Encrypted - usunięcie infekcji

[ToServeAndProtect]

Kolega w pracy oczywiście uruchomił załącznik i zaszyfrował sobie pliki. Na szczęście nie wszystko

FRST
Addition
Shortcuts

działam troszkę nodem bo podobno sobie z tym radził ale logi nie zaszkodzi sprawdzić

EDIT: NOD32 i BitDefender poczyściły trochę ale logi chyba warto sprawdzić

[ordynat]

2016-06-07 14:52 - 2016-04-26 14:46 - 00012092 _____ C:\Users\MaciejK.RRC\Documents\WCRiMS tablety Xplore.xlsx.encrypted
2016-06-07 14:52 - 2016-04-25 09:50 - 00013434 _____ C:\Users\MaciejK.RRC\Documents\Kopia Projekty_M.xlsx.encrypted
2016-06-07 14:52 - 2016-04-22 09:21 - 00012238 _____ C:\Users\MaciejK.RRC\Documents\Pracownia tog.docx.encrypted
2016-06-07 14:52 - 2016-04-21 14:19 - 00014880 _____ C:\Users\MaciejK.RRC\Documents\Maciek_2016_1KW_plus.xlsx.encrypted
2016-06-07 14:52 - 2016-04-21 13:56 - 00011801 _____ C:\Users\MaciejK.RRC\Documents\Kopia Kopia Co_jak.xlsx.encrypted
2016-06-07 14:52 - 2016-04-21 12:50 - 00009871 _____ C:\Users\MaciejK.RRC\Documents\Co_jak.xlsx.encrypted
2016-06-07 14:52 - 2016-03-09 15:04 - 00010424 _____ C:\Users\MaciejK.RRC\Documents\Matic_projekt_rysio.xlsx.encrypted
2016-06-07 14:52 - 2016-02-11 14:45 - 00011187 _____ C:\Users\MaciejK.RRC\Documents\IPN_Matic_1.xlsx
2016-06-07 14:52 - 2016-02-10 12:04 - 00009988 _____ C:\Users\MaciejK.RRC\Documents\Toiowo.xlsx.encrypted
2016-06-07 14:52 - 2016-01-08 15:28 - 00014061 _____ C:\Users\MaciejK.RRC\Documents\Maciek_2016_1KW.xlsx.encrypted
2016-06-07 14:52 - 2016-01-05 11:00 - 00012915 _____ C:\Users\MaciejK.RRC\Documents\Maciek_2015.xlsx.encrypted
2016-06-07 14:52 - 2016-01-04 11:19 - 00029968 _____ C:\Users\MaciejK.RRC\Documents\REM.2015_1.docx.encrypted
2016-06-07 14:52 - 2016-01-04 11:14 - 00028450 _____ C:\Users\MaciejK.RRC\Documents\REM.2015.docx.encrypted
2016-06-07 14:52 - 2015-12-28 12:47 - 00051261 _____ C:\Users\MaciejK.RRC\Documents\UpWare-161215-CISCO_BD_wersja_nr_1.xlsx.encrypted
2016-06-07 14:52 - 2015-12-01 12:39 - 03139327 _____ C:\Users\MaciejK.RRC\Documents\DeLL_Q4_16_Channel Coverage_13_11_2015_final.xlsx.encrypted
2016-06-07 14:52 - 2015-12-01 00:54 - 00042261 _____ C:\Users\MaciejK.RRC\Documents\4_Qumak_1021616951526.docx.encrypted
2016-06-07 14:52 - 2015-11-20 16:10 - 00010720 _____ C:\Users\MaciejK.RRC\Documents\Rozliczenie_EM.xlsx.encrypted
2016-06-07 14:52 - 2015-11-05 16:20 - 03489009 _____ C:\Users\MaciejK.RRC\Documents\Lenovo Enterprise Coverage 2H'15 for Distribution .xls.encrypted
2016-06-07 14:52 - 2015-10-09 14:35 - 00010852 _____ C:\Users\MaciejK.RRC\Documents\Soltec_zamowienie_NR1.xlsx.encrypted
2016-06-07 14:52 - 2015-10-02 15:22 - 00069149 _____ C:\Users\MaciejK.RRC\Documents\Storage_RRC_PGI_3Q15_150922 RRC (May be selected only for IBM Storage).xls.encrypted
2016-06-07 14:52 - 2015-10-02 11:38 - 00051741 _____ C:\Users\MaciejK.RRC\Documents\Niver_151002_GR_Niver_x3850X6_PWPW_ST.xls.encrypted
2016-06-07 14:51 - 2016-01-07 11:37 - 00124228 _____ C:\Users\MaciejK.RRC\Desktop\FN-321000_2016_01_00090.pdf.encrypted
2016-06-07 14:51 - 2015-12-10 16:29 - 00059349 _____ C:\Users\MaciejK.RRC\Desktop\Trecom_110.pdf.encrypted
2016-06-07 14:51 - 2015-10-12 13:27 - 00069149 _____ C:\Users\MaciejK.RRC\Desktop\Storage_zapisane_RRC.xls.encrypted
2016-06-07 14:51 - 2015-10-02 15:24 - 00071709 _____ C:\Users\MaciejK.RRC\Desktop\KONTAKTY1.xls.encrypted

nawet nie wiem, czy jest na to deszyfrator, wiec nie daję tego do usuwania.

Otwórz Notatnik i wklej w nim:

2016-06-07 14:51 - 2016-06-07 14:52 - 00000000 ____D C:\ProgramData\ynadakubefipotov
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3985409602-888539743-1935948570-6146 -> DefaultScope {569F22A5-AEF1-4DDD-BC3C-57F4193C8D41} URL =
SearchScopes: HKU\S-1-5-21-3985409602-888539743-1935948570-6146 -> {569F22A5-AEF1-4DDD-BC3C-57F4193C8D41} URL =
HKLM Group Policy restriction on software: *.divx*.exe <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.bmp*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.avi*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.txt*.scr <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.jpg*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.xlsx*.exe <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.exe <====== UWAGA
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.wma*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.mp3*.com <====== UWAGA
HKLM Group Policy restriction on software: *.jpg*.pif <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.com <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.bmp*.com <====== UWAGA
HKLM Group Policy restriction on software: *.divx*.com <====== UWAGA
HKLM Group Policy restriction on software: *.xls*.pif <====== UWAGA
HKLM Group Policy restriction on software: scsvserv.exe <====== UWAGA
HKLM Group Policy restriction on software: *.txt*.com <====== UWAGA
HKLM Group Policy restriction on software: *.7z*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.png*.pif <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\*.com <====== UWAGA
HKLM Group Policy restriction on software: *.zip*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.avi*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.zip*.com <====== UWAGA
HKLM Group Policy restriction on software: %appdata%\*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.rtf*.com <====== UWAGA
HKLM Group Policy restriction on software: *.mp4*.com <====== UWAGA
HKLM Group Policy restriction on software: *.doc*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.xls*.com <====== UWAGA
HKLM Group Policy restriction on software: *.pdf*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.rar*.pif <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.exe <====== UWAGA
HKLM Group Policy restriction on software: %allusersprofile%\*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.png*.exe <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.zip*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.ppt*.exe <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.docx*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.7z*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.zip*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.rtf*.exe <====== UWAGA
HKLM Group Policy restriction on software: %allusersprofile%\*.com <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.scr <====== UWAGA
HKLM Group Policy restriction on software: vssadmin.exe <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.xlsx*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.avi*.pif <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.rtf*.scr <====== UWAGA
HKLM Group Policy restriction on software: %allusersprofile%\*.scr <====== UWAGA
HKLM Group Policy restriction on software: %appdata%\*\*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.png*.com <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\Appdata\Roaming\Microsoft\Windows\IEUpdate\*.exe <====== UWAGA
HKLM Group Policy restriction on software: %appdata%\*\*.scr <====== UWAGA
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== UWAGA
HKLM Group Policy restriction on software: %allusersprofile%\*.exe <====== UWAGA
HKLM Group Policy restriction on software: cipher.exe <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.exe <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.rar*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.pdf*.com <====== UWAGA
HKLM Group Policy restriction on software: lsassw86s.exe <====== UWAGA
HKLM Group Policy restriction on software: %appdata%\*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.7z*.com <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\*.scr <====== UWAGA
HKLM Group Policy restriction on software: ** <====== UWAGA
HKLM Group Policy restriction on software: *.gif*.scr <====== UWAGA
HKLM Group Policy restriction on software: %programdata%\*\svchost.exe <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.bmp*.pif <====== UWAGA
HKLM Group Policy restriction on software: %appdata%\*\*.com <====== UWAGA
HKLM Group Policy restriction on software: *.mp4*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.docx*.scr <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.xlsx*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.jpg*.com <====== UWAGA
HKLM Group Policy restriction on software: *.jpeg*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.rar*.com <====== UWAGA
HKLM Group Policy restriction on software: *.pptx*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.pub*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.ppt*.com <====== UWAGA
HKLM Group Policy restriction on software: *.mp4*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.mp4*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.gif*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.mp3*.exe <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.doc*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.pub*.pif <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.scr <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.com <====== UWAGA
HKLM Group Policy restriction on software: %appdata%\*.exe <====== UWAGA
HKLM Group Policy restriction on software: syskey.exe <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== UWAGA
HKLM Group Policy restriction on software: *.txt*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.pdf*.exe <====== UWAGA
HKLM Group Policy restriction on software: %programfiles(x86)%\*\svchost.exe <====== UWAGA
HKLM Group Policy restriction on software: *.wmv*.scr <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.scr <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\*.com <====== UWAGA
HKLM Group Policy restriction on software: *.wmv*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.docx*.com <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.wav*.scr <====== UWAGA
HKLM Group Policy restriction on software: %programfiles%\*\svchost.exe <====== UWAGA
HKLM Group Policy restriction on software: *.png*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.ppt*.pif <====== UWAGA
HKLM Group Policy restriction on software: %systemdrive%\*\svchost.exe <====== UWAGA
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== UWAGA
HKLM Group Policy restriction on software: *.pptx*.com <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.com <====== UWAGA
HKLM Group Policy restriction on software: *.xlsx*.com <====== UWAGA
HKLM Group Policy restriction on software: *.mp3*.pif <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.pif <====== UWAGA
HKLM Group Policy restriction on software: C:\Users\*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.wav*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.wma*.exe <====== UWAGA
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.com <====== UWAGA
HKLM Group Policy restriction on software: *.jpeg*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.xls*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.wav*.com <====== UWAGA
HKLM Group Policy restriction on software: *.ppt*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.wmv*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.pptx*.pif <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.pif <====== UWAGA
HKLM Group Policy restriction on software: lsassvrtdbks.exe <====== UWAGA
HKLM Group Policy restriction on software: *.doc*.com <====== UWAGA
HKLM Group Policy restriction on software: *.xls*.scr <====== UWAGA
HKLM Group Policy restriction on software: C:\Users\*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.gif*.com <====== UWAGA
HKLM Group Policy restriction on software: *.pdf*.scr <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.com <====== UWAGA
HKLM Group Policy restriction on software: *.jpeg*.com <====== UWAGA
HKLM Group Policy restriction on software: *.docx*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.divx*.pif <====== UWAGA
HKLM Group Policy restriction on software: %appdata%\*.com <====== UWAGA
HKLM Group Policy restriction on software: *.rtf*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.wma*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.rar*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.gif*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.jpg*.scr <====== UWAGA
HKLM Group Policy restriction on software: *:\$Recycle.Bin <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.doc*.pif <====== UWAGA
HKLM Group Policy restriction on software: *.txt*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.pub*.com <====== UWAGA
HKLM Group Policy restriction on software: *.bmp*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.jpeg*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.wmv*.com <====== UWAGA
HKLM Group Policy restriction on software: *.wma*.com <====== UWAGA
HKLM Group Policy restriction on software: *.pptx*.scr <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.divx*.scr <====== UWAGA
HKLM Group Policy restriction on software: C:\Users\*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.pub*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.mp3*.scr <====== UWAGA
HKLM Group Policy restriction on software: *.wav*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.avi*.com <====== UWAGA
HKLM Group Policy restriction on software: %appdata%\*\*.exe <====== UWAGA
HKLM Group Policy restriction on software: *.7z*.exe <====== UWAGA
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.pif <====== UWAGA
HKLM\...\.scr: CryptoPreventSCR => "C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.CryptoPreventEXEC" "%1" /S %* <===== UWAGA
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).
.

[ToServeAndProtect]

Pliki usunięte ręcznie bo wiadomo, nie do odzyskania

[ordynat]

W nowych logach nie widzę już niczego podejrzanego.
.

Autor postu otrzymał pochwałę

[ToServeAndProtect]

dzięki