Stung by Spora Ransomware - Bastard!

Hawkster · Jan 20, 2017

So i was busy creating a link list in scrapebox, i decided i wanted to manually check a few. Opened up a link in chrome and the font on the page was all messed up, after a few seconds a box shows up (seemingly from google) saying something like 'font outdated' or some shit.

In a moment of dumbness i clicked the exe download and ran it. Now all my word files etc are encrypted. It opens a tab on the browser to tell you your files are encrypted

I did a system restore to yesterday but somehow that didnt work.

I also followed this video

but somehow the fucking virus is checking the box in the start up menu after i un-check it.

So yeah thats what im doing right now lol

Info:

https://www.pcrisk.com/removal-guides/10824-spora-ransomware
https://threatpost.com/spora-ransomware-offers-victims-unique-payment-options/123130/
https://www.bleepingcomputer.com/ne...he-most-sophisticated-payment-site-as-of-yet/

Newly written article: https://www.bleepingcomputer.com/ne...ry-20th-2017-satan-raas-spora-locky-and-more/

ArtOfVaw · Jan 20, 2017

Here are some tips to start surfing the interent securely:

- Don't rush.
- Check if the content is legit (through many ways).
- Don't use Microsoft Windows.

Shit, I've heard about another ransomware that offer you to decrypt your files for free as soon as you "invite" your friends (two of them) to download it. Forgot the name tho.

bartosimpsonio · Jan 20, 2017

Geez man sorry to hear you fell for this.

I haven't heard of this particular plague, but from other cases I've heard of 90% ended up paying ransom. Sucks.

asap1 · Jan 20, 2017

Damn, that sucks.

tymillz · Jan 20, 2017

I recently got hit with Ransomware. Cleaned my server. Server was clean for a week or so and bang, go hit again. I ended up wipe the server and saying fuck it.

datsunguy · Jan 20, 2017

ouch thats terrible, i hope you have your files backed up.

whats the ransom they are charging?

Deleted member 969102 · Jan 20, 2017

tymillz said:
I recently got hit with Ransomware. Cleaned my server. Server was clean for a week or so and bang, go hit again. I ended up wipe the server and saying fuck it.

Sometimes they hide in the System files and are fully undetectable.

Last week I was installing something and after a minute or so I had a whole desktop full of shit. Every time my AV removed it and rebooted, it was there again.

Like you said, wiping windows is the best way to deal with this shit.

Reaver · Jan 20, 2017

Ouch.

Let us know how it goes honey bunch. You may have to wipe everything like @tymillz did.

tymillz said:
I recently got hit with Ransomware. Cleaned my server. Server was clean for a week or so and bang, go hit again. I ended up wipe the server and saying fuck it.

I was wondering if you ever got that fixed. You in the clear now?

Capo Dei Capi · Jan 20, 2017

One of the best ways to prevent them is to build up a massive list of sites blocked in the hosts files in addition to using adguard in a chromium browser. So many sites are blocked using that combination.

I got one of those things a few years ago and I immediately turned off the pc and used a linux start up disk to delete the bad files and recover the important good files that weren't corrupted yet.

tb303 · Jan 20, 2017

Hawkster said:
but somehow the fucking virus is checking the box in the start up menu after i un-check it.

I didnt see him do it in the video so sorry if you tried this already.
But you should also go to the services tab in msconfig. Select hide all microsoft services and disable everything you see that looks odd before reboot. If this stops if coming back. Then re-enable one by one until you find the culprit.
Also I had an infection recenty that kept being triggered by chrome's thumbnail view of most visited. I had to delete the contents of chromes appdata folder to stop it coming back. Random but worth knowing.

tymillz · Jan 20, 2017

alwaysinvisible said:
I was wondering if you ever got that fixed. You in the clear now?

Yeah after a complete wipe. I swore I was clean and then bang they kidnapped my shit all over again. I know they were Russian but if they were Russian women I would've offered the good ole HJV in return for my server.

Hawkster · Jan 20, 2017

$79

I aint fuckin paying them anything, they can fuck right off. I'll throw my pc in the bin before i do that

datsunguy said:
ouch thats terrible, i hope you have your files backed up.

whats the ransom they are charging?

datsunguy · Jan 20, 2017

Hawkster said:
$79

I aint fuckin paying them anything, they can fuck right off. I'll throw my pc in the bin before i do that

Good on ya, dont give in.
If you dont absolutely have to get a few docs back dont do it.

fullwall3t · Jan 20, 2017

I was.able to decrypt.the files with software I forgot the name /: . But.from what you have wrote I probably got older version of this virus

MisterF · Jan 20, 2017

Scum like this need their hands nailing to the floor.

nakaam30 · Jan 20, 2017

someone needs to findout where those assholes lives and nuke the sh*t out of them, along with those IRS scammers

Deleted member 657006 · Jan 20, 2017

I looked heavy into this even file wise , there no way to un encrypt the files , best to re install the os and make a clone and if it happends in future re load the clone .

There no way to un encrypt the files unless you pay for the encript key that encrypt them all.

You must of made backups ,you no the score with any pc work, always back up and even make another backup on disc

The random infection is ruthless
It go thru all your files just the same as any virus cheek , it then encrypts the files and dll to the programs and folders , has cost business millions , top hacker and programmers tried there best to un encrypt the files , but there so meny diffrent en crypted files most give up , been impossable to solve , only solution was , one i posted above....

Conor · Jan 20, 2017

Thankfully all my important stuff (Totally legal movies and music) are on an external hard drive, whilst business documents are saved on Google Drive. I should be okay if this ever happens to me. Let's hope you haven't got anything super important at risk OP.

Taegn · Jan 20, 2017

If the developer was even moderately competent you will have a really tough time of this...

Hawkster · Jan 20, 2017

Think i've successfully got rid of it from the PC

Interestingly it seems only wordpad files are affected, all the text in those files is encrypted while text in notepad files remains as it was.

Can access all programs, videos, images etc.

Stung by Spora Ransomware - Bastard!

Elite Member

Junior Member

Elite Member

BANNED

Senior Member

Supreme Member

Deleted member 969102

Guest

Elite Member

BANNED

Supreme Member

Senior Member

Elite Member

Supreme Member

BANNED

Repeat Selling Out MP - Doxxing - Harass Comps.

Regular Member

Deleted member 657006

Guest

Elite Member

Regular Member

Elite Member

Main Menu

Marketplace

Making Money

BlackHat World