Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

Системата ми е инфектирана с _ReCoVeRy_+vpysa

9 март 201610 г.

Лепнах някаква гадост, която преправя текстовите файлове и снимките в doc.mp3 и .jpg.mp3. За съжаление дори и да преправя разширението на файловете те не могат да се отворят. Почти навсякъде има по 3 файла:

_ReCoVeRy_+vpysa.html

_ReCoVeRy_+vpysa.png

_ReCoVeRy_+vpysa.txt

Веднага изключих лаптопа и с Нортън Гост възстанових системния дял от имидж файл. Но за съжаление вируса е поразил важни документи и снимки в другите дялове на хард диска.

Дали ще има начин да възстановя поразените документи и снимки?

текстовия файл е със следното съдържание:

NOT YOUR LANGUAGE? USE https://translate.google.com

What happened to your files ?
All of your files were protected by a strong encryption with RSA4096
More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)

How did this happen ?
!!! Specially for your PC was generated personal RSA4096 Key , both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server

What do I do ?
So , there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
* http://t54ndnku456ngkwsudqer.wallymac.com/DD1F5EBA1AB2814F
* http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/DD1F5EBA1AB2814F
* http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/DD1F5EBA1AB2814F
If for some reasons the addresses are not available, follow these steps
1 Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2 After a successful installation, run the browser
3 Type in the address bar: xlowfznrg4wf7dli.onion/DD1F5EBA1AB2814F
4 Follow the instructions on the site

IMPORTANT INFORMATION
Your personal pages
http://t54ndnku456ngkwsudqer.wallymac.com/DD1F5EBA1AB2814F
http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/DD1F5EBA1AB2814F
http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/DD1F5EBA1AB2814F
Your personal pages TOR Browser xlowfznrg4wf7dli. onion/DD1F5EBA1AB2814F

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01
Ran by Kapitango (administrator) on KAPITANGO-PC (09-03-2016 17:04:51)
Running from C:\Users\Kapitango\Desktop
Loaded Profiles: Kapitango (Available Profiles: Kapitango & UpdatusUser)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Windows\SysWOW64\AsusService.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\HotkeyService\HotKeyMon.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\HotkeyService\HotkeyService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(GridinSoft LLC) C:\Program Files\GridinSoft Anti-Malware\gsam.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-13] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2010-01-22] (NEC Electronics Corporation)
HKLM-x32\...\Run: [HotkeyMon] => C:\Program Files (x86)\ASUS\HotkeyService\HotKeyMon.exe [101288 2010-12-07] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [HotkeyService] => C:\Program Files (x86)\ASUS\HotkeyService\HotkeyService.exe [1248176 2010-12-07] (ASUSTeK Computer Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2011-09-14] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [192616 2011-09-14] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{76A8D3AD-67AF-438D-91E9-4CE9EDB94756}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2908288086-1325201104-4050100807-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.bg/
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27] (Adobe Systems Incorporated)

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2011-03-06] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2011-03-06] (NVIDIA Corporation)

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AsusService; C:\Windows\SysWOW64\AsusService.exe [224680 2010-12-07] ()
S4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-02-13] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-21] ( )
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x64.sys [75888 2011-03-30] (Atheros Communications, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
S3 RT-USB; C:\Windows\System32\drivers\RT-USB64.SYS [70984 2010-06-16] (Ross-Tech LLC)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2015-12-28] () [File not signed]
R3 TrojanKillerDriver; C:\Windows\System32\DRIVERS\gtkdrv.sys [17568 2016-02-29] (Windows (R) Win 7 DDK provider)
U3 azv7w72g; C:\Windows\System32\Drivers\azv7w72g.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-09 17:05 - 2016-03-09 17:05 - 00006292 _____ C:\Users\Kapitango\Desktop\Премахване на зловреден софтуер - HiJackThis логове - kaldata.com - Форуми.url
2016-03-09 17:04 - 2016-03-09 17:05 - 00006754 _____ C:\Users\Kapitango\Desktop\FRST.txt
2016-03-09 17:04 - 2016-03-09 17:04 - 02374144 _____ (Farbar) C:\Users\Kapitango\Desktop\FRST64.exe
2016-03-09 17:04 - 2016-03-09 17:04 - 00000000 ____D C:\FRST
2016-03-09 16:51 - 2016-03-09 16:51 - 00000501 _____ C:\Users\Kapitango\Desktop\Възстановяване на иконите, файлове и папки, след агресия Data Recovery зловреден софтуер - Trojan Killer.url
2016-03-09 16:50 - 2016-03-09 16:50 - 00000899 _____ C:\Users\Public\Desktop\GridinSoft Anti-Malware.lnk
2016-03-09 16:50 - 2016-03-09 16:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GridinSoft Anti-Malware
2016-03-09 16:50 - 2016-03-09 16:50 - 00000000 ____D C:\ProgramData\GridinSoft
2016-03-09 16:50 - 2016-03-09 16:50 - 00000000 ____D C:\Program Files\GridinSoft Anti-Malware
2016-03-09 16:48 - 2016-03-09 16:49 - 55512608 _____ C:\Users\Kapitango\Desktop\gsam-3.0.29-setup.exe
2016-02-29 18:36 - 2016-02-29 18:36 - 00017568 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\gtkdrv.sys

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-09 16:50 - 2015-12-28 15:10 - 00000000 ____D C:\Users\UpdatusUser
2016-03-09 16:37 - 2009-07-14 07:13 - 00713888 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-09 16:37 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-03-09 16:32 - 2015-12-28 15:09 - 00000000 ____D C:\ProgramData\NVIDIA
2016-03-09 16:31 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

Some files in TEMP:
====================
C:\Users\Kapitango\AppData\Local\Temp\nvStInst.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-12-30 11:48

==================== End of FRST.txt ============================

Addition.txt

9 март 201610 г.

Здравейте,

Преименуването на файловете няма да помогне. Те са криптирани, а не само преименувани. И за ваше съжаление няма декриптор за най-новата версия на TeslaCrypt, която сте лепнали.

Единствено ако бяхте пробвали с програма за възстановяване на изтрити файлове или претърсване на сенчестите копия за стари версии на файловете може би щяхте да имате някакъв минимален успех. Но след като сте върнали Image-a сте се лишили от тази възможност.

Поздрави!

9 март 201610 г.

Автор

Ясно. Аз вече възстанових доста от нещата точно с file_recovery понеже са на другите дялове на харда. С какво да се пазя от тази TeslaCrypt?

Аз съм с Malwarebytes Anti-Malware но не го лови.

9 март 201610 г.

Току що, kapitango написа:

Ясно. Аз вече възстанових доста от нещата точно с file_recovery понеже са на другите дялове на харда. С какво да се пазя от тази TeslaCrypt?

Аз съм с Malwarebytes Anti-Malware но не го лови.

Malwarebytes Anti-Malware не е антивирусна програма и е желателно да се инсталира пълноценен антивирусен софтуер.

Колкото до предпазването ще напиша един информативен пост, но ще е малко по-късно, че ще хапвам или след мача или утре сутринта (за да си събера мислите). Има какво да се каже по темата.

10 март 201610 г.

Направо можете да видите следния коментар в който съм обобщил повечето мерки за защита:

Както и този:

Поздрави!

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.