contents of chromes appdata folder to stop it coming back. Random but worth knowing.

 

[tymillz]

I was wondering if you ever got that fixed. You in the clear now?

Yeah after a complete wipe. I swore I was clean and then bang they kidnapped my shit all over again. I know they were Russian but if they were Russian women I would've offered the good ole HJV in return for my server.

 

[Hawkster]

$79

I aint fuckin paying them anything, they can fuck right off. I'll throw my pc in the bin before i do that

ouch thats terrible, i hope you have your files backed up.

whats the ransom they are charging?

 

[datsunguy]

$79

I aint fuckin paying them anything, they can fuck right off. I'll throw my pc in the bin before i do that

Good on ya, dont give in.
If you dont absolutely have to get a few docs back dont do it.

 

[fullwall3t]

I was.able to decrypt.the files with software I forgot the name /: . But.from what you have wrote I probably got older version of this virus

 

[MisterF]

Scum like this need their hands nailing to the floor.

 

[nakaam30]

someone needs to findout where those assholes lives and nuke the sh*t out of them, along with those IRS scammers

 

[Deleted member 657006]

I looked heavy into this even file wise , there no way to un encrypt the files , best to re install the os and make a clone and if it happends in future re load the clone .

There no way to un encrypt the files unless you pay for the encript key that encrypt them all.

You must of made backups ,you no the score with any pc work, always back up and even make another backup on disc

The random infection is ruthless
It go thru all your files just the same as any virus cheek , it then encrypts the files and dll to the programs and folders , has cost business millions , top hacker and programmers tried there best to un encrypt the files , but there so meny diffrent en crypted files most give up , been impossable to solve , only solution was , one i posted above....

 

[Conor]

Thankfully all my important stuff (Totally legal movies and music) are on an external hard drive, whilst business documents are saved on Google Drive. I should be okay if this ever happens to me. Let's hope you haven't got anything super important at risk OP.

 

[Taegn]

If the developer was even moderately competent you will have a really tough time of this...

 

[Hawkster]

Think i've successfully got rid of it from the PC

Interestingly it seems only wordpad files are affected, all the text in those files is encrypted while text in notepad files remains as it was.

Can access all programs, videos, images etc.