.POSHCODER Malware Removal?

Hi Guys,

I am using windows 7 x64

All of a sudden, my files renamed with end extension as .poshcoder

From .txt, .doc, .xls to .psd illustrator files.

I have my data on the laptop since 7 months hard hard effort. I don't know what this is all about. I had few hours ago's Restore point automatically created, restored it. But the files on desktop and D drive files are still encrypted with .poshcoder files.

It leave one Unblock Files.vbs in each folder where it encrypted the files. Now that It was first time, It decrypted one file for me and for the rest, it is asking bitcoins to be added to one of the wallet. I don't know what is this all about and how to get rid of it and get my files decrypted.

Please, reply.

Thanks in advance. I can provide the code in Ublock Files.vbs so you can figure it out more.

Hi

Please upload the .vbs file here and include your problem description (ie copy and paste what you put in your previous post).

Hi,

I am having the exact same issue. Every file has been renamed to filename.docx.POSHKODER etc.

I have the same VBS file as described by the OP. Mine is called UnblockFiles.vbs and is located in every folder.

Every file was edited at 8.28am this morning which is when I first turned the laptop on.

Any help would be much appreciated.

Hi

 

Please upload the .vbs file here and include your problem description (ie copy and paste what you put in your previous post).

Dear, 

I have uploaded the file there with description of Problem.

Please, reply.

I am stuck in the middle of nowhere. 

From what I can tell, it's a similar scam to the HowDecrypt and CryptorBit scams.

After reading this guide, I don't think the solutions will apply to our issue.

Gilly, how did it happen to you? Any clue? I came, turned on my machine and it is there huh.

I tried, Online virus scan, Kaspersky Scan, Eset NOD Scan, Malware Bytes, Trojen Hunter, Nothing is detecting this ransomware. How come?

Trying to make a connection but can't figure it out. Possibly a video I opened yesterday. 3 other people at work also opened it without any issues, and it was an official company video, nothing dodgy.

None of my virus scanners picked it up either.

After the problem arose, I download some zips, restarted the system and those new zipped files are also changed to .POSHCODER huh :@

http://www.foolishit.com/vb6-projects/cryptoprevent/ this didn't help either.

I just faced same issue. Trying to find out the solution on Google, Bing, yahoo everywhere but did not find any solution. If anybody get solution Please share.

Same happens to me. I got also Google drive that is encrypted to because i use the desktop version of Google drive. 

Its asking 500$ to resolve this issue.  

Any news for this issue?

Same happens to me. I got also Google drive that is encrypted to because i use the desktop version of Google drive. 

Its asking 500$ to resolve this issue.  

Any news for this issue?

Hey,

They asked me to drop in 0.5 BTC bitcoins using blockchain. Did they ask you the same thing? Bytheway it popsup when you click on unblockfiles.vbs and I have not seen anything that the script asks you to pay $500.

I made a screenshot bu since i am new here i don't know how to upload. 

The Popup is showing where to buy the bitcoins. After clicking the adresses its shows me how much the bitcoin costs. 

I am still looking for help. I am stuck. Please reply.