0

I have one PC (Windows 7) which is attacked presumably by a ransomware (in spite of having regularly updated antivirus viz Net Protector AV).
What I could see is this --
In MySQL/bin folder, all files got an extension of .[fileslocker@pm.me]
Also, backup files with .sql extension also got an extension of .fileslocker@me
These files have got encrypted.
So the database can't be read/manipulated.
I searched the web, but not sure which remedy/utility is safe.
Note:- This question seeks specifically regarding the virus of .[fileslocker@pm.me] and not in general suggestions such as system restore or reinstall or virus-scan. Hence it is not a duplicate of another question.
What should I do to get rid of this?

marked as duplicate by forest, Steffen Ullrich, AviD Dec 27 '18 at 11:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • The email comes back to a known Protonmail vanity alias. So that person is likely privacy minded and is either playing some sick joke on you OR you likely have a ransomware attack. Is there any way to see logs of when or where it originated or where those sanitized/deleted in the process? – linuxdev2013 Dec 27 '18 at 4:09
  • I am not aware of where a log is maintained in OS. Perhaps you can suggest where to see such log. – Vineet Dec 27 '18 at 4:12
  • My question specifically askes re this particular virus. It is not asking 'in general' remedies such as reinstall or scan. So I don't think it is a dup of other Q. – Vineet Dec 27 '18 at 5:06
  • 2
    We aren't a virus removal service and we can't help with removing specific malware. That's what we have that canonical duplicate question. – forest Dec 27 '18 at 5:21
  • 1
    @Vineet: As forest already said: this is not a malware removal site but we can provide useful links. The first answer in the first question I've linked to provides a clearly visible link to NoMoreRansom - look there for more help. – Steffen Ullrich Dec 27 '18 at 8:25