Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Ransomware Help in ASUS - cannot detect virus, but display screen changed.

  • Please log in to reply
2 replies to this topic

#1 Asususer1023


  • Members
  • 1 posts

Posted 02 June 2017 - 07:44 PM

Yesterday I created a new user account for my Asus computer using a microsoft outlook acoount, and when I accessed that new user and was setting up itunes, the display background suddenly changed. However, there are no files on this user (but there are many files on the other user account which does not seem affected), and running scans on malwarebyte showed no ransomware/virus identified. Moreover, I cannot seem to find any txt or random html files that contain instructions, other than the display background. When I tried to change the display background, I also cannot seem to find the file of the current display background. So I deleted the user account and recreated it again, but the same display was there. I am really confused!


Anyway, the following message was on the display background:


NOT YOUR LANGUAGE ? USE http://translate.google.com


What happened to your files ? 

All of your files were protected by a strong encryption with RSA4096

More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)

How did this happen ?
!!! Specially for your PC was generated personal RSA4096 Key , both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our Secret Server

What do I do?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your date easy way
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment

Your personal ID: ***Blanked out****

For more specific instructions, please visit your personal homepage, there are a few different addresses pointing to your page below:

1-http://***********.onion.to (blanked out, but I'm assuming every one has a different address?)


If for some reasons the addresses are not available, follow these steps

1-Download and install tor-browser: Hyyp://torproject.org/projects/torbrowser.html.en
2-After a successful installation, run the browser

3-Type in the address bar - http://"".onion
4-Follow the instrutions on the site

Be sure to copy your personal ID and the instruction link to your notepad not to lose them


^ It is all hand typed because I am afraid that sending a screenshot through the infected computer would affect my other macbook. I am really not sure what to do and would appreciate any help! Am I infected by a ransomware, and if so how should I get rid of it, seeing as the ransomware cannot be detected? Or should I be running the scans in safe mode or something?

Thanks for any help! 

Edited by Asususer1023, 02 June 2017 - 07:45 PM.

BC AdBot (Login to Remove)


#2 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,769 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:32 AM

Posted 03 June 2017 - 06:15 AM

More information is needed to determine specifically what infection you are dealing with since there are many variants of crypto malware (file encrypting ransomware). RSA-4096 / RSA-2048 / RSA-1024 / AES-256 / AES-128 are encryption algorithms and not an explicit way of identifying a particular ransomware infection.

Did the display ransom demand have a specific name with it? Check your documents folder for an image the malware typically uses for the background note. Check the C:\ProgramData (or C:\Documents and Settings\All Users\Application Data) for a randomly named .html, .txt, .png, .bmp, .url file. Most ransomware will also drop a ransom note in every directory/affected folder where data has been encrypted.

Are there any obvious file extensions appended to or with your encrypted data files? If so, what is the extension and is it the same for each encrypted file or is it different?

The best way to identify the different ransomwares is the ransom note (including it's name), samples of the encrypted files, the malware file itself, any obvious extensions appended to the encrypted files, samples of the encrypted files and information related to any email addresses used by the cyber-criminals to request payment.

You can submit samples of encrypted files and ransom notes to ID Ransomware for assistance with identification and confirmation. This is a service that helps identify what ransomware may have encrypted your files and then attempts to direct you to an appropriate support topic where you can seek further assistance.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 xXToffeeXx


    Bleepin' Polar Bear

  • Malware Response Instructor
  • 6,086 posts
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:01:32 PM

Posted 04 June 2017 - 09:55 AM

A few questions, if you don't mind:


Did this system previously belong to someone else? Have you ever previously had other user accounts on this computer? Did you ever get hit with ransomware (specifically one called CryptoWall).



~If I am helping you and you have not had a reply from me in two days, please send me a PM~


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here


 ~Twitter~ | ~Malware Analyst at Emsisoft~

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users