Шифровальшик попал на сервер через RDP

[ivan.v1]

Остались ли в систему следы шифровальщика вируса? 

 

вот такой был текст 

 

All your data has been locked us
You want to return?
Write email adk0@keemail.me

FRST.txt Addition.txt

[Sandor]

Здравствуйте!

 

• Отключите до перезагрузки антивирус.
• Выделите следующий код:

  Start::
  Startup: C:\Users\adm1c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FILES_ENCRYPTED.txt [2022-08-02] () [File not signed]
  Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FILES_ENCRYPTED.txt [2022-08-02] () [File not signed]
  Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FILES_ENCRYPTED.txt [2022-08-02] () [File not signed]
  Startup: C:\Users\USR1CV83\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FILES_ENCRYPTED.txt [2022-08-02] () [File not signed]
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\USR1CV83\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\USR1CV83\Downloads\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\USR1CV83\Documents\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\USR1CV83\Desktop\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\USR1CV83\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\USR1CV83\AppData\Roaming\Microsoft\Windows\Start Menu\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\USR1CV83\AppData\Roaming\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\USR1CV83\AppData\LocalLow\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\sa_1c\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\sa_1c\Downloads\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\sa_1c\Documents\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\sa_1c\Desktop\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\sa_1c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\sa_1c\AppData\Roaming\Microsoft\Windows\Start Menu\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\sa_1c\AppData\Roaming\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\sa_1c\AppData\LocalLow\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\sa_1c\AppData\Local\Temp\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Public\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Public\Downloads\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Public\Documents\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Default\Downloads\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Default\Documents\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Default\Desktop\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Default\AppData\Roaming\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Default\AppData\Local\Temp\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Administrator\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Administrator\AppData\Roaming\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Administrator\AppData\LocalLow\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\Administrator\AppData\Local\Temp\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\adm1c\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\adm1c\Downloads\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\adm1c\Documents\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\adm1c\Desktop\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\adm1c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\adm1c\AppData\Roaming\Microsoft\Windows\Start Menu\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\adm1c\AppData\Roaming\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\adm1c\AppData\LocalLow\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\Users\adm1c\AppData\Local\Temp\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FILES_ENCRYPTED.txt
  2022-12-24 06:01 - 2022-08-02 12:54 - 000000082 _____ C:\ProgramData\Microsoft\Windows\Start Menu\FILES_ENCRYPTED.txt
  FirewallRules: [{D6F6082C-4B5F-4BB4-A3BB-51860394FA73}] => (Allow) LPort=5985
  FirewallRules: [{2D4C4EF8-DBEF-4213-A562-32F71619949A}] => (Allow) LPort=22
  FirewallRules: [{943E44FB-DA0D-4FB1-BA30-3FC325870D1E}] => (Allow) LPort=123
  End::

   

• Скопируйте выделенный текст (правой кнопкой - Копировать).
• Запустите FRST (FRST64) от имени администратора.
• Нажмите Исправить (Fix) один раз (!) и подождите. Программа создаст лог-файл (Fixlog.txt). Прикрепите его к своему следующему сообщению.

Компьютер перезагрузите вручную.

Подробнее читайте в этом руководстве.