Yesterday I created a new user account for my Asus computer using a microsoft outlook acoount, and when I accessed that new user and was setting up itunes, the display background suddenly changed. However, there are no files on this user (but there are many files on the other user account which does not seem affected), and running scans on malwarebyte showed no ransomware/virus identified. Moreover, I cannot seem to find any txt or random html files that contain instructions, other than the display background. When I tried to change the display background, I also cannot seem to find the file of the current display background. So I deleted the user account and recreated it again, but the same display was there. I am really confused!
Anyway, the following message was on the display background:
NOT YOUR LANGUAGE ? USE http://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA4096
More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA4096 Key , both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our Secret Server
What do I do?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your date easy way
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment
Your personal ID: ***Blanked out****
For more specific instructions, please visit your personal homepage, there are a few different addresses pointing to your page below:
1-http://***********.onion.to (blanked out, but I'm assuming every one has a different address?)
If for some reasons the addresses are not available, follow these steps
1-Download and install tor-browser: Hyyp://torproject.org/projects/torbrowser.html.en
2-After a successful installation, run the browser
3-Type in the address bar - http://"".onion
4-Follow the instrutions on the site
Be sure to copy your personal ID and the instruction link to your notepad not to lose them
^ It is all hand typed because I am afraid that sending a screenshot through the infected computer would affect my other macbook. I am really not sure what to do and would appreciate any help! Am I infected by a ransomware, and if so how should I get rid of it, seeing as the ransomware cannot be detected? Or should I be running the scans in safe mode or something?
Thanks for any help!
Edited by Asususer1023, 02 June 2017 - 07:45 PM.