VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

ransomware .thor

https://forum.viry.cz:443/viewtopic.php?t=150428

Stránka 1 z 2

ransomware .thor

Napsal: 01 lis 2016 11:13
od dorban
Dobrý den,

manželce se na jejím pracovním počítači "podařilo" spustit ransomware, který ji zašifroval většinu datových souborů (přípona .thor) (infikovaný soubor přišel emailem od zákazníka, vypadal jako faktura, kterou zákazník běžně posílá, ale bylo to s příponou zip - takže jí to nelze až tak zazlívat)

počítač jsem spustil v nouzovém režimu, projel ESET online scannerem a následně jsem spustil FRST, log přikládám jako samostatný soubor, do textu se nevejde. Prosím o pomoc (počítám, že datové soubory jsou nejspíš ztracené)

Re: ransomware .thor

Napsal: 01 lis 2016 11:13
od dorban
ještě přidávám addition log

Re: ransomware .thor

Napsal: 01 lis 2016 18:48
od Rudy
Datové soubory vám nerozšifrujeme, na to je třeba přímý přístup do PC, což nemáme právně ošetřeno. Nikdo vám ale nezaručí, že to bude možné, na některé šifrování dešifrovací klíč není znám. PC vám odvirujeme a pak se obraťte sem: https://neslape.cz/?utm_campaign=neslap ... ium=banner . Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

Re: ransomware .thor

Napsal: 01 lis 2016 19:25
od dorban
Děkuji. Ohledně dat mi to je jasné. Zatím tedy log z AdwCleaneru: (jinak koukám, že za chvíli dosáhnete kulaté a pro mě neuvěřitelné mety v počtu příspěvků. Hluboká poklona)

# AdwCleaner v6.030 - Log soubor vytvořen 01/11/2016 na 19:14:24
# Aktualizováno dne 19/10/2016 z Malwarebytes
# Databáze : 2016-11-01.2 [Server]
# Operační systém : Windows 7 Professional Service Pack 1 (X64)
# Uživatelské jméno : Martina - SONEK2-PC
# Beží od : C:\Users\Martina\Desktop\adwcleaner_6.030.exe
# Mod: Skenování
# Podpora : https://www.malwarebytes.com/support



***** [ Služby ] *****

Nebyly nalezeny žádné škodlivé služby.


***** [ Adresáře ] *****

Složka nalezena: C:\Users\Martina\AppData\Local\25264
Složka nalezena: C:\Users\Martina\AppData\Local\globalUpdate
Složka nalezena: C:\Users\Martina\AppData\Local\SysassistByHotWheel
Složka nalezena: C:\Users\Martina\AppData\Local\webplayer
Složka nalezena: C:\Users\Martina\AppData\Local\Webplayer
Složka nalezena: C:\Users\Martina\AppData\Roaming\Babylon
Složka nalezena: C:\Users\Martina\AppData\Roaming\IQIYI Video
Složka nalezena: C:\Users\Martina\AppData\Roaming\ppslog
Složka nalezena: C:\Users\Martina\AppData\Roaming\Tencent
Složka nalezena: C:\Users\Martina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FilesFrog Update Checker
Složka nalezena: C:\Users\Martina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FLV Player
Složka nalezena: C:\Users\Martina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com
Složka nalezena: C:\Users\Martina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\filesfrog update checker
Složka nalezena: C:\Program Files\Common Files\Tencent
Složka nalezena: C:\windows\SysNative\tprb
Složka nalezena: C:\Users\Martina\AppData\Local\VirtualStore\Program Files (x86)\Tencent
Složka nalezena: C:\IQIYI Video
Složka nalezena: C:\ppsfile
Složka nalezena: C:\QiYi
Složka nalezena: C:\ProgramData\apn
Složka nalezena: C:\ProgramData\Babylon
Složka nalezena: C:\ProgramData\IQIYI Video
Složka nalezena: C:\ProgramData\Partner
Složka nalezena: C:\ProgramData\Rising
Složka nalezena: C:\ProgramData\StarApp
Složka nalezena: C:\ProgramData\SweetIM
Složka nalezena: C:\ProgramData\TXQMPC
Složka nalezena: C:\ProgramData\Tencent
Složka nalezena: C:\ProgramData\Application Data\apn
Složka nalezena: C:\ProgramData\Application Data\Babylon
Složka nalezena: C:\ProgramData\Application Data\IQIYI Video
Složka nalezena: C:\ProgramData\Application Data\Partner
Složka nalezena: C:\ProgramData\Application Data\Rising
Složka nalezena: C:\ProgramData\Application Data\StarApp
Složka nalezena: C:\ProgramData\Application Data\SweetIM
Složka nalezena: C:\ProgramData\Application Data\TXQMPC
Složka nalezena: C:\ProgramData\Application Data\Tencent
Složka nalezena: C:\Program Files (x86)\FilesFrog Update Checker
Složka nalezena: C:\Program Files (x86)\globalUpdate
Složka nalezena: C:\Program Files (x86)\Gophoto.it
Složka nalezena: C:\Program Files (x86)\Rising
Složka nalezena: C:\Program Files (x86)\SweetIM
Složka nalezena: C:\Program Files (x86)\TornTV.com
Složka nalezena: C:\Program Files (x86)\filesfrog update checker
Složka nalezena: C:\Program Files (x86)\Tencent
Složka nalezena: C:\Program Files (x86)\Common Files\Tencent
Složka nalezena: C:\windows\Installer\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}
Složka nalezena: C:\windows\SysWOW64\mjcm
Složka nalezena: C:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent
Složka nalezena: C:\Users\Martina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk


***** [ Soubory ] *****

Soubor nalezen: C:\Users\Martina\AppData\LocalLow\SkwConfig.bin
Soubor nalezen: C:\Users\Martina\Desktop\Check for Updates.lnk


***** [ DLL ] *****

Nebyly nalezeny žádné škodlivé DLL soubory.


***** [ WMI ] *****

Nebyly nalezeny žádné škodlivé klíče.


***** [ Zástupce ] *****

Zástupce infikován: C:\Users\Martina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FLV Player\Uninstall.lnk ( _?=C:\Users\Martina\AppData\Local\WebPlayer\FLV Player )


***** [ Plánovač úloh ] *****

Žádný nebezpečná úloha nenalezena.


***** [ Registry ] *****

Klíč nalezen: HKLM\SOFTWARE\Classes\Prod.cap
Klíč nalezen: HKLM\SOFTWARE\Classes\sim-packages
Klíč nalezen: HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Klíč nalezen: HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Klíč nalezen: HKLM\SOFTWARE\Classes\Toolbar3.SWEETIE
Klíč nalezen: HKLM\SOFTWARE\Classes\Toolbar3.SWEETIE.1
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\Prod.cap
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\sim-packages
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\Toolbar3.SWEETIE
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\Toolbar3.SWEETIE.1
Klíč nalezen: HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Klíč nalezen: HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Klíč nalezen: HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
Klíč nalezen: HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
Klíč nalezen: HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Klíč nalezen: HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Klíč nalezen: HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Klíč nalezen: HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Klíč nalezen: HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Klíč nalezen: HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Klíč nalezen: HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Klíč nalezen: HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Klíč nalezen: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4F524A2D-5637-006A-76A7-7A786E7484D7}
Klíč nalezen: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Klíč nalezen: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Klíč nalezen: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Klíč nalezen: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Hodnota nalezena: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Hodnota nalezena: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{EEE6C35C-6118-11DC-9C72-001320C79847}]
Klíč nalezen: HKU\.DEFAULT\Software\AskPartnerNetwork
Klíč nalezen: HKU\.DEFAULT\Software\ImInstaller
Klíč nalezen: HKU\.DEFAULT\Software\SweetIM
Klíč nalezen: HKU\.DEFAULT\Software\WNLT
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\1ClickDownload
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\BABSOLUTION
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\BI
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\DataMngr
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\ImInstaller
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\Somoto
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\SweetIM
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\Webplayer
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\Datamngr
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\FLV Player
Klíč nalezen: HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1719941174-560027120-3640491002-1000\Software\SweetIM
Klíč nalezen: HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1719941174-560027120-3640491002-1000\Software\WNLT
Klíč nalezen: HKU\S-1-5-18\Software\AskPartnerNetwork
Klíč nalezen: HKU\S-1-5-18\Software\ImInstaller
Klíč nalezen: HKU\S-1-5-18\Software\SweetIM
Klíč nalezen: HKU\S-1-5-18\Software\WNLT
Klíč nalezen: HKCU\Software\1ClickDownload
Klíč nalezen: HKCU\Software\BABSOLUTION
Klíč nalezen: HKCU\Software\BI
Klíč nalezen: HKCU\Software\DataMngr
Klíč nalezen: HKCU\Software\ImInstaller
Klíč nalezen: HKCU\Software\Somoto
Klíč nalezen: HKCU\Software\SweetIM
Klíč nalezen: HKCU\Software\Webplayer
Klíč nalezen: HKCU\Software\Datamngr
Klíč nalezen: HKLM\SOFTWARE\Babylon
Klíč nalezen: HKLM\SOFTWARE\DataMngr
Klíč nalezen: HKLM\SOFTWARE\SweetIM
Klíč nalezen: HKLM\SOFTWARE\Datamngr
Klíč nalezen: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\FLV Player
Klíč nalezen: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0D3BEDD9-C4BF-4040-BE99-8DA827F265A7}
Klíč nalezen: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}
Klíč nalezen: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FilesFrog Update Checker
Klíč nalezen: [x64] HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1719941174-560027120-3640491002-1000\Software\SweetIM
Klíč nalezen: [x64] HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1719941174-560027120-3640491002-1000\Software\WNLT
Klíč nalezen: [x64] HKCU\Software\1ClickDownload
Klíč nalezen: [x64] HKCU\Software\BABSOLUTION
Klíč nalezen: [x64] HKCU\Software\BI
Klíč nalezen: [x64] HKCU\Software\DataMngr
Klíč nalezen: [x64] HKCU\Software\ImInstaller
Klíč nalezen: [x64] HKCU\Software\Somoto
Klíč nalezen: [x64] HKCU\Software\SweetIM
Klíč nalezen: [x64] HKCU\Software\Webplayer
Klíč nalezen: [x64] HKCU\Software\Datamngr
Klíč nalezen: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\FLV Player
Klíč nalezen: HKLM\SOFTWARE\Classes\Installer\Features\9DDEB3D0FB4C0404EB99D88A722F567A
Klíč nalezen: HKLM\SOFTWARE\Classes\Installer\Features\B2FD9C0A5B9838449838816A28001F4B
Klíč nalezen: HKLM\SOFTWARE\Classes\Installer\Products\9DDEB3D0FB4C0404EB99D88A722F567A
Klíč nalezen: HKLM\SOFTWARE\Classes\Installer\Products\B2FD9C0A5B9838449838816A28001F4B
Klíč nalezen: HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
Klíč nalezen: HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9DDEB3D0FB4C0404EB99D88A722F567A
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B2FD9C0A5B9838449838816A28001F4B
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75D5168E5E176C24981B4E5DBD991078
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EDC790504E1834DBC20C9A04328FD2
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8724E58E6C7D00C48A0D4F3345EB2C26
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7F556BF224D804D96A96F0F6344789
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB676B0E1B9EFA049B9F7DDDA9645734
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B31BBB0B825EDEF45AB0FE7099C68C81
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B471D8D7319336B4CA89374ED0D7B806
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC30043663AA2CA4DA1DAA9CA5FDCC75
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE21F3FD57B244142880EF15A165A156
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F754C503375A13344B22388E18DFE87E
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FDC83385E6C239F4C876A77A37DF581D
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9DDEB3D0FB4C0404EB99D88A722F567A
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B2FD9C0A5B9838449838816A28001F4B
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\Installer\Features\9DDEB3D0FB4C0404EB99D88A722F567A
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\Installer\Features\B2FD9C0A5B9838449838816A28001F4B
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\Installer\Products\9DDEB3D0FB4C0404EB99D88A722F567A
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\Installer\Products\B2FD9C0A5B9838449838816A28001F4B
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
Klíč nalezen: [x64] HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
Klíč nalezen: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
Data nalezena: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://home.sweetim.com/?barid={18652D22-9F7C-11E2-8AB0-F0DEF1837B48}&UPN2=110838710987220582
Data nalezena: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\Microsoft\Internet Explorer\Main [Secondary Start Pages] - hxxp://www.search.ask.com/?tpid=ORJ-V7-SAT&o=A ... 5EBE7%5EOS
Data nalezena: HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://home.sweetim.com/?barid={18652D22-9F7C-11E2-8AB0-F0DEF1837B48}&UPN2=1108387109872205823&src=10&&st=23&did=10963&ptr=100
Data nalezena: HKCU\Software\Microsoft\Internet Explorer\Main [Secondary Start Pages] - hxxp://www.search.ask.com/?tpid=ORJ-V7-SAT&o=A ... &apn_dtid=
Data nalezena: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://home.sweetim.com/?barid={18652D22-9F7C-11E2-8AB0-F0DEF1837B48}&UPN2=1108387109872205823&src=10&&st=23&did=10963&ptr=100
Data nalezena: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Secondary Start Pages] - hxxp://www.search.ask.com/?tpid=ORJ-V7-SAT&o=A ... E7&apn_dti
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{2BC29D19-9F4F-46AF-8BA0-2C22992966F3}
Klíč nalezen: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Data nalezena: HKU\S-1-5-21-1719941174-560027120-3640491002-1000\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] -
Klíč nalezen: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Klíč nalezen: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2BC29D19-9F4F-46AF-8BA0-2C22992966F3}
Klíč nalezen: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Data nalezena: HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] -
Klíč nalezen: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Klíč nalezen: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2BC29D19-9F4F-46AF-8BA0-2C22992966F3}
Klíč nalezen: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Data nalezena: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] -
Klíč nalezen: HKLM\SOFTWARE\Google\Chrome\Extensions\nbmafkdmkkckhggblphicnnhlgljnoje
Klíč nalezen: HKLM\SOFTWARE\Google\Chrome\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk
Klíč nalezen: HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd
Klíč nalezen: [x64] HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd


***** [ Internetové prohlížeče ] *****

Nebyly nalezeny žádné škodlivé položky prohlížeče Firefox báze.
Chromium nastavení nalezeno: [C:\Users\Martina\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences ] - bopakagnckmlgajfccecajhnimjiiedh
Chromium nastavení nalezeno: [C:\Users\Martina\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences ] - fcfenmboojpjinhpgggodefccipikbpd
Chromium nastavení nalezeno: [C:\Users\Martina\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences ] - pfmopbbadnfoelckkcmjjeaaegjpjjbk

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [23748 Bajtů] - [01/11/2016 19:14:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [23823 Bajtů] ##########

Re: ransomware .thor

Napsal: 01 lis 2016 20:31
od Rudy
Děkuji za poklonu. :) Neklikl jste ale na mazání, ADW nemazal. Zkuste to ještě jednou.

Re: ransomware .thor

Napsal: 01 lis 2016 21:12
od dorban
Na mazání jsem kliknul, ale poté se počítač restartoval. Vzal jsem jediný log, který po restartu byl (a to byl asi jen po scanu)

Takže jsem spustil AdwCleaner znovu a to už nenašel nic. Log z druhého scanu přikládám.

# AdwCleaner v6.030 - Log soubor vytvořen 01/11/2016 na 21:08:44
# Aktualizováno dne 19/10/2016 z Malwarebytes
# Databáze : 2016-11-01.2 [Server]
# Operační systém : Windows 7 Professional Service Pack 1 (X64)
# Uživatelské jméno : Martina - SONEK2-PC
# Beží od : C:\Users\Martina\Desktop\adwcleaner_6.030.exe
# Mod: Skenování
# Podpora : https://www.malwarebytes.com/support



***** [ Služby ] *****

Nebyly nalezeny žádné škodlivé služby.


***** [ Adresáře ] *****

Nebyly nalezeny žádné škodlivé složky.


***** [ Soubory ] *****

Nebyly nalezeny žádné škodlivé soubory.


***** [ DLL ] *****

Nebyly nalezeny žádné škodlivé DLL soubory.


***** [ WMI ] *****

Nebyly nalezeny žádné škodlivé klíče.


***** [ Zástupce ] *****

Žádné infikovaný zástupce nenalezen.


***** [ Plánovač úloh ] *****

Žádný nebezpečná úloha nenalezena.


***** [ Registry ] *****

Nebyly nalezeny žádné škodlivé položky registru.


***** [ Internetové prohlížeče ] *****

Nebyly nalezeny žádné škodlivé položky prohlížeče Firefox báze.
Nebyly nalezeny žádné škodlivé položky prohlížeče Chromium báze.

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [25157 Bajtů] - [01/11/2016 19:16:38]
C:\AdwCleaner\AdwCleaner[S0].txt - [24288 Bajtů] - [01/11/2016 19:14:24]
C:\AdwCleaner\AdwCleaner[S1].txt - [1412 Bajtů] - [01/11/2016 21:08:44]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1486 Bajtů] ##########

Re: ransomware .thor

Napsal: 01 lis 2016 21:32
od Rudy
OK. Teď dejte nový log FRST.

Re: ransomware .thor

Napsal: 01 lis 2016 22:11
od dorban
Log přikládám v příloze, opět se nevejde (jsou tam všechny zašifrované soubory)

Re: ransomware .thor

Napsal: 01 lis 2016 22:12
od dorban
a ještě addition

Re: ransomware .thor

Napsal: 01 lis 2016 22:31
od Rudy
Otevřte poznámkový blok a zkopírujte do něj:
Start
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {42dcbefe-a001-11e1-aa32-f0def1837b48} - E:\Autorun.exe
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {96f9a79c-d54c-11e1-889b-f0def1837b48} - E:\iStudio.exe
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {af770ee6-99ae-11e1-a87f-f0def1837b48} - E:\Autorun.exe
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {af770f00-99ae-11e1-a87f-f0def1837b48} - E:\Autorun.exe
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {b3c22b0b-9a85-11e1-a861-f0def1837b48} - E:\Autorun.exe
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {fc465afd-fca8-11e1-a56b-f0def1837b48} - E:\Autorun.exe
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKU\S-1-5-21-1719941174-560027120-3640491002-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1719941174-560027120-3640491002-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1719941174-560027120-3640491002-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97 ... -SearchBox
SearchScopes: HKU\S-1-5-21-1719941174-560027120-3640491002-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-1719941174-560027120-3640491002-1000 -> {C6AED432-1793-4C49-BE3F-514649DEE879} URL = hxxp://www.google.com/search?sourceid=ie7&q=
BHO: No Name -> {4F524A2D-5637-006A-76A7-7A786E7484D7} -> No File
BHO: No Name -> {4F524A2D-5637-2D53-4154-7A786E7484D7} -> No File
U3 BcmSqlStartupSvc; no ImagePath
U2 CLKMSVC10_3A60B698; no ImagePath
U2 CLKMSVC10_C3B3B687; no ImagePath
U2 DriverService; no ImagePath
U2 IAStorDataMgrSvc; no ImagePath
U2 iATAgentService; no ImagePath
U2 idealife Update Service; no ImagePath
U3 IGRS; no ImagePath
U2 IviRegMgr; no ImagePath
U2 nvUpdatusService; no ImagePath
U2 Oasis2Service; no ImagePath
U2 PCCarerService; no ImagePath
U2 ReadyComm.DirectRouter; no ImagePath
U2 RichVideo; no ImagePath
U2 RtLedService; no ImagePath
U2 SeaPort; no ImagePath
U2 SoftwareService; no ImagePath
U3 SQLWriter; no ImagePath
U2 Stereo Service; no ImagePath
C:\windows\Tasks\GoogleUpdateTaskMachineCore1d1e95612db9067.job
C:\windows\Tasks\GoogleUpdateTaskMachineUA1d1e956136c85d5.job
C:\Program Files (x86)\GUTF400.tmp
C:\Users\Martina\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {7D111E63-A977-447E-8912-FE21666EC183} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {D07EB46A-D5B8-4B5D-BFB6-A012BAA8ADAE} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION
End
Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Z logu:
Velikost slozky "C:\Users\Martina\Desktop" je 49079 MB.
To je příliš mnoho a může to způsobovat zpomalení startu systému. Vytvořte v C:\Users\Martina novou složku, do které přesuňte všechna data z plochy (kromě zástupců). Na plochu si pak dejte zástupce té složky pro snazší přístup.

Soubory jsem viděl, budete se ale muset informovat u kolegů, zda na tento typ ransomware existuje dešifrovací klíč.

Re: ransomware .thor

Napsal: 01 lis 2016 22:56
od dorban
Ohledně velikosti plochy - na to, že toto jste nehledal, tak máte dobrý postřeh. Děkuji za tip.

Fix result of Farbar Recovery Scan Tool (x64) Version: 30-10-2016
Ran by Martina (01-11-2016 22:52:27) Run:1
Running from C:\Users\Martina\Desktop
Loaded Profiles: Martina (Available Profiles: Martina)
Boot Mode: Safe Mode (with Networking)
==============================================

fixlist content:
*****************
Start
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {42dcbefe-a001-11e1-aa32-f0def1837b48} - E:\Autorun.exe
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {96f9a79c-d54c-11e1-889b-f0def1837b48} - E:\iStudio.exe
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {af770ee6-99ae-11e1-a87f-f0def1837b48} - E:\Autorun.exe
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {af770f00-99ae-11e1-a87f-f0def1837b48} - E:\Autorun.exe
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {b3c22b0b-9a85-11e1-a861-f0def1837b48} - E:\Autorun.exe
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\...\MountPoints2: {fc465afd-fca8-11e1-a56b-f0def1837b48} - E:\Autorun.exe
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKU\S-1-5-21-1719941174-560027120-3640491002-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1719941174-560027120-3640491002-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1719941174-560027120-3640491002-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97 ... -SearchBox
SearchScopes: HKU\S-1-5-21-1719941174-560027120-3640491002-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-1719941174-560027120-3640491002-1000 -> {C6AED432-1793-4C49-BE3F-514649DEE879} URL = hxxp://www.google.com/search?sourceid=ie7&q=
BHO: No Name -> {4F524A2D-5637-006A-76A7-7A786E7484D7} -> No File
BHO: No Name -> {4F524A2D-5637-2D53-4154-7A786E7484D7} -> No File
U3 BcmSqlStartupSvc; no ImagePath
U2 CLKMSVC10_3A60B698; no ImagePath
U2 CLKMSVC10_C3B3B687; no ImagePath
U2 DriverService; no ImagePath
U2 IAStorDataMgrSvc; no ImagePath
U2 iATAgentService; no ImagePath
U2 idealife Update Service; no ImagePath
U3 IGRS; no ImagePath
U2 IviRegMgr; no ImagePath
U2 nvUpdatusService; no ImagePath
U2 Oasis2Service; no ImagePath
U2 PCCarerService; no ImagePath
U2 ReadyComm.DirectRouter; no ImagePath
U2 RichVideo; no ImagePath
U2 RtLedService; no ImagePath
U2 SeaPort; no ImagePath
U2 SoftwareService; no ImagePath
U3 SQLWriter; no ImagePath
U2 Stereo Service; no ImagePath
C:\windows\Tasks\GoogleUpdateTaskMachineCore1d1e95612db9067.job
C:\windows\Tasks\GoogleUpdateTaskMachineUA1d1e956136c85d5.job
C:\Program Files (x86)\GUTF400.tmp
C:\Users\Martina\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {7D111E63-A977-447E-8912-FE21666EC183} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {D07EB46A-D5B8-4B5D-BFB6-A012BAA8ADAE} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION
End
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
"HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{42dcbefe-a001-11e1-aa32-f0def1837b48}" => key removed successfully
HKCR\CLSID\{42dcbefe-a001-11e1-aa32-f0def1837b48} => key not found.
"HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{96f9a79c-d54c-11e1-889b-f0def1837b48}" => key removed successfully
HKCR\CLSID\{96f9a79c-d54c-11e1-889b-f0def1837b48} => key not found.
"HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af770ee6-99ae-11e1-a87f-f0def1837b48}" => key removed successfully
HKCR\CLSID\{af770ee6-99ae-11e1-a87f-f0def1837b48} => key not found.
"HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af770f00-99ae-11e1-a87f-f0def1837b48}" => key removed successfully
HKCR\CLSID\{af770f00-99ae-11e1-a87f-f0def1837b48} => key not found.
"HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3c22b0b-9a85-11e1-a861-f0def1837b48}" => key removed successfully
HKCR\CLSID\{b3c22b0b-9a85-11e1-a861-f0def1837b48} => key not found.
"HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fc465afd-fca8-11e1-a56b-f0def1837b48}" => key removed successfully
HKCR\CLSID\{fc465afd-fca8-11e1-a56b-f0def1837b48} => key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
"HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}" => key removed successfully
HKCR\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} => key not found.
"HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => key removed successfully
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => key not found.
"HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C6AED432-1793-4C49-BE3F-514649DEE879}" => key removed successfully
HKCR\CLSID\{C6AED432-1793-4C49-BE3F-514649DEE879} => key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4F524A2D-5637-006A-76A7-7A786E7484D7}" => key removed successfully
HKCR\CLSID\{4F524A2D-5637-006A-76A7-7A786E7484D7} => key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4F524A2D-5637-2D53-4154-7A786E7484D7}" => key removed successfully
HKCR\CLSID\{4F524A2D-5637-2D53-4154-7A786E7484D7} => key not found.
BcmSqlStartupSvc => service removed successfully
CLKMSVC10_3A60B698 => service removed successfully
CLKMSVC10_C3B3B687 => service removed successfully
DriverService => service removed successfully
IAStorDataMgrSvc => service removed successfully
iATAgentService => service removed successfully
idealife Update Service => service removed successfully
IGRS => service removed successfully
IviRegMgr => service removed successfully
nvUpdatusService => service removed successfully
Oasis2Service => service removed successfully
PCCarerService => service removed successfully
ReadyComm.DirectRouter => service removed successfully
RichVideo => service removed successfully
RtLedService => service removed successfully
SeaPort => service removed successfully
SoftwareService => service removed successfully
SQLWriter => service removed successfully
Stereo Service => service removed successfully
C:\windows\Tasks\GoogleUpdateTaskMachineCore1d1e95612db9067.job => moved successfully
C:\windows\Tasks\GoogleUpdateTaskMachineUA1d1e956136c85d5.job => moved successfully
C:\Program Files (x86)\GUTF400.tmp => moved successfully
C:\Users\Martina\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsBackup\ConfigNotification" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7D111E63-A977-447E-8912-FE21666EC183}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7D111E63-A977-447E-8912-FE21666EC183}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AC4E5ACF-89F7-4220-BA21-81EE183975E2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AC4E5ACF-89F7-4220-BA21-81EE183975E2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Application Experience\AitAgent" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CEE64558-E1A7-4D9D-80A7-2001912BE5B5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CEE64558-E1A7-4D9D-80A7-2001912BE5B5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MemoryDiagnostic\CorruptionDetector" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D07EB46A-D5B8-4B5D-BFB6-A012BAA8ADAE}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D07EB46A-D5B8-4B5D-BFB6-A012BAA8ADAE}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Activation Technologies\ValidationTask" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FA2BC0A6-8D4B-458A-85C8-2B8C72487513}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA2BC0A6-8D4B-458A-85C8-2B8C72487513}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector" => key removed successfully

==== End of Fixlog 22:52:28 ====

Re: ransomware .thor

Napsal: 02 lis 2016 18:25
od Rudy
Tak bylo to uveden v logu a to nelze přehlédnout. :) Vše bylo smazáno. Pro jistotu udělejte ještě kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Re: ransomware .thor

Napsal: 03 lis 2016 07:53
od dorban
Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 3.11.2016
Čas skenování: 7:01
Protokol: log malvarebytes.txt
Správce: Ano

Verze: 2.2.1.1043
Databáze malwaru: v2016.11.03.04
Databáze rootkitů: v2016.10.31.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: Martina

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 331570
Uplynulý čas: 41 min, 54 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 1
PUP.Optional.ASK, HKU\S-1-5-21-1719941174-560027120-3640491002-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{4F524A2D-5637-2D53-4154-7A786E7484D7}, , [77690eade9b15fd7c89873238b776997],

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

Re: ransomware .thor

Napsal: 03 lis 2016 17:57
od Rudy
Položku smažte a tím by měl být PC čistý.

Re: ransomware .thor

Napsal: 03 lis 2016 18:54
od dorban
Děkuji. Trošku to kazí fakt, že ač počítač včera fungoval, dnes jde nastartovat jen v nouzovém režimu. Zvažuju, jestli risknout spuštění "poslední známá funkční konfigurace (pokročilé)". Tj. jaká je pravděpodobnost, že by se systém vrátil do zavirovaného stavu. Co myslíte?

Podotýkám, že body obnovení jaksi nejsou (jestli je vypnul ten malware, nebo nebyly nastaveny to nevím)
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz