Вирус RSA 4096

25 май 201610 г.

Има подобна тема, но да пусна за всеки случай-има много важна информация и документи и всички са криптирани с RSA4096-и по възможност трябва всички да се възстановят

Addition.txt

Ето логовете

First.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:24-05-2016 01
Ran by Admin (administrator) on OBS-PC2 (25-05-2016 08:38:02)
Running from D:\My Documents\Downloads
Loaded Profiles: Admin & User (Available Profiles: Admin & User & Administrator)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Marvell) C:\Program Files\HP\HP LaserJet M1319 MFP Series\ReceiveFaxUtility.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Google Inc.) C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IMJPMIG8.1] => C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [208952 2006-02-28] (Microsoft Corporation)
HKLM\...\Run: [PHIME2002ASync] => C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [455168 2006-02-28] (Microsoft Corporation)
HKLM\...\Run: [PHIME2002A] => C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [455168 2006-02-28] (Microsoft Corporation)
HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [16875008 2008-06-27] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Alcmtr] => C:\WINDOWS\ALCMTR.EXE [57344 2008-06-19] (Realtek Semiconductor Corp.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [ReceiveUtility] => C:\Program Files\HP\HP LaserJet M1319 MFP Series\ReceiveFaxUtility.exe [344064 2007-11-20] (Marvell)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [866584 2006-11-03] (Microsoft Corporation)
HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [153136 2007-03-01] (Nero AG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [807392 2016-03-15] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [DWQueuedReporting] => C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE [434080 2011-07-27] (Microsoft Corporation)
HKLM\...\Run: [UserFaultCheck] => %systemroot%\system32\dumprep 0 -u
HKLM\...\Run: [Avira SystrayStartTrigger] => C:\Program Files\Avira\Launcher\Avira.SystrayStartTrigger.exe [66328 2016-04-25] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k
HKU\S-1-5-21-839522115-2000478354-725345543-1003\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2007-06-27] (Nero AG)
HKU\S-1-5-21-839522115-2000478354-725345543-1006\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2007-06-27] (Nero AG)
HKU\S-1-5-21-839522115-2000478354-725345543-1006\...\Run: [Google Update] => C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [107848 2015-07-07] (Google Inc.)
HKU\S-1-5-21-839522115-2000478354-725345543-1006\...\Run: [ApisVreme] => D:\My Documents\A7USER\Remind.exe [1918976 2011-03-29] ()
HKU\S-1-5-21-839522115-2000478354-725345543-1006\...\MountPoints2: {39c451d1-27b1-11e1-920a-002197339da9} - G:\AutoRun.exe
HKU\S-1-5-18\...\Run: [DWQueuedReporting] => C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE [434080 2011-07-27] (Microsoft Corporation)
ShellExecuteHooks: Microsoft AntiMalware ShellExecuteHook - {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll [83224 2006-11-03] (Microsoft Corporation)
Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\E3228E2E846FB.lnk [1899-12-30]
ShortcutTarget: E3228E2E846FB.lnk -> C:\Documents and Settings\All Users\Application Data\E3228E2E846F.bmp ()
Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\E3228E2E846FH.lnk [1899-12-30]
ShortcutTarget: E3228E2E846FH.lnk -> C:\Documents and Settings\All Users\Application Data\E3228E2E846F.html ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2014-05-15] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2014-05-15] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 23 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2014-05-15] (Avira Operations GmbH & Co. KG)
Tcpip\..\Interfaces\{BD0F0076-A205-44B4-9A1F-4DD1D1EB550A}: [NameServer] 192.168.1.254

Internet Explorer:
==================
HKU\S-1-5-21-839522115-2000478354-725345543-1003\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-839522115-2000478354-725345543-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-839522115-2000478354-725345543-1006 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17] (Microsoft Corporation)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236157959921
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

FireFox:
========
FF Plugin: @adobe.com/ShockwavePlayer -> C:\WINDOWS\system32\Adobe\Director\np32dsw.dll [2009-01-16] (Adobe Systems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.449 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll [2009-11-09] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll [2009-11-09] (RealNetworks, Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-839522115-2000478354-725345543-1006: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin HKU\S-1-5-21-839522115-2000478354-725345543-1006: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-06-24] [not signed]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [940304 2016-03-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [466504 2016-03-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [466504 2016-03-15] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1236896 2016-03-15] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe [280008 2016-04-25] (Avira Operations GmbH & Co. KG)
S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [13592 2006-11-03] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [109016 2016-03-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136272 2016-03-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37896 2015-05-07] (Avira Operations GmbH & Co. KG)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
R3 HP1319EWS; C:\WINDOWS\System32\DRIVERS\HP1319EWS.SYS [10752 2007-11-14] (Marvell Semiconductor, Inc.)
R3 HP1319FX; C:\WINDOWS\System32\DRIVERS\HP1319FAX.SYS [11264 2007-11-14] (Marvell Semiconductor, Inc.)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R2 NwlnkIpx; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88320 2008-04-14] (Microsoft Corporation)
R2 NwlnkNb; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2006-02-28] (Microsoft Corporation)
R2 NwlnkSpx; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2006-02-28] (Microsoft Corporation)
R1 pelmouse; C:\WINDOWS\System32\DRIVERS\pelmouse.sys [16768 2006-09-14] (Primax Electronics Ltd.)
S3 pelps2m; C:\WINDOWS\System32\DRIVERS\pelps2m.sys [19818 2006-10-31] (Primax Electronics Ltd.)
R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [31848 2015-06-09] (Avira Operations GmbH & Co. KG)
S3 VNUSB; C:\WINDOWS\System32\DRIVERS\VNUSB.sys [38496 2006-04-07] (OLYMPUS IMAGING CORP.) [File not signed]
R3 yukonwxp; C:\WINDOWS\System32\DRIVERS\yk51x86.sys [289024 2008-06-27] (Marvell)
S4 IntelIde; no ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-25 08:37 - 2016-05-25 08:38 - 00000000 ____D C:\FRST
2016-05-18 13:33 - 2016-05-18 13:33 - 00349353 ____R C:\Documents and Settings\User\Desktop\pokana mai .pdf.crypt
2016-05-11 14:01 - 2016-05-11 14:01 - 00665313 ____R C:\Documents and Settings\User\Desktop\pokani.pdf.crypt
2016-04-25 15:30 - 2016-05-18 08:51 - 00027160 ____R C:\Documents and Settings\User\Desktop\молба за отпуск.doc.crypt
2016-04-25 13:48 - 2016-04-25 14:42 - 00017919 ____R C:\Documents and Settings\User\Desktop\поименно гласуване на 29.08.2012 г..docx.crypt
2016-04-25 13:48 - 2016-04-25 13:51 - 00015017 ____R C:\Documents and Settings\User\Desktop\ПРИСЪСТВЕНА КНИГА Microsoft Office Word Document.docx.crypt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-25 08:38 - 2009-03-04 11:50 - 00000000 ____D C:\Documents and Settings\User\Local Settings\Temp
2016-05-25 08:38 - 2009-02-27 01:41 - 00000000 ____D C:\Documents and Settings\Admin\Local Settings\Temp
2016-05-25 08:37 - 2009-07-01 09:26 - 00000422 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{8F346620-9099-4F3E-B452-7FEA354F3563}.job
2016-05-25 08:34 - 2015-07-07 08:46 - 00001074 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-2000478354-725345543-1006UA.job
2016-05-25 08:33 - 2014-12-09 16:53 - 00000420 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{B803DACF-EC71-4D4B-B0E6-118F87F3DDDB}.job
2016-05-25 08:30 - 2014-04-25 08:49 - 00000222 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
2016-05-25 08:29 - 2010-12-10 17:09 - 00000292 _____ C:\WINDOWS\Tasks\BearShareNAG.job
2016-05-25 08:29 - 2009-02-27 01:40 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-25 08:29 - 2006-02-28 15:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2016-05-19 16:53 - 2009-02-27 01:40 - 00032392 _____ C:\WINDOWS\SchedLgU.Txt
2016-05-19 16:52 - 2014-04-25 14:28 - 00320690 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
2016-05-19 16:52 - 2009-03-04 11:50 - 00000178 ___SH C:\Documents and Settings\User\ntuser.ini
2016-05-19 16:44 - 2009-11-12 10:36 - 00000770 _____ C:\Documents and Settings\User\Delo.ini
2016-05-19 16:29 - 2014-02-12 13:48 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-05-19 12:20 - 2014-04-04 08:47 - 00000408 ____H C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job
2016-05-19 09:33 - 2015-07-07 08:46 - 00001022 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-2000478354-725345543-1006Core.job
2016-05-18 16:48 - 2013-02-19 10:50 - 00000000 ____D C:\Documents and Settings\User\Application Data\TeamViewer
2016-05-18 15:38 - 2014-02-20 14:17 - 00000000 ____D C:\spoolerlogs
2016-05-17 16:54 - 2014-04-25 14:28 - 00320690 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-839522115-2000478354-725345543-1006-0.dat
2016-05-13 13:29 - 2014-02-12 13:48 - 00797376 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2016-05-13 13:29 - 2011-11-01 14:59 - 00142528 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2016-05-13 08:34 - 2014-04-25 08:52 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Package Cache
2016-05-12 08:36 - 2014-04-25 08:52 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Avira
2016-05-11 17:10 - 2013-07-25 16:52 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-05-11 16:58 - 2009-03-04 11:10 - 136686448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-05-11 16:57 - 2009-03-04 10:04 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Microsoft Help

==================== Files in the root of some directories =======

1899-12-30 00:00 - 1899-12-30 00:00 - 2592054 ____T () C:\Documents and Settings\All Users\Application Data\E3228E2E846F.bmp
1601-03-12 16:17 - 1601-03-12 16:17 - 0014193 _____ () C:\Documents and Settings\All Users\Application Data\E3228E2E846F.html
2009-03-05 17:44 - 2009-03-05 17:44 - 0000056 ____H () C:\Documents and Settings\All Users\Application Data\ezsidmv.dat
2010-10-04 10:56 - 2010-10-04 10:56 - 0000390 _____ () C:\Documents and Settings\All Users\Application Data\hpzinstall.log

Some files in TEMP:
====================
C:\Documents and Settings\Admin\Local Settings\Temp\avgnt.exe
C:\Documents and Settings\User\Local Settings\Temp\avgnt.exe
C:\Documents and Settings\User\Local Settings\Temp\svchost.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

Addition.txt

Това е картинката на десктопа!

!Recovery_E3228E2E846F.bmp

25 май 201610 г.

Довечера ще мога да пиша. Дотогава пробвайте да декриптирате файловете си с това:

http://media.kaspersky.com/utilities/VirusUtilities/RU/rannohdecryptor.exe

За повече информация вижте следния блог:

https://blog.kaspersky.com/cryptxxx-ransomware/11939/

Засега имам наблюдението, че поне при 3-ма потребителя файловете са възстановени успешно (поне pdf файловете и графичните формати).

За съжаление видеофайловете едва ли ще бъдат декриптирани!

Нужен е поне един здрав файл (с една и съща големина като заразения) за да сработи инструмента. Дано да имате такъв на флашка или облачна услуга или прикачен файл в писмо.

После ще изчистим остатъците.

Успех!

25 май 201610 г.

Автор

Не се получава нещо с тази програма-Трябва да избера криптираните файлове ли? Каквото и да избера ми дава:

The decrytion of files encrypted by this variant of Trojan.Ransorm.Win32.CryptXXX is not supported

Криптираните файлове са доста и са повечето doc,docx, pdf

Редактирано 25 май 201610 г. от gig93 (преглед на промените)

25 май 201610 г.

Значи на този етап пиете една студена вода. Попаднали сте на новия вариант 3, който не подлежи на декриптиране в момента (а не се знае дали и изобщо ще може да бъде декриптиран, защото и той като TeslaCrypt бе обявен за непробиваем). Авторите на Tesla предоставиха ключа за декриптиране на версии 3 и 4 на Tesla и мигрираха към CryptXXX и не вярвам да дадат ключа и за тази зараза поне не и в близко бъдеще.

Пробвайте със стара версия на инструмента, защото според един от коментарите там съобщението за грешка е друго - че оригиналния файл и криптирания файл не съвпадат като големина. Ако не стане и със старата версия значи нищо не можем да направим на този етап за възстановяването на файловете.

Можете все пак да опитате стандартните процедури - използване на табът в Properties на всеки файл => Previous Versions и да възстановите стари, но читави версии на файловете си (ако има стари копия) или с програма за възстановяване на изтрити файлове като Recuva, R-Studio, TestDisk и т.н. но не възлагайте големи надежди, защото вируса изтрива старите сенчести копия - Volume Shadow Copies и презаписва Master File Table...

Иначе можем поне довечера да почистим остатъците, но за важните ви файлове греда.

25 май 201610 г.

Автор

Ами става въпрос за работното ми място, а аз чак в понеделник ще съм на работа, въпроса ми беше за файловете, но щом не става направо мога да го преинсталирам или ще може да се махне поне вируса и евентуално да запазя тези криптирани файлове ако могат да се възстановят по-нататък! Поне да може да се продължи нормалната работа за нататък.

25 май 201610 г.

Ами както кажете. То в логовете не се видяха много активни остатъци като цяло и това е нормално, защото вируса се самоизтрива като приключи своята дейност. Но пък щом идеята ви е била да спасите само файловете (то на всички поразени от криптовирус това им е целта, но е малко след дъжд-качулка) тогава ако ще ви е по-лесно, можете и да преинсталирате като копирате криптираните файлове на външен носител и да чакате (защото и без това една компрометирана система не може да бъде ползвана със 100%-ово доверие особено за офис система, където се работи с "чувствителна информация". Не се знае колко, но може и един ден да ви огрее, защото и Tesla бе обявена за непробиваема, а вече се лекуват файловете и то благодарение на злосторниците (не че това ги оправдава разбира се, а и едва ли някога ще разберем защо така лесно сдадоха фронта, но няма значение), та който не си беше изтрил файловете и имаше търпение имаше и късмет да си възстанови в последствие.

Пишете как желаете да продължим. Ако ще почистваме лесно мога да напиша скрипт за премахването на остатъците (поне тези, които се виждат в логовете), да проверим с още няколко програми и дори да изтрием криптираните файлове с разширение *.crypt с един замах за да не заемат място...

Поздрави!

30 май 201610 г.

Какво ще правим за да знам как да маркирам темата?

Поздрави!

1 юни 201610 г.

Автор

Ок ако може да изчистим вируса от този компютър, въпреки, че той вече не е свързан никъде в момента всички шернати папки в мрежата са с криптирани файлове, но с друго разширение CRYP1, дали е от същият вирус?

1 юни 201610 г.

Това е още по-нова версия на CryptXXX 3.0 (някои го наричат UltraCrypter).

Ще ми трябват нови логове от FRST.

1 юни 201610 г.

Автор

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:29-05-2016 02
Ran by Admin (administrator) on OBS-PC2OLD (01-06-2016 10:40:58)
Running from D:\My Documents\Downloads
Loaded Profiles: Admin & User (Available Profiles: Admin & User & Administrator)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.exe
(Intel Corporation) C:\WINDOWS\system32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Marvell) C:\Program Files\HP\HP LaserJet M1319 MFP Series\ReceiveFaxUtility.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Marvell) C:\Program Files\HP\HP LaserJet M1319 MFP Series\ReceiveFaxUtility.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.Systray.exe
(Google Inc.) C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IMJPMIG8.1] => C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [208952 2006-02-28] (Microsoft Corporation)
HKLM\...\Run: [PHIME2002ASync] => C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [455168 2006-02-28] (Microsoft Corporation)
HKLM\...\Run: [PHIME2002A] => C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [455168 2006-02-28] (Microsoft Corporation)
HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [16875008 2008-06-27] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Alcmtr] => C:\WINDOWS\ALCMTR.EXE [57344 2008-06-19] (Realtek Semiconductor Corp.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [ReceiveUtility] => C:\Program Files\HP\HP LaserJet M1319 MFP Series\ReceiveFaxUtility.exe [344064 2007-11-20] (Marvell)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [866584 2006-11-03] (Microsoft Corporation)
HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [153136 2007-03-01] (Nero AG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [807392 2016-03-15] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira SystrayStartTrigger] => C:\Program Files\Avira\Launcher\Avira.SystrayStartTrigger.exe [67840 2016-05-04] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-839522115-2000478354-725345543-1003\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2007-06-27] (Nero AG)
HKU\S-1-5-21-839522115-2000478354-725345543-1006\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2007-06-27] (Nero AG)
HKU\S-1-5-21-839522115-2000478354-725345543-1006\...\Run: [Google Update] => C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [107848 2015-07-07] (Google Inc.)
HKU\S-1-5-21-839522115-2000478354-725345543-1006\...\Run: [ApisVreme] => D:\My Documents\A7USER\Remind.exe [1918976 2011-03-29] ()
HKU\S-1-5-21-839522115-2000478354-725345543-1006\...\MountPoints2: {39c451d1-27b1-11e1-920a-002197339da9} - G:\AutoRun.exe
HKU\S-1-5-18\...\Run: [DWQueuedReporting] => C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE [434080 2011-07-27] (Microsoft Corporation)
ShellExecuteHooks: Microsoft AntiMalware ShellExecuteHook - {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll [83224 2006-11-03] (Microsoft Corporation)
Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\E3228E2E846FB.lnk [1899-12-30]
ShortcutTarget: E3228E2E846FB.lnk -> C:\Documents and Settings\All Users\Application Data\E3228E2E846F.bmp ()
Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\E3228E2E846FH.lnk [1899-12-30]
ShortcutTarget: E3228E2E846FH.lnk -> C:\Documents and Settings\All Users\Application Data\E3228E2E846F.html ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2014-05-15] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2014-05-15] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 23 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2014-05-15] (Avira Operations GmbH & Co. KG)
Tcpip\..\Interfaces\{BD0F0076-A205-44B4-9A1F-4DD1D1EB550A}: [NameServer] 192.168.1.254

Internet Explorer:
==================
HKU\S-1-5-21-839522115-2000478354-725345543-1003\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-839522115-2000478354-725345543-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-839522115-2000478354-725345543-1006 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17] (Microsoft Corporation)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236157959921
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

FireFox:
========
FF Plugin: @adobe.com/ShockwavePlayer -> C:\WINDOWS\system32\Adobe\Director\np32dsw.dll [2009-01-16] (Adobe Systems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.449 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll [2009-11-09] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll [2009-11-09] (RealNetworks, Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-839522115-2000478354-725345543-1006: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin HKU\S-1-5-21-839522115-2000478354-725345543-1006: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-06-24] [not signed]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [940304 2016-03-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [466504 2016-03-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [466504 2016-03-15] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1236896 2016-03-15] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe [276424 2016-05-04] (Avira Operations GmbH & Co. KG)
S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [13592 2006-11-03] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [109016 2016-03-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136272 2016-03-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37896 2015-05-07] (Avira Operations GmbH & Co. KG)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
S3 HP1319EWS; C:\WINDOWS\System32\DRIVERS\HP1319EWS.SYS [10752 2007-11-14] (Marvell Semiconductor, Inc.)
S3 HP1319FX; C:\WINDOWS\System32\DRIVERS\HP1319FAX.SYS [11264 2007-11-14] (Marvell Semiconductor, Inc.)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R2 NwlnkIpx; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88320 2008-04-14] (Microsoft Corporation)
R2 NwlnkNb; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2006-02-28] (Microsoft Corporation)
R2 NwlnkSpx; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2006-02-28] (Microsoft Corporation)
R1 pelmouse; C:\WINDOWS\System32\DRIVERS\pelmouse.sys [16768 2006-09-14] (Primax Electronics Ltd.)
S3 pelps2m; C:\WINDOWS\System32\DRIVERS\pelps2m.sys [19818 2006-10-31] (Primax Electronics Ltd.)
R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [31848 2015-06-09] (Avira Operations GmbH & Co. KG)
S3 VNUSB; C:\WINDOWS\System32\DRIVERS\VNUSB.sys [38496 2006-04-07] (OLYMPUS IMAGING CORP.) [File not signed]
R3 yukonwxp; C:\WINDOWS\System32\DRIVERS\yk51x86.sys [289024 2008-06-27] (Marvell)
S4 IntelIde; no ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-01 10:32 - 2016-06-01 10:32 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-06-01 10:31 - 2016-06-01 10:31 - 00000777 _____ C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2016-06-01 10:31 - 2016-06-01 10:31 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-06-01 10:31 - 2016-06-01 10:31 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware
2016-06-01 10:31 - 2016-06-01 10:31 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2016-06-01 10:31 - 2016-03-10 14:09 - 00123264 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-06-01 10:31 - 2016-03-10 14:08 - 00024448 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-05-30 08:44 - 2008-04-14 05:41 - 00021504 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\hidserv.dll
2016-05-30 08:44 - 2008-04-14 05:41 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\system32\hidserv.dll
2016-05-25 13:07 - 2016-05-25 13:09 - 00002878 _____ C:\RannohDecryptor.1.9.1.1_25.05.2016_13.07.47_log.txt
2016-05-25 13:00 - 2016-05-25 13:00 - 00000000 ____D C:\Documents and Settings\User\Desktop\filers
2016-05-25 12:58 - 2016-05-25 13:04 - 00003848 _____ C:\RannohDecryptor.1.9.1.1_25.05.2016_12.58.34_log.txt
2016-05-25 08:42 - 2016-05-25 08:42 - 00038005 _____ C:\Documents and Settings\Admin\Desktop\Addition.txt
2016-05-25 08:37 - 2016-06-01 10:40 - 00000000 ____D C:\FRST
2016-05-18 13:33 - 2016-05-18 13:33 - 00349353 ____R C:\Documents and Settings\User\Desktop\pokana mai .pdf.crypt
2016-05-11 14:01 - 2016-05-11 14:01 - 00665313 ____R C:\Documents and Settings\User\Desktop\pokani.pdf.crypt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-01 10:41 - 2009-02-27 01:41 - 00000000 ____D C:\Documents and Settings\Admin\Local Settings\Temp
2016-06-01 10:40 - 2009-03-04 11:50 - 00000000 ____D C:\Documents and Settings\User\Local Settings\Temp
2016-06-01 10:37 - 2014-12-09 16:53 - 00000420 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{B803DACF-EC71-4D4B-B0E6-118F87F3DDDB}.job
2016-06-01 10:37 - 2014-04-25 08:52 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Avira
2016-06-01 10:34 - 2014-04-25 08:52 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Package Cache
2016-06-01 10:33 - 2015-07-07 08:46 - 00001074 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-2000478354-725345543-1006UA.job
2016-06-01 10:32 - 2009-07-01 09:26 - 00000422 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{8F346620-9099-4F3E-B452-7FEA354F3563}.job
2016-06-01 10:29 - 2014-02-12 13:48 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-06-01 10:28 - 2014-04-25 08:49 - 00000222 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
2016-06-01 10:28 - 2006-02-28 15:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2016-06-01 10:26 - 2010-12-10 17:09 - 00000292 _____ C:\WINDOWS\Tasks\BearShareNAG.job
2016-06-01 10:26 - 2009-02-27 01:40 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-30 08:47 - 2015-11-24 16:01 - 00320690 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-839522115-2000478354-725345543-1003-0.dat
2016-05-30 08:47 - 2014-04-25 14:28 - 00320690 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
2016-05-30 08:47 - 2009-02-27 01:41 - 00000178 ___SH C:\Documents and Settings\Admin\ntuser.ini
2016-05-30 08:47 - 2009-02-27 01:41 - 00000000 ____D C:\Documents and Settings\Admin
2016-05-30 08:47 - 2009-02-27 01:40 - 00032654 _____ C:\WINDOWS\SchedLgU.Txt
2016-05-30 08:44 - 2009-02-27 03:15 - 00000000 RSHDC C:\WINDOWS\system32\dllcache
2016-05-30 08:36 - 2009-03-04 11:50 - 00000178 ___SH C:\Documents and Settings\User\ntuser.ini
2016-05-27 12:20 - 2014-04-04 08:47 - 00000408 ____H C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job
2016-05-27 09:33 - 2015-07-07 08:46 - 00001022 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-2000478354-725345543-1006Core.job
2016-05-26 16:56 - 2014-04-25 14:28 - 00320690 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-839522115-2000478354-725345543-1006-0.dat
2016-05-19 16:44 - 2009-11-12 10:36 - 00000770 _____ C:\Documents and Settings\User\Delo.ini
2016-05-18 16:48 - 2013-02-19 10:50 - 00000000 ____D C:\Documents and Settings\User\Application Data\TeamViewer
2016-05-18 15:38 - 2014-02-20 14:17 - 00000000 ____D C:\spoolerlogs
2016-05-18 08:51 - 2016-04-25 15:30 - 00027160 ____R C:\Documents and Settings\User\Desktop\молба за отпуск.doc.crypt
2016-05-13 13:29 - 2014-02-12 13:48 - 00797376 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2016-05-13 13:29 - 2011-11-01 14:59 - 00142528 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2016-05-11 17:10 - 2013-07-25 16:52 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-05-11 16:58 - 2009-03-04 11:10 - 136686448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-05-11 16:57 - 2009-03-04 10:04 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Microsoft Help

==================== Files in the root of some directories =======

1899-12-30 00:00 - 1899-12-30 00:00 - 2592054 ____T () C:\Documents and Settings\All Users\Application Data\E3228E2E846F.bmp
1601-03-12 16:17 - 1601-03-12 16:17 - 0014193 _____ () C:\Documents and Settings\All Users\Application Data\E3228E2E846F.html
2009-03-05 17:44 - 2009-03-05 17:44 - 0000056 ____H () C:\Documents and Settings\All Users\Application Data\ezsidmv.dat
2010-10-04 10:56 - 2010-10-04 10:56 - 0000390 _____ () C:\Documents and Settings\All Users\Application Data\hpzinstall.log

Some files in TEMP:
====================
C:\Documents and Settings\Admin\Local Settings\Temp\avgnt.exe
C:\Documents and Settings\User\Local Settings\Temp\avgnt.exe
C:\Documents and Settings\User\Local Settings\Temp\svchost.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

1 юни 201610 г.

Не сте сложили отметка пред Addition.txt преди да направите новата проверка и липсва новия лог файл - Addition.txt

Криптираните файлове ще ги трием ли или ще си ги копирате и ще чакате един ден да се появи евентуален декриптор за тях?

1 юни 201610 г.

Автор

Данните са много важни и няма да се трият

Addition.txt

1 юни 201610 г.

Важни, важни колко да са важни в този им вид, но дано един ден да се появи декриптор.

Деинсталирайте следната програма от Control Panel-a:

FoxTab FLV Player

Използването на Windows XP вече не е добра идея...в логовете се забелязват остатъци и от полиморфен вирус Ramnit.B!!!

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

Пишете дали процедурата е успешна и дали вече се е премахнал и съобщението от десктопа.

Поздрави!

2 юни 201610 г.

Автор

Мисля, че се оправи, Благодаря, проблема е, че още един компютър се е заразил,но май с този по-новият вирус CRYP1 Да пусна ли и за него логове или да направя нова тема?

Fix result of Farbar Recovery Scan Tool (x86) Version:29-05-2016 02
Ran by User (2016-06-02 08:38:41) Run:1
Running from D:\My Documents\Downloads
Loaded Profiles: User (Available Profiles: Admin & User & Administrator)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [] => [X]
File: D:\My Documents\A7USER\Remind.exe
HKU\S-1-5-21-839522115-2000478354-725345543-1006\...\MountPoints2: {39c451d1-27b1-11e1-920a-002197339da9} - G:\AutoRun.exe
Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\E3228E2E846FB.lnk [1899-12-30]
ShortcutTarget: E3228E2E846FB.lnk -> C:\Documents and Settings\All Users\Application Data\E3228E2E846F.bmp ()
Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\E3228E2E846FH.lnk [1899-12-30]
ShortcutTarget: E3228E2E846FH.lnk -> C:\Documents and Settings\All Users\Application Data\E3228E2E846F.html ()
CMD: del /F /Q /S "C:\E3228E2E846F.bmp"
CMD: del /F /Q /S "C:\E3228E2E846F.html"
CMD: Dir /b c:\*E3228E2E846F* /s
Task: C:\WINDOWS\Tasks\BearShareNAG.job => C:\DOCUME~1\User\LOCALS~1\Temp\BearShare_setup.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job =>
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job =>
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm.sys => ""="Driver"
HKU\S-1-5-21-839522115-2000478354-725345543-1006\Control Panel\Desktop\\Wallpaper -> C:\DOCUME~1\ALLUSE~1\APPLIC~1\E3228E2E846F.bmp
Unlock: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\winmgmt
cmd: sc config winmgmt start= auto
cmd: net start winmgmt
Reg: reg add "HKLM\SYSTEM\CurrentControlSet\services\winmgmt" /v Start /t REG_DWORD /d 2 /f
EmptyTemp:
end
*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully.

========================= File: D:\My Documents\A7USER\Remind.exe ========================

File not signed
MD5: 1C3FDF0B7DEBDC7541F9F2B849B5D46E
Creation and modification date: 2011-04-26 14:01 - 2011-03-29 05:24
Size: 1918976
Attributes: ---AH
Company Name:
Internal Name:
Original Name:
Product:
Description:
File Version: 7.0.1.14
Product Version: 1.0.0.0
Copyright:

====== End of File: ======

"HKU\S-1-5-21-839522115-2000478354-725345543-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39c451d1-27b1-11e1-920a-002197339da9}" => key removed successfully.
HKCR\CLSID\{39c451d1-27b1-11e1-920a-002197339da9} => key not found.
C:\Documents and Settings\User\Start Menu\Programs\Startup\E3228E2E846FB.lnk => not found.
C:\Documents and Settings\All Users\Application Data\E3228E2E846F.bmp => moved successfully
C:\Documents and Settings\User\Start Menu\Programs\Startup\E3228E2E846FH.lnk => not found.
ShortcutTarget: E3228E2E846FH.lnk -> C:\Documents and Settings\All Users\Application Data\E3228E2E846F.html () => not found.

========= del /F /Q /S "C:\E3228E2E846F.bmp" =========

Could Not Find C:\E3228E2E846F.bmp