The first computer that I received was shutdown immediately once the user knew that something was wrong. The computer was dropped off to me shortly after where I immediately removed the drive and scanned it externally. The drive had 4 files placed in nearly every folder. The files are set to automatically run when you would access the folder on the infected machine. Even though I scanned the hard drive externally and removed the viruses and spyware, then did a Windows search for the 4 file names that where in the folder and removed all of them, the files were already encrypted to the point where that could not be opened. The computer did not know how to open them even though the file names and extensions were correct. I of course also tried opening the files on a non infected computer but could not open them there either. Luckily, the owner of this computer had a recent backup of all needed files. The computer was then reformatted and setup from scratch.
The machine I received recently was a laptop and had been infected with the same virus. When the owner called me I asked that she did not shut down the laptop. I asked that she made sure the battery was charged to 100% and that she got the laptop to me asap. When I received the computer shortly after, I installed and ran Spybot, Malwarebytes and Trojan remover. The computer already had AVG Free installed and seemed to be working properly. Both Spybot and Malwarebytes found and removed numerous infections. I then did a search for the 4 files that I had seen in the other infected computers and they were not there. Next I scanned the registry for any of the file names that Spybot and Malwarebytes found and removed anything looking suspicious. I reinstalled the hard drive into the laptop and started it up. Everything ran fine. Next I ran the name scans that I ran externally and everything was clean. The computer is still running fine a week later.