crylock 2.0.0.0 Зашифровано CryLock

[quazar 0]

Добрый день!

Судя по всему зашифровали файлы через RDP, был обнаружен пользователь в папке загрузок посторонние файлы.

в приложении зашифрованные файлы и файлы с копиями оригиналами

Addition.txt FRST.txt files.rar

[thyrex 1 210]

Для этой версии расшифровки нет.

 

Чистка мусора нужна или система под переустановку?

[quazar 0]

1 час назад, thyrex сказал:

Для этой версии расшифровки нет.

 

Чистка мусора нужна или система под переустановку?

Да нужна

 

1 час назад, thyrex сказал:

Для этой версии расшифровки нет.

 

Чистка мусора нужна или система под переустановку?

Может ли появится дешифратор?

[thyrex 1 210]

Без слива ключей самими злоумышленниками расшифровка не появится.

[quazar 0]

10 часов назад, thyrex сказал:

Для этой версии расшифровки нет.

 

Чистка мусора нужна или система под переустановку?

Чистку мусора как сделать?

[thyrex 1 210]

1. Выделите следующий код:

Start::
CreateRestorePoint:
KU\S-1-5-21-2832951202-910057528-4141359491-1012\...\MountPoints2: {a4f38584-27b1-11eb-8104-2c4d54d40897} - "E:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-2832951202-910057528-4141359491-1015\...\MountPoints2: {a4f38584-27b1-11eb-8104-2c4d54d40897} - "E:\HiSuiteDownLoader.exe" 
2020-12-05 18:22 - 2020-12-05 18:22 - 000013918 _____ C:\how_to_decrypt.hta
2020-12-05 18:21 - 2020-12-05 18:21 - 000013918 _____ C:\Users\Администратор\how_to_decrypt.hta
2020-12-05 18:21 - 2020-12-05 18:21 - 000013918 _____ C:\Users\Администратор\Downloads\how_to_decrypt.hta
2020-12-05 18:21 - 2020-12-05 18:21 - 000013918 _____ C:\Users\Администратор\Documents\how_to_decrypt.hta
2020-12-05 18:21 - 2020-12-05 18:21 - 000013918 _____ C:\Users\Администратор\Desktop\how_to_decrypt.hta
2020-12-05 18:21 - 2020-12-05 18:21 - 000013918 _____ C:\Users\Администратор\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:21 - 2020-12-05 18:21 - 000013918 _____ C:\Users\Администратор\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:21 - 2020-12-05 18:21 - 000013918 _____ C:\Users\Администратор\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:21 - 2020-12-05 18:21 - 000013918 _____ C:\Users\Администратор\AppData\how_to_decrypt.hta
2020-12-05 18:20 - 2020-12-05 18:20 - 000013918 _____ C:\Users\Администратор\AppData\Local\how_to_decrypt.hta
2020-12-05 18:20 - 2020-12-05 18:20 - 000013918 _____ C:\Users\Vladimir\how_to_decrypt.hta
2020-12-05 18:20 - 2020-12-05 18:20 - 000013918 _____ C:\Users\Vladimir\Downloads\how_to_decrypt.hta
2020-12-05 18:20 - 2020-12-05 18:20 - 000013918 _____ C:\Users\Vladimir\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:18 - 2020-12-05 18:18 - 000013918 _____ C:\Users\Vladimir\Documents\how_to_decrypt.hta
2020-12-05 18:16 - 2020-12-05 18:16 - 000013918 _____ C:\Users\Vladimir\Desktop\how_to_decrypt.hta
2020-12-05 18:16 - 2020-12-05 18:16 - 000013918 _____ C:\Users\Vladimir\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:16 - 2020-12-05 18:16 - 000013918 _____ C:\Users\Vladimir\AppData\how_to_decrypt.hta
2020-12-05 18:15 - 2020-12-05 18:15 - 000013918 _____ C:\Users\Vladimir\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:12 - 2020-12-05 18:12 - 000013918 _____ C:\Users\Vladimir\AppData\Local\how_to_decrypt.hta
2020-12-05 18:10 - 2020-12-05 18:10 - 000013918 _____ C:\Users\Viktor\how_to_decrypt.hta
2020-12-05 18:10 - 2020-12-05 18:10 - 000013918 _____ C:\Users\Viktor\Downloads\how_to_decrypt.hta
2020-12-05 18:10 - 2020-12-05 18:10 - 000013918 _____ C:\Users\Viktor\Documents\how_to_decrypt.hta
2020-12-05 18:10 - 2020-12-05 18:10 - 000013918 _____ C:\Users\Viktor\Desktop\how_to_decrypt.hta
2020-12-05 18:10 - 2020-12-05 18:10 - 000013918 _____ C:\Users\Viktor\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Viktor\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Viktor\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Viktor\AppData\Local\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Viktor\AppData\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Vadim\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Vadim\Downloads\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Vadim\Documents\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Vadim\Desktop\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Vadim\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Vadim\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Vadim\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:09 - 2020-12-05 18:09 - 000013918 _____ C:\Users\Vadim\AppData\how_to_decrypt.hta
2020-12-05 18:08 - 2020-12-05 18:08 - 000013918 _____ C:\Users\Vadim\AppData\Local\how_to_decrypt.hta
2020-12-05 18:08 - 2020-12-05 18:08 - 000013918 _____ C:\Users\Upravl\how_to_decrypt.hta
2020-12-05 18:08 - 2020-12-05 18:08 - 000013918 _____ C:\Users\Upravl\Downloads\how_to_decrypt.hta
2020-12-05 18:08 - 2020-12-05 18:08 - 000013918 _____ C:\Users\Upravl\Documents\how_to_decrypt.hta
2020-12-05 18:08 - 2020-12-05 18:08 - 000013918 _____ C:\Users\Upravl\Desktop\how_to_decrypt.hta
2020-12-05 18:08 - 2020-12-05 18:08 - 000013918 _____ C:\Users\Upravl\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:08 - 2020-12-05 18:08 - 000013918 _____ C:\Users\Upravl\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:08 - 2020-12-05 18:08 - 000013918 _____ C:\Users\Upravl\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:08 - 2020-12-05 18:08 - 000013918 _____ C:\Users\Upravl\AppData\how_to_decrypt.hta
2020-12-05 18:07 - 2020-12-05 18:07 - 000013918 _____ C:\Users\Upravl\AppData\Local\how_to_decrypt.hta
2020-12-05 18:07 - 2020-12-05 18:07 - 000013918 _____ C:\Users\System1C\how_to_decrypt.hta
2020-12-05 18:07 - 2020-12-05 18:07 - 000013918 _____ C:\Users\System1C\Downloads\how_to_decrypt.hta
2020-12-05 18:07 - 2020-12-05 18:07 - 000013918 _____ C:\Users\System1C\Documents\how_to_decrypt.hta
2020-12-05 18:07 - 2020-12-05 18:07 - 000013918 _____ C:\Users\System1C\Desktop\how_to_decrypt.hta
2020-12-05 18:07 - 2020-12-05 18:07 - 000013918 _____ C:\Users\System1C\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:07 - 2020-12-05 18:07 - 000013918 _____ C:\Users\System1C\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:07 - 2020-12-05 18:07 - 000013918 _____ C:\Users\System1C\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:07 - 2020-12-05 18:07 - 000013918 _____ C:\Users\System1C\AppData\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\System1C\AppData\Local\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\Sklad\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\Sklad\Downloads\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\Sklad\Documents\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\Sklad\Desktop\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\Sklad\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\Sklad\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\Sklad\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\Sklad\AppData\Local\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\Sklad\AppData\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\Public\how_to_decrypt.hta
2020-12-05 18:06 - 2020-12-05 18:06 - 000013918 _____ C:\Users\Public\Downloads\how_to_decrypt.hta
2020-12-05 18:05 - 2020-12-05 18:05 - 000013918 _____ C:\Users\Office1\how_to_decrypt.hta
2020-12-05 18:05 - 2020-12-05 18:05 - 000013918 _____ C:\Users\Office1\Downloads\how_to_decrypt.hta
2020-12-05 18:05 - 2020-12-05 18:05 - 000013918 _____ C:\Users\Office1\Documents\how_to_decrypt.hta
2020-12-05 18:05 - 2020-12-05 18:05 - 000013918 _____ C:\Users\Office1\Desktop\how_to_decrypt.hta
2020-12-05 18:05 - 2020-12-05 18:05 - 000013918 _____ C:\Users\Office1\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:05 - 2020-12-05 18:05 - 000013918 _____ C:\Users\Office1\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:05 - 2020-12-05 18:05 - 000013918 _____ C:\Users\Office1\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:05 - 2020-12-05 18:05 - 000013918 _____ C:\Users\Office1\AppData\how_to_decrypt.hta
2020-12-05 18:04 - 2020-12-05 18:04 - 000013918 _____ C:\Users\Office1\AppData\Local\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Nad\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Nad\Downloads\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Nad\Documents\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Nad\Desktop\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Nad\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Nad\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Nad\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Nad\AppData\Local\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Nad\AppData\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Mag2user1c\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Mag2user1c\Downloads\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Mag2user1c\Documents\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Mag2user1c\Desktop\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Mag2user1c\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Mag2user1c\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Mag2user1c\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:03 - 2020-12-05 18:03 - 000013918 _____ C:\Users\Mag2user1c\AppData\how_to_decrypt.hta
2020-12-05 18:02 - 2020-12-05 18:02 - 000013918 _____ C:\Users\Mag2user1c\AppData\Local\how_to_decrypt.hta
2020-12-05 18:02 - 2020-12-05 18:02 - 000013918 _____ C:\Users\Mag1user1c\how_to_decrypt.hta
2020-12-05 18:02 - 2020-12-05 18:02 - 000013918 _____ C:\Users\Mag1user1c\Downloads\how_to_decrypt.hta
2020-12-05 18:02 - 2020-12-05 18:02 - 000013918 _____ C:\Users\Mag1user1c\Documents\how_to_decrypt.hta
2020-12-05 18:02 - 2020-12-05 18:02 - 000013918 _____ C:\Users\Mag1user1c\Desktop\how_to_decrypt.hta
2020-12-05 18:02 - 2020-12-05 18:02 - 000013918 _____ C:\Users\Mag1user1c\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:02 - 2020-12-05 18:02 - 000013918 _____ C:\Users\Mag1user1c\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:02 - 2020-12-05 18:02 - 000013918 _____ C:\Users\Mag1user1c\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:02 - 2020-12-05 18:02 - 000013918 _____ C:\Users\Mag1user1c\AppData\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\Mag1user1c\AppData\Local\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri59\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri59\Downloads\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri59\Documents\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri59\Desktop\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri59\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri59\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri59\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri59\AppData\Local\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri59\AppData\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri44\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri44\Downloads\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri44\Documents\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri44\Desktop\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri44\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri44\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri44\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri44\AppData\Local\how_to_decrypt.hta
2020-12-05 18:01 - 2020-12-05 18:01 - 000013918 _____ C:\Users\dveri44\AppData\how_to_decrypt.hta
2020-12-05 18:00 - 2020-12-05 18:00 - 000013918 _____ C:\Users\dveri207\how_to_decrypt.hta
2020-12-05 18:00 - 2020-12-05 18:00 - 000013918 _____ C:\Users\dveri207\Downloads\how_to_decrypt.hta
2020-12-05 18:00 - 2020-12-05 18:00 - 000013918 _____ C:\Users\dveri207\Documents\how_to_decrypt.hta
2020-12-05 18:00 - 2020-12-05 18:00 - 000013918 _____ C:\Users\dveri207\Desktop\how_to_decrypt.hta
2020-12-05 18:00 - 2020-12-05 18:00 - 000013918 _____ C:\Users\dveri207\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 18:00 - 2020-12-05 18:00 - 000013918 _____ C:\Users\dveri207\AppData\Roaming\how_to_decrypt.hta
2020-12-05 18:00 - 2020-12-05 18:00 - 000013918 _____ C:\Users\dveri207\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 18:00 - 2020-12-05 18:00 - 000013918 _____ C:\Users\dveri207\AppData\Local\how_to_decrypt.hta
2020-12-05 18:00 - 2020-12-05 18:00 - 000013918 _____ C:\Users\dveri207\AppData\how_to_decrypt.hta
2020-12-05 18:00 - 2020-12-05 18:00 - 000013918 _____ C:\Users\Director2019\how_to_decrypt.hta
2020-12-05 18:00 - 2020-12-05 18:00 - 000013918 _____ C:\Users\Director2019\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 17:59 - 2020-12-05 17:59 - 000013918 _____ C:\Users\Director2019\Downloads\how_to_decrypt.hta
2020-12-05 17:59 - 2020-12-05 17:59 - 000013918 _____ C:\Users\Director2019\Documents\how_to_decrypt.hta
2020-12-05 17:59 - 2020-12-05 17:59 - 000013918 _____ C:\Users\Director2019\Desktop\how_to_decrypt.hta
2020-12-05 17:59 - 2020-12-05 17:59 - 000013918 _____ C:\Users\Director2019\AppData\Roaming\how_to_decrypt.hta
2020-12-05 17:59 - 2020-12-05 17:59 - 000013918 _____ C:\Users\Director2019\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 17:59 - 2020-12-05 17:59 - 000013918 _____ C:\Users\Director2019\AppData\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Director2019\AppData\Local\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default\Downloads\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default\Documents\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default\Desktop\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default\AppData\Roaming\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default\AppData\Local\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default\AppData\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default User\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default User\Downloads\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default User\Documents\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default User\Desktop\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default User\AppData\Roaming\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default User\AppData\Local\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Default User\AppData\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Buhgalter\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Buhgalter\Downloads\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000013918 _____ C:\Users\Buhgalter\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 17:58 - 2020-12-05 17:58 - 000000040 _____ C:\Users\Adminis\Desktop\ClearLock.ini
2020-12-05 17:57 - 2020-12-05 17:57 - 000013918 _____ C:\Users\Buhgalter\Documents\how_to_decrypt.hta
2020-12-05 17:57 - 2020-12-05 17:57 - 000013918 _____ C:\Users\Buhgalter\Desktop\how_to_decrypt.hta
2020-12-05 17:57 - 2020-12-05 17:57 - 000013918 _____ C:\Users\Buhgalter\AppData\Roaming\how_to_decrypt.hta
2020-12-05 17:57 - 2020-12-05 17:57 - 000013918 _____ C:\Users\Buhgalter\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 17:57 - 2020-12-05 17:57 - 000013918 _____ C:\Users\Buhgalter\AppData\how_to_decrypt.hta
2020-12-05 17:57 - 2010-09-21 02:47 - 000451221 _____ (Swan River Computers) C:\Users\Adminis\Desktop\ClearLock.exe
2020-12-05 17:53 - 2020-12-05 17:53 - 000013918 _____ C:\Users\Buhgalter\AppData\Local\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\azia\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\azia\Downloads\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\azia\Documents\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\azia\Desktop\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\azia\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\azia\AppData\Roaming\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\azia\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\azia\AppData\Local\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\azia\AppData\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\Alena_home\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\Alena_home\Downloads\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\Alena_home\Documents\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\Alena_home\Desktop\how_to_decrypt.hta
2020-12-05 17:51 - 2020-12-05 17:51 - 000013918 _____ C:\Users\Alena_home\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Alena_home\AppData\Roaming\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Alena_home\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Alena_home\AppData\Local\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Alena_home\AppData\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Adminis\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Adminis\Downloads\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Adminis\Documents\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Adminis\Desktop\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Adminis\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Adminis\AppData\Roaming\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Adminis\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Adminis\AppData\Local\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\Adminis\AppData\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\ADM\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\ADM\Downloads\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\ADM\Documents\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\ADM\Desktop\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\ADM\AppData\Roaming\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\ADM\AppData\Roaming\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\ADM\AppData\LocalLow\how_to_decrypt.hta
2020-12-05 17:50 - 2020-12-05 17:50 - 000013918 _____ C:\Users\ADM\AppData\how_to_decrypt.hta
2020-12-05 17:49 - 2020-12-05 17:49 - 000013918 _____ C:\Users\ADM\AppData\Local\how_to_decrypt.hta
2020-12-05 17:47 - 2020-12-05 17:47 - 000013918 _____ C:\Users\Все пользователи\how_to_decrypt.hta
2020-12-05 17:47 - 2020-12-05 17:47 - 000013918 _____ C:\Users\Все пользователи\Documents\how_to_decrypt.hta
2020-12-05 17:47 - 2020-12-05 17:47 - 000013918 _____ C:\Users\Все пользователи\Desktop\how_to_decrypt.hta
2020-12-05 17:47 - 2020-12-05 17:47 - 000013918 _____ C:\Users\Public\Documents\how_to_decrypt.hta
2020-12-05 17:47 - 2020-12-05 17:47 - 000013918 _____ C:\Users\Public\Desktop\how_to_decrypt.hta
2020-12-05 17:47 - 2020-12-05 17:47 - 000013918 _____ C:\ProgramData\Microsoft\Windows\Start Menu\how_to_decrypt.hta
2020-12-05 17:47 - 2020-12-05 17:47 - 000013918 _____ C:\ProgramData\how_to_decrypt.hta
2020-12-05 17:47 - 2020-12-05 17:47 - 000013918 _____ C:\ProgramData\Documents\how_to_decrypt.hta
2020-12-05 17:47 - 2020-12-05 17:47 - 000013918 _____ C:\ProgramData\Desktop\how_to_decrypt.hta
2020-12-05 17:44 - 2020-12-05 17:44 - 000013918 _____ C:\Users\how_to_decrypt.hta
AlternateDataStreams: C:\Users\Vladimir\Application Data:1 [148]
AlternateDataStreams: C:\Users\Vladimir\AppData\Roaming:1 [148]
End::

2. Скопируйте выделенный текст (правая кнопка мыши – Копировать).
3. Запустите Farbar Recovery Scan Tool.
4. Нажмите один раз на кнопку Fix и подождите. Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении.

• Обратите внимание: перезагрузку компьютера нужно выполнить вручную после данного скрипта.