Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

enter image description here

Hi.I have Microsoft Windows 7 SP1 on my PC. I have an Ubuntu OS near Windows OS. My internet connection has a proxy server from Iran that monitors our networking and filters some of our websites. These days I have used some software about free VPN, SSH+ and SSH that I think I have hacked from those softwares. (psiphon and freegate)

My antivirus software was Microsoft Security Essentials.

Windows default images in Libraries\Pictures have been changes to black image with some text on it: File is encrypted. This file can be decrypted using the program DirtyDesctype.exe. Press CRTL+ALT+D to run DirtyDesctype.exe OR Check the paths (...). I use all of the ways to run DirtyDesctype.exe but I cant find anything. I changed my antivirus from Microsoft Security Essentials to Avira but non can find any virus or unwanted program. Antiviruses reports sad that my system is clean but it isn't. (why?) I created another user on my PC and I have this problem on second user too.

My questions:

  1. What is it?
  2. Why I have this problem?
  3. Where this come from? (My proxy server or those free VPN softwares or any where else)
  4. How can I solve this?
share|improve this question

marked as duplicate by Rory Alsop Aug 11 '13 at 8:44

This question was marked as an exact duplicate of an existing question.

This has a lot of questions, but the link Deer Hunter offered has all the relevant info for the first 4 questions. The 5th is off topic here. – Rory Alsop Aug 11 '13 at 8:44
Re #5, FWIW - Product recommendations are off-topic throughtout Stack Exchange. I.e. - the edit doesn't warrant reopening the question. – TildalWave Aug 11 '13 at 9:13
Mohammed - also, you don't need to make everything in your question a link. I have edited them all out except the image as they didn't help the question. – Rory Alsop Aug 11 '13 at 9:15
I don't know that. Thank you. – user29154 Aug 11 '13 at 10:01
up vote 0 down vote accepted
  1. It is a classic Ransomware .
  2. You have been infected . How , there can be many answers .
  3. Could any of the shady websites you visit ;) or a legit website with infection
  4. i have mentioned the link below though i am not sure how effective it is as i have not been infected with this thing yet .
  5. What do you mean by "managing internet usage" ??

Here's a Blogpost on how to remove it

share|improve this answer
monitoring downloads and uploads, servers that we connected to, unwanted popup pages, auto install softwares, auto run programs and ... – user29154 Aug 11 '13 at 8:04
Buddy the thing is , even if you monitor everything and your computer is running an older version of Java( just an example amongst many other softwares) you will still be hacked . It may not be Ransomware , it might be a exploit kit or something else . For monitoring your network connection you can use "Netstat" amongst many other commercially available softwares . I personally use Mac as host machine and use XP\win 7 as a virtual machine with snapshot . Maybe a Windows user will be able explain to you better – Cherokee Aug 11 '13 at 8:17
This problem was from Torch browser that installs with iLivid. – user29154 Sep 24 '13 at 16:50