New virus Crypto Wall 4.0 - 3338587358_av666@weekendwarrior55.com

[tester 0]

Hello!

 

Today December 4, 2015 I'm afraid that I've got a virus from a romanian news web site

 

Hundreds of PDF files, JPG, RTF, TXT, Microsoft Office, from my Windows 7 computer have been renamed as follows and I think they are encrypted

 

SN851989.JPG.id-3338587358_av666@weekendwarrior55.com

SN852029.JPG.id-3338587358_av666@weekendwarrior55.com

 

I send you zip with encrypted files and virus. They store in: 

C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D9B.tmp

 

Can you help me!

 

3338587358_av666.zip

[Marcos 5,074]

The malware is already detected as Win32/Filecoder.DG. Make sure that you have LiveGrid enabled for maximum protection.

[tester 0]

Thank you. I have question can you help me to decrypt my files?

[Marcos 5,074]

Please email the following stuff to samples[at]eset.com:

- examples of encrypted files (ideally a couple of doc / xls documents)

- the output from ESET Log Collector

- information about you license

 

Use the subject in the form:

[Filecoder] Filecoder.DG - X PCs

where X is the number of seats you have purchased.