[SOLVED] SFC can't do complete scan, just 73%

[googaa]

hello,

My windows 7 Home Premium sp1 crash many time when I'm working
Befor i've been hacker by Ransomware Sage 2.0 .. I've have do scan with COMBOFIX to eradicate it but can't recover my owb files.
Since my Windows crashes after start
then I decide to do SFC scan but il can't do completev scan / scannow process stop at 73%
Whant can I doing please ?
Many Thanks

 

[x BlueRobot]

Befor i've been hacker by Ransomware Sage 2.0 .. I've have do scan with COMBOFIX to eradicate it but can't recover my owb files.

Do you know which files were encrypted (if any)?

I would suggest that you follow these posting instructions to ensure that the machine is clean - Malware Removal Posting Instructions

 

[googaa]

Do you know which files were encrypted (if any)?

I would suggest that you follow these posting instructions to ensure that the machine is clean - Malware Removal Posting Instructions

Sorry, I mean befor windows crashes I've been hacked by ransomware SAGE 2.0...
My personnal files were encrypted till know
I don't know if any system files were encrypted... but i've a great doubt
As well I can't exécute somme programme and install exp/ CCleaner...
Despite of any I'm going to try to follow instructions.
Thanks.

 

[PeterJ]

Hello and welcome,

I've have do scan with COMBOFIX to eradicate it but can't recover my owb files.

Where were you instructed to do that ?

Perform a scan with FRST:

1. Download the Farbar Recovery Scan Tool and save it to your Desktop:
   32-bit: Downloading Farbar Recovery Scan Tool
   64-bit: Downloading Farbar Recovery Scan Tool
   
2. Right-click to run the tool as administrator. When the tool opens click Yes to disclaimer.
3. Note: Ensure that the Addition.txt check box is checked at the bottom of the form within the Optional Scan area.
4. Press the Scan button.
5. Please wait for the tool to finish. It will produce two logfiles called FRST.txt and Addition.txt in the same directory the tool is run from (which should be the desktop)
6. Post the logfiles FRST.txt and Addition.txt as attachment in your next reply.

 

[googaa]

Hello and welcome,

Where were you instructed to do that ?

Perform a scan with FRST:

1. Download the Farbar Recovery Scan Tool and save it to your Desktop:
   32-bit: Downloading Farbar Recovery Scan Tool
   64-bit: Downloading Farbar Recovery Scan Tool
2. Right-click to run the tool as administrator. When the tool opens click Yes to disclaimer.
3. Note: Ensure that the Addition.txt check box is checked at the bottom of the form within the Optional Scan area.
4. Press the Scan button.
5. Please wait for the tool to finish. It will produce two logfiles called FRST.txt and Addition.txt in the same directory the tool is run from (which should be the desktop)
6. Post the logfiles FRST.txt and Addition.txt as attachment in your next reply.

here are logfiles FRST.txt and Addition.txt :
I don't do FIX just Analyse !
many thanks

 

[PeterJ]

Warning: This script was written specifically for this user, for use on that particular machine. Do not run this script on another machine.

1. Download the attachment fixlist.txt and save it to your desktop.
2. Rename the file FRST64.exe into English.exe. Right-click on English.exe and select "Run as administrator".
3. Press the Fix button.
4. The tool will now process fixlist.txt.
5. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
6. When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
7. Post the logfile Fixlog.txt as attachment in your next reply.

 

[googaa]

7. Post the logfile Fixlog.txt as attachment in your next reply.

here is FIXLOG.TXT (07/08/2020)

Thanks.

 

[PeterJ]

ChkDsk Scan

• Click on Start - All programs - Accessories.
• Rightclick on Command-prompt and select Run as administrator.
• When command prompt opens, typ chkdsk into it, then press enter.
• Wait for this to complete.
  
• Download ListChkdskResult.exe by SleepyDude and save it on your desktop.
• Rightclick
  
  ListChkdskResult.exe and select Run as administrator. Notepad will open the file ListChkdskResult.txt on completion. (The file ListChkdskResult.txt can be found on your desktop.)
• Copy and paste its content in your next reply.

 

[googaa]

• Rightclick
  
  ListChkdskResult.exe and select Run as administrator. Notepad will open the file ListChkdskResult.txt on completion. (The file ListChkdskResult.txt can be found on your desktop.)
• Copy and paste its content in your next reply.

here is the ListChkdskResult.txt :

Thanks.

 

[PeterJ]

Please do following.

SFC Scan

1. Click on the Start button and in the search box, type Command Prompt
2. When you see Command Prompt on the list, right-click on it and select Run as administrator.
3. When command prompt opens, copy and paste the following commands into it, press enter after each.
   
   

   sfc /scannow

   Wait for this to finish before you continue
   
   

   copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"

4. This will create a file, cbs.txt on your Desktop. Please attach this to your next post.
   Note: if the file is too big to upload to your next post please upload via a service such as Filedropper or One Drive or SendSpace and just provide the download link.

 

[googaa]

1- I do SFC scan : as first message its stop at 73% !!
2- here is cbs.txt : 8Mo too large... link below

CBS.Txt

Note please : my system became more and more heavier. Several crashes that can takes several minutes !!!

Many thanks.

 

[PeterJ]

Follow the instructions below please.

WARNING! The following fix is specific to the user's system in this thread only. No one else should follow these instructions, as it could damage your system.

• Download
  
  SFCFix and move the executable to your desktop.
• Download the attachment SFCFix.zip and save it on your desktop.
• Save any work you have open, and close all programs.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.
  
  
• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Open the file, then copy and paste its content in your next reply.

 

[googaa]

Here is content of SFCFix.txt :

SFCFix version 3.0.2.1 by niemiro.
Start time: 2020-08-09 11:34:36.189
Microsoft Windows 7 Service Pack 1 - amd64
Using .zip script file at C:\Users\CachSoumy\Desktop\SFCFix.zip [0]

PowerCopy::
Successfully took permissions for file or folder C:\Windows\winsxs\wow64_microsoft-windows-ieframe_31bf3856ad364e35_11.2.9600.19596_none_514a8f5bf78f8e6f\ieframe.dll

Failed to backup file C:\Windows\winsxs\wow64_microsoft-windows-ieframe_31bf3856ad364e35_11.2.9600.19596_none_514a8f5bf78f8e6f\ieframe.dll with error code 0x45D.

Successfully copied file C:\Users\CachSoumy\AppData\Local\niemiro\Archive\wow64_microsoft-windows-ieframe_31bf3856ad364e35_11.2.9600.19596_none_514a8f5bf78f8e6f\ieframe.dll to C:\Windows\winsxs\wow64_microsoft-windows-ieframe_31bf3856ad364e35_11.2.9600.19596_none_514a8f5bf78f8e6f\ieframe.dll.

Successfully restored ownership for C:\Windows\winsxs\wow64_microsoft-windows-ieframe_31bf3856ad364e35_11.2.9600.19596_none_514a8f5bf78f8e6f\ieframe.dll
Successfully restored permissions on C:\Windows\winsxs\wow64_microsoft-windows-ieframe_31bf3856ad364e35_11.2.9600.19596_none_514a8f5bf78f8e6f\ieframe.dll
PowerCopy:: directive completed successfully.

Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2020-08-09 11:38:47.205
Script hash: jN7ryQgH8SKrZsR4XJNgChBq/wlc7K5w99ZFPb9CZcw=
----------------------EOF-----------------------

Thanks.

 

[PeterJ]

Restart the computer.
Open an elevated command prompt. Copy and paste the following command into it, press enter after each.

sfc /scannow

Wait for this to finish before you continue

Perform the following only when it fails:

• copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"

• This will create a file, cbs.txt on your Desktop. Zip this file and attach the zipped cbs.txt to your next post.

 

[googaa]

1. SFC scan : 100%. ok

2. CBS.txt :

CBS.txt

 

[PeterJ]

Looking good. Are there any remaining issues ?

 

[googaa]

Thank you very much, it's seems good

when I save from any browers there is no icone just a blanc icone .. is it normal, please?

Can I do something for my personnal files encrypted by Ransomware Sage 2.0 ?

Many Thanks.

 

[PeterJ]

when I save from any browers there is no icone just a blanc icone .. is it normal, please?

I don't understand what you mean. Please explain more, a screenshot might be helpful.

Can I do something for my personnal files encrypted by Ransomware Sage 2.0 ?

As far as iI know there is no decrypter without having the private key.
You can check if there are restore points but it is likely they were deleted by the ransom ware.
Please check your backups if you have any.

 

[googaa]

I don't understand what you mean. Please explain more, a screenshot might be helpful.

1. I have Chrome as my default browser and when I save a page there is no icon to identify the source or the program.. just blank icone like image below

2. for Ransomware sage 2.0 encryption I think there are no solutions. I save the files for a while maybe someone will find a patch for the decryption ...

Thanks.

 

[PeterJ]

Warning: This script was written specifically for this user, for use on that particular machine. Do not run this script on another machine.

1. Download the attachment fixlist.txt and save it to your desktop.
2. Right-click on FRST64.exe and select "Run as administrator".
3. Press the Fix button.
4. The tool will now process fixlist.txt.
5. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
6. When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
7. Post the logfile Fixlog.txt as attachment in your next reply.