hwarray

Thank you for your help.

System seems to be running OK, speed is good. MS Office (Word & Excel) having an issue. Open a clean Document or spreadsheet, the file opens but a 2nd doc (or spreadsheet) opens showing the ransom note. scan_151209-000416.txt FRST.txt

Missed your last reply. Will run the scans & get the logs uploaded. Thanks

Decrypter showed invalid key format. The key.dat file I found was recovered (undelete) from the hard drive and didn't work. Is there another file I should be looking for? Recovery_key.txt is mentioned is some posts, searching for that file now.

Fixlog.txt attached Fixlog.txt

User was infected. Virus was active for about 3 hours before User realized there was a problem. Bug was found and quarantined by Malwarebytes, identified as PJCux-a.exe (Ransom.TeslaCrypt). Most of the files on local drive (C:) & shared network drive (Y:) are encrypted with a vvv extension. Ran EMSISoft Decrypter, Encryption key was found. Program seemed to be working, but failed to decrypt anything. Shadow copies on both the User's computer & the shared drive were deleted. User's computer, all other computers in the office, shared drives & the Server are now clean, but the en