cryakl Шифровальщик tosenderbuild.exe (Trojan-Ransom.Win32.Cryakl.aoj)

[Марат Хафизов]

Мне бы бакап зашифрованный выудить 

Логи прилагаю.

Addition.txt

FRST.txt

Shortcut.txt

Изменено 20 января, 2017 пользователем Марат Хафизов

[SQ]

Здравствуйте,

 

Приложите логи согласно правилам.

 

 

Касаемо логов FRST:

• Закройте и сохраните все открытые приложения.
• Скопируйте приведенный ниже текст в Блокнот и сохраните файл как fixlist.txt в ту же папку откуда была запущена утилита Farbar Recovery Scan Tool:

  CreateRestorePoint:
  2017-01-20 02:05 - 2017-01-20 02:05 - 00000390 _____ C:\Users\Все пользователи\README.txt
  2017-01-20 02:05 - 2017-01-20 02:05 - 00000390 _____ C:\Users\README.txt
  2017-01-20 02:05 - 2017-01-20 02:05 - 00000390 _____ C:\README.txt
  2017-01-20 02:05 - 2017-01-20 02:05 - 00000390 _____ C:\ProgramData\README.txt
  2017-01-20 02:04 - 2017-01-20 02:05 - 00000390 _____ C:\Users\Public\Documents\README.txt
  2017-01-20 02:04 - 2017-01-20 02:05 - 00000390 _____ C:\Users\Public\Desktop\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\Администратор\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\Администратор\Downloads\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\Администратор\Documents\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\Администратор\AppData\Roaming\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\Администратор\AppData\Roaming\Microsoft\Windows\Start Menu\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\Администратор\AppData\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\Администратор\AppData\LocalLow\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\Администратор\AppData\Local\Temp\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\USR1CV82\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\USR1CV82\Downloads\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\USR1CV82\Documents\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\USR1CV82\Desktop\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\USR1CV82\AppData\Roaming\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\USR1CV82\AppData\Roaming\Microsoft\Windows\Start Menu\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\USR1CV82\AppData\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\USR1CV82\AppData\LocalLow\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\USR1CV82\AppData\Local\Temp\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\SQLSERVERAGENT\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\SQLSERVERAGENT\Downloads\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\SQLSERVERAGENT\Documents\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\SQLSERVERAGENT\Desktop\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\SQLSERVERAGENT\AppData\Roaming\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\SQLSERVERAGENT\AppData\Roaming\Microsoft\Windows\Start Menu\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\SQLSERVERAGENT\AppData\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\SQLSERVERAGENT\AppData\LocalLow\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\SQLSERVERAGENT\AppData\Local\Temp\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\Public\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\Public\Downloads\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\MSSQLSERVER\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\MSSQLSERVER\Downloads\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\MSSQLSERVER\Documents\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\MSSQLSERVER\Desktop\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\MSSQLSERVER\AppData\Roaming\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\MSSQLSERVER\AppData\Roaming\Microsoft\Windows\Start Menu\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\MSSQLSERVER\AppData\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\MSSQLSERVER\AppData\LocalLow\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\MSSQLSERVER\AppData\Local\Temp\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\list\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\list\Downloads\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\list\Documents\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\list\Desktop\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\list\AppData\Roaming\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\list\AppData\Roaming\Microsoft\Windows\Start Menu\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\list\AppData\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\list\AppData\LocalLow\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 00000390 _____ C:\Users\list\AppData\Local\Temp\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\host\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\host\Downloads\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\host\Documents\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\host\Desktop\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\host\AppData\Roaming\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\host\AppData\Roaming\Microsoft\Windows\Start Menu\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\host\AppData\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\host\AppData\LocalLow\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\host\AppData\Local\Temp\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default\Downloads\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default\Documents\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default\Desktop\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default\AppData\Roaming\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default\AppData\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default\AppData\Local\Temp\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default User\Downloads\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default User\Documents\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default User\Desktop\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default User\AppData\Roaming\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default User\AppData\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\Default User\AppData\Local\Temp\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\1cservice\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\1cservice\Downloads\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\1cservice\Documents\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\1cservice\Desktop\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\1cservice\AppData\Roaming\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\1cservice\AppData\Roaming\Microsoft\Windows\Start Menu\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\1cservice\AppData\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\1cservice\AppData\LocalLow\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Users\1cservice\AppData\Local\Temp\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 00000390 _____ C:\Program Files (x86)\README.txt
  2017-01-20 01:57 - 2017-01-20 01:57 - 00000390 _____ C:\Program Files\README.txt
  2017-01-20 01:49 - 2017-01-20 01:49 - 00000390 _____ C:\Program Files\Common Files\README.txt
  2017-01-20 01:47 - 2017-01-20 01:47 - 00000000 _____ C:\Users\list\AppData\Local\Temp\v8l8F8B.tmp
  2017-01-20 01:47 - 2017-01-20 01:47 - 00000000 _____ C:\Users\list\AppData\Local\Temp\v8l3217.tmp
  2017-01-20 01:40 - 2017-01-20 01:40 - 00000000 _____ C:\Users\list\AppData\Local\Temp\v8lF658.tmp
  2017-01-19 05:00 - 2017-01-19 05:00 - 00000000 _____ C:\Users\Администратор\AppData\Local\Temp\v8l50A2.tmp
  2017-01-18 08:40 - 2017-01-18 08:40 - 00000000 _____ C:\Users\list\AppData\Local\Temp\v8lD74F.tmp
  2017-01-20 01:57 - 2017-01-20 01:57 - 0000390 _____ () C:\Program Files\README.txt
  2017-01-20 02:03 - 2017-01-20 02:03 - 0000390 _____ () C:\Program Files (x86)\README.txt
  2017-01-20 01:49 - 2017-01-20 01:49 - 0000390 _____ () C:\Program Files\Common Files\README.txt
  2017-01-20 01:59 - 2017-01-20 01:59 - 0000390 _____ () C:\Program Files (x86)\Common Files\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 0000390 _____ () C:\Users\Администратор\AppData\Roaming\README.txt
  2017-01-20 02:04 - 2017-01-20 02:04 - 0000390 _____ () C:\Users\Администратор\AppData\Roaming\Microsoft\README.txt
  2017-01-20 02:05 - 2017-01-20 02:05 - 0000390 _____ () C:\ProgramData\README.txt
  

• Запустите FRST и нажмите один раз на кнопку Fix и подождите.
• Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении!

Изменено 20 января, 2017 пользователем thyrex