ransom.shade Шифратор cryptsen7fo43rr6.onion

[Kyja]

Здравствуйте, поймали шифратор.

 

Подскажите какие еще следы остались в системе? И как удалить их

 

Сами файлы не востановить как я так понял из других тем верно?

 

 

 

 

CollectionLog-2019.03.09-17.19.zip

[thyrex]

Скачайте Farbar Recovery Scan Tool и сохраните на Рабочем столе.

• Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.

1. Запустите программу двойным щелчком. Когда программа запустится, нажмите Yes для соглашения с предупреждением.

2. Убедитесь, что в окне Optional Scan отмечены List BCD, Driver MD5 и 90 Days Files.

3. Нажмите кнопку Scan.

4. После окончания сканирования будет создан отчет (FRST.txt) в той же папке, откуда была запущена программа.

5. Если программа была запущена в первый раз, также будет создан отчет (Addition.txt).

6. Файлы FRST.txt и Addition.txt заархивируйте (в один общий архив) и прикрепите к сообщению.

[Kyja]

Сделано

Scan.rar

[thyrex]

1. Выделите следующий код:

Start::
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKU\S-1-5-21-2322996236-998960802-2957947716-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
S3 cpuz140; C:\Users\Server\AppData\Local\Temp\cpuz140\cpuz140_x64.sys [45888 2016-12-27] (CPUID -> CPUID) <==== ATTENTION
2019-03-06 12:03 - 2019-03-09 14:51 - 000000000 __SHD C:\Users\Все пользователи\Windows
2019-03-06 12:03 - 2019-03-09 14:51 - 000000000 __SHD C:\ProgramData\Windows
AlternateDataStreams: C:\ProgramData\TEMP:41ADDB8A [298]
AlternateDataStreams: C:\ProgramData\TEMP:58A5270D [376]
AlternateDataStreams: C:\ProgramData\TEMP:A064CECC [144]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:41ADDB8A [298]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:58A5270D [376]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:A064CECC [144]
FirewallRules: [{7FC1A1C0-5BB2-4F03-9926-C5F8A8D92730}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{9FC3C0D0-B2AC-4C34-922F-576C07AF7D82}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{414FBB0E-39D1-4596-9478-71010B2B041E}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{C25820CC-BE0F-494D-8FF3-C3192632A3BD}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{19E3E950-1FD5-40B0-B512-06E1D35AB698}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{27B7F97F-58C4-4611-84BA-67806D038010}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{D28840A3-548E-434C-832E-E545B0DBCAB0}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{2B132071-02F9-4031-B060-27C7674FF4F7}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{51CC446F-9E67-448C-8C64-7BB416256EA9}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{F421B25E-77F3-4FD0-B6FB-9016D554590F}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{67DFC33C-0EF8-4167-BA11-22BDE10123FF}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{44975F3B-D1DB-4B54-BF1A-A0C13FD39274}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{4F72EA5B-1E81-41D4-8851-84C4633709F2}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{12C489F7-81BE-4629-93C4-0C66F959FF2E}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{A0434709-A0A9-4551-AE30-3B4D79A0D3A4}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{944227AA-D410-4C66-92C6-356915C4B383}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{F1EB59CD-DDA5-4CF3-899A-20DD3D13EC53}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{78AACA08-E758-4BBC-8DF7-28CCBEC8FAF3}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{89ECF9C2-CF46-4205-8A1A-164989FE6199}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{D474B464-DBC3-432F-8BDB-CCBCCADC6A5A}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{11CBD735-0A67-4793-9326-9BE0384327F7}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{336CB20A-2524-401F-887F-885542DD289F}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{D5AB82CB-C470-46CD-BA48-4D646627AEB4}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{1329A21A-D34D-476C-BB94-569680FCC05E}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{7E09F456-BA2F-41C9-8EE9-E6E3B5D2D40F}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{EC37D33B-1377-4DF6-BED7-B20771E494D7}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{77AA1CBD-4378-403F-8F3E-5037EAC08DA7}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{65B3B01F-CF9F-4343-A24F-2FF019D65398}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{8C9A0C70-A40F-4204-B7E0-36F2296ED807}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{4E72D6E7-D968-496E-8FB2-6B3EB072825D}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{A56E2C04-B7C1-44B0-9F94-10B20A601993}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{6698C861-589F-4210-B4D9-EB68E69512D6}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{C9711EF0-F678-40C9-8DA9-5608BE03B7FA}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{05EA31FE-F602-4024-B14F-BB4DA176EE0F}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{DE6CB156-0E12-46DF-BD97-95FA7ECAEDA6}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{39C700C4-C787-4696-ABC7-0C9D15D36B73}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{CE0C7359-A514-4D44-8B3B-031E520CF91A}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{9A107276-5C89-40CF-9D12-F3B2C8E459C4}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{0109A9DA-3737-4610-98BF-38E84B04DCA6}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{D941E6FF-0016-435F-9687-6398E179032A}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{D216BFBF-06C2-4F28-8D28-2115DC125521}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{F0D58119-19D8-4EA2-A6F8-EEE8CCF9BE87}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{C311174C-2395-485D-A852-226D48B7CA51}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{CFE9736F-8DB3-4CCB-8058-1DF6E76398EC}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{1B866FFF-1318-4E12-BD0E-D4382FA51FD1}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{91041461-2EFF-4CAC-A517-204B63504AFA}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{E20CDFF2-B45D-443C-9ABA-F0051A987E10}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{3B62F355-E3AB-4928-9807-3939BD854F51}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{7AE459CD-958D-47D9-BA31-05C512680AD9}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{B4F2DB85-328D-45D8-9495-945DC87EE202}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{31991363-F40C-4EBE-B2F1-52747BAB5593}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{7B81819A-4D81-46DB-AA84-037B9E6A03B1}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{483A2CBA-F6BB-4B7A-9899-CBC725BCFBE1}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{7AC762A7-C350-4BF3-B483-F8468A44BCDA}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{47ED28A8-B637-42BA-AB40-2625E59524BF}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{4A404EA6-83C0-47FC-AD2D-C80D96ED5136}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{1A986B34-EF7B-4A38-B713-559E990C3D7C}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{3BC93477-4C2D-4F6D-84D5-D98A6CAA0920}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{1114D675-F571-44A5-922B-448912E61D83}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{0DD4E729-BFD7-4414-9C78-BFA2888F7635}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{510D0D27-E569-477D-BB85-AA4F512E726B}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{C4F1CE78-6D6E-4475-AE55-59C0E9B72B9B}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{7D68AF01-D160-4F65-BFEF-091DEEFC0A95}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{C7944108-A9BF-4E09-986D-90D2072D688F}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{78AA06A4-447E-4C91-A9FE-3AC538A06046}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{AC565604-8D5C-41B8-BA72-C1C1AE81FCB0}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{493A9B9C-FC54-4599-B949-F78DA029E1E8}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{D5913733-21F1-4F26-B178-E92D0629C6ED}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{A31EE6E7-9572-4417-A4A4-D53C038171FF}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{FF897084-F86E-4099-A076-C9E4F8D92F01}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{A4EA5E4F-63D5-4B79-9331-1814B6C0E4D9}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{52ADF490-1098-49C2-8787-744EC0B87742}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{C32BD51C-ADEE-4255-875D-9345C422F50A}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{DEC638BB-B86A-4DC0-989C-BDB1AC2F11FF}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{1F5BE79A-712B-41BD-9D66-4D2E869773D6}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{09217944-500A-4755-B4BC-EDCEE5A64216}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{CD18F05D-5C12-4080-B477-377D18E0AAED}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{19616A77-5C0E-4326-A3DB-46BEE667610A}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{79F6F06D-19A9-4EF0-988D-3CDCD61F1332}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{A1648357-A037-4BE2-84E7-5924607053A9}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{A98F751C-6BE4-45C4-8DBC-93868B226555}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{0757BEE1-CA1A-4DCB-8645-FC128E827109}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{8B761E4F-F548-49BC-A3AB-1C59EF58F4CA}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{CCD57DFB-EE25-42F9-851B-E3AA69E21BE5}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{4389CDDE-90EC-4A3E-8DBA-A760AED50218}] => (Allow) %ProgramFiles% (x86)\FileZilla Server\FileZilla Server.exe No File
FirewallRules: [{F77E8340-347F-4DD6-A9A3-2A51837B70BE}] => (Allow) %ProgramFiles% (x86)\FileZilla Server\FileZilla Server.exe No File
FirewallRules: [TCP Query User{4C8DB6CE-FB06-417F-A315-60AA8B4E7CFB}F:\quik_vtb24\winros.exe] => (Block) F:\quik_vtb24\winros.exe No File
FirewallRules: [UDP Query User{1246DFE5-C56A-41C7-B618-9F3B2BADA911}F:\quik_vtb24\winros.exe] => (Block) F:\quik_vtb24\winros.exe No File
FirewallRules: [{07A927F5-5E21-40AD-BB75-57FABC1DB175}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
FirewallRules: [{04BF0E14-68C0-4325-B867-D2F93BD725DC}] => (Allow) E:\ze\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe No File
Reboot:
End::

2. Скопируйте выделенный текст (правая кнопка мыши – Копировать).

3. Запустите Farbar Recovery Scan Tool.

4. Нажмите один раз на кнопку Fix и подождите. Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении.

• Обратите внимание: будет выполнена перезагрузка компьютера.

[Kyja]

сделано

(а не надо было выполнить скрипт который Вы указали в amz?)

Fixlog.txt

[thyrex]

Мусор почистили. Больше помочь нечем

[Kyja]

Большое спасибо

Есть ли смысл оставить зашифрованые харды или расшифровки в 99% случаев нет?

[thyrex]

Расшифровки этого варианта нет в 100% случаев. Расшифровка первых вариантов Shade появилась только после изъятия ключей у злоумышленников.

[Kyja]

Случайно вставил диск который еще не был отфармотирован в уже очищенную винду.

Сделал все тоже самое что до этого кроме выполнения скрипта

Подскажите пожалуйста осталось ли что то?

Скан2.rar

[thyrex]

Все в порядке