Расшифровка файлов

[Стенсансан]

Помогите пожалуйста расшифровать файлы ,которые зашифровались в следствии проникновения вируса.

[Info_bot]

Уважаемый(ая) Стенсансан, спасибо за обращение на наш форум!

Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в правилах оформления запроса о помощи.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

[thyrex]

Выполните скрипт в AVZ

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
QuarantineFile('C:\Users\Станислав\AppData\Roaming\XASSLL.exe','');
 QuarantineFile('C:\Users\Станислав\AppData\Roaming\WUTHPZ.exe','');
 QuarantineFile('C:\Users\Станислав\AppData\Roaming\RYNX.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-6.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-7.exe','');
 QuarantineFile('C:\Program Files\ver0BlockAndSurf\J4BlockAndSurfJ52.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-5.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-3.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-11.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-1-6.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-1-7.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-10.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-7.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-6.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-5.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-3.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-11.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-10.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-1-7.exe','');
 QuarantineFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-1-6.exe','');
 QuarantineFile('C:\Program Files\CinemaPlus12bV17.03\29955a1d-dad0-40f2-a840-3b123e78e959-3.exe','');
 QuarantineFile('C:\Program Files\CinemaPlus12bV17.03\29955a1d-dad0-40f2-a840-3b123e78e959-11.exe','');
 QuarantineFile('C:\Program Files\CinemaPlus12bV17.03\29955a1d-dad0-40f2-a840-3b123e78e959-10.exe','');
 DelBHO('{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}');
 DelBHO('{3573F849-E5CB-5D5D-3B05-D782B26FD0A9}');
 QuarantineFile('C:\Program Files\ver0BlockAndSurf\190.dll','');
 QuarantineFile('C:\Users\Станислав\AppData\Roaming\Browsers\exe.resworb.bat','');
 QuarantineFile('C:\Users\Станислав\AppData\Roaming\Browsers\exe.erolpxei.bat','');
 QuarantineFile('C:\Users\Станислав\AppData\Roaming\Browsers\exe.emorhc.bat','');
 QuarantineFile('C:\Users\Станислав\AppData\Local\SmartWeb\SmartWebHelper.exe','');
 QuarantineFile('C:\Users\Станислав\AppData\Local\6FBC7600-1426596031-81E1-3454-5404A6337A6B\bnsq9F8F.exe','');
 QuarantineFile('C:\Windows\system32\drivers\qrnfd_1_10_0_9.sys','');
 DeleteService('TS888');
 DeleteService('qrnfd_1_10_0_9');
 DeleteService('QMUdisk');
 DeleteService('silykubo');
 DeleteService('hyjigyby');
 SetServiceStart('IHProtect Service', 4);
 DeleteService('IHProtect Service');
 SetServiceStart('hycetuje', 4);
 DeleteService('hycetuje');
 QuarantineFile('C:\Program Files\XTab\SupTab.dll','');
 TerminateProcessByName('c:\users\Станислав\appdata\roaming\6fbc7600-1426585054-81e1-3454-5404a6337a6b\vnsza22.tmp');
 QuarantineFile('c:\users\Станислав\appdata\roaming\6fbc7600-1426585054-81e1-3454-5404a6337a6b\vnsza22.tmp','');
 TerminateProcessByName('c:\program files\xtab\protectservice.exe');
 QuarantineFile('c:\program files\xtab\protectservice.exe','');
 TerminateProcessByName('c:\users\Станислав\appdata\roaming\6fbc7600-1426585054-81e1-3454-5404a6337a6b\nse9151.tmp');
 QuarantineFile('c:\users\Станислав\appdata\roaming\6fbc7600-1426585054-81e1-3454-5404a6337a6b\nse9151.tmp','');
 TerminateProcessByName('c:\users\Станислав\appdata\roaming\6fbc7600-1426585054-81e1-3454-5404a6337a6b\jnsf120c.tmp');
 QuarantineFile('c:\users\Станислав\appdata\roaming\6fbc7600-1426585054-81e1-3454-5404a6337a6b\jnsf120c.tmp','');
 TerminateProcessByName('c:\users\Станислав\appdata\local\amigo\application\amigo.exe');
 DeleteFile('c:\users\Станислав\appdata\local\amigo\application\amigo.exe','32');
 DeleteFile('c:\users\Станислав\appdata\roaming\6fbc7600-1426585054-81e1-3454-5404a6337a6b\jnsf120c.tmp','32');
 DeleteFile('c:\users\Станислав\appdata\roaming\6fbc7600-1426585054-81e1-3454-5404a6337a6b\nse9151.tmp','32');
 DeleteFile('c:\program files\xtab\protectservice.exe','32');
 DeleteFile('c:\users\Станислав\appdata\roaming\6fbc7600-1426585054-81e1-3454-5404a6337a6b\vnsza22.tmp','32');
 DeleteFile('C:\Program Files\XTab\SupTab.dll','32');
 DeleteFile('C:\Users\2E78~1\AppData\Local\Temp\nsqD98D.tmp\IpConfig.dll','32');
 DeleteFile('C:\Users\Станислав\AppData\Local\Amigo\Application\32.0.1709.125\chrome.dll','32');
 DeleteFile('C:\Users\Станислав\AppData\Local\Amigo\Application\32.0.1709.125\chrome_child.dll','32');
 DeleteFile('C:\Users\Станислав\AppData\Local\Amigo\Application\32.0.1709.125\D3DCompiler_46.dll','32');
 DeleteFile('C:\Users\Станислав\AppData\Local\Amigo\Application\32.0.1709.125\ffmpegsumo.dll','32');
 DeleteFile('C:\Users\Станислав\AppData\Local\Amigo\Application\32.0.1709.125\icudt.dll','32');
 DeleteFile('C:\Users\Станислав\AppData\Local\Amigo\Application\32.0.1709.125\libegl.dll','32');
 DeleteFile('C:\Users\Станислав\AppData\Local\Amigo\Application\32.0.1709.125\libglesv2.dll','32');
 DeleteFile('C:\Users\Станислав\AppData\Local\Amigo\Application\32.0.1709.125\ppGoogleNaClPluginChrome.dll','32');
 DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.7.16065.215\QMUdisk.sys','32');
 DeleteFile('C:\Windows\system32\drivers\qrnfd_1_10_0_9.sys','32');
 DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.7.16065.215\TS888.sys','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','WinCheck');
 DeleteFile('C:\Users\Станислав\AppData\Local\6FBC7600-1426596031-81E1-3454-5404A6337A6B\bnsq9F8F.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','amigo');
 DeleteFile('C:\Users\Станислав\AppData\Local\SmartWeb\SmartWebHelper.exe','32');
 DeleteFile('C:\Users\Станислав\AppData\Roaming\Browsers\exe.emorhc.bat','32');
 DeleteFile('C:\Users\Станислав\AppData\Roaming\Browsers\exe.erolpxei.bat','32');
 DeleteFile('C:\Users\Станислав\AppData\Roaming\Browsers\exe.resworb.bat','32');
 DeleteFile('C:\Program Files\ver0BlockAndSurf\190.dll','32');
 DeleteFile('C:\Program Files\CinemaPlus12bV17.03\29955a1d-dad0-40f2-a840-3b123e78e959-10.exe','32');
 DeleteFile('C:\Program Files\CinemaPlus12bV17.03\29955a1d-dad0-40f2-a840-3b123e78e959-11.exe','32');
 DeleteFile('C:\Program Files\CinemaPlus12bV17.03\29955a1d-dad0-40f2-a840-3b123e78e959-3.exe','32');
 DeleteFile('C:\Windows\Tasks\29955a1d-dad0-40f2-a840-3b123e78e959-3.job','32');
 DeleteFile('C:\Windows\Tasks\29955a1d-dad0-40f2-a840-3b123e78e959-11.job','32');
 DeleteFile('C:\Windows\Tasks\29955a1d-dad0-40f2-a840-3b123e78e959-10_user.job','32');
 DeleteFile('C:\Windows\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-1-6.job','32');
 DeleteFile('C:\Windows\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-1-7.job','32');
 DeleteFile('C:\Windows\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-10_user.job','32');
 DeleteFile('C:\Windows\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-11.job','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-1-6.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-1-7.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-10.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-11.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-3.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-5.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-6.exe','32');
 DeleteFile('C:\Windows\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-3.job','32');
 DeleteFile('C:\Windows\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-5.job','32');
 DeleteFile('C:\Windows\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-5_user.job','32');
 DeleteFile('C:\Windows\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-6.job','32');
 DeleteFile('C:\Windows\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-7.job','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV24.03\6a1342ee-b38d-4d50-a2aa-31d99af81a13-7.exe','32');
 DeleteFile('C:\Program Files\AnyProtectEx\AnyProtect.exe','32');
 DeleteFile('C:\Windows\Tasks\APSnotifierPP1.job','32');
 DeleteFile('C:\Windows\Tasks\APSnotifierPP2.job','32');
 DeleteFile('C:\Windows\Tasks\APSnotifierPP3.job','32');
 DeleteFile('C:\Windows\Tasks\b200321a-3845-42bf-9257-929d1fd12462-1-6.job','32');
 DeleteFile('C:\Windows\Tasks\b200321a-3845-42bf-9257-929d1fd12462-10_user.job','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-10.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-1-7.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-1-6.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-11.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-3.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-5.exe','32');
 DeleteFile('C:\Windows\Tasks\b200321a-3845-42bf-9257-929d1fd12462-11.job','32');
 DeleteFile('C:\Windows\Tasks\b200321a-3845-42bf-9257-929d1fd12462-3.job','32');
 DeleteFile('C:\Windows\Tasks\b200321a-3845-42bf-9257-929d1fd12462-5.job','32');
 DeleteFile('C:\Windows\Tasks\b200321a-3845-42bf-9257-929d1fd12462-5_user.job','32');
 DeleteFile('C:\Windows\Tasks\b200321a-3845-42bf-9257-929d1fd12462-6.job','32');
 DeleteFile('C:\Windows\Tasks\b200321a-3845-42bf-9257-929d1fd12462-7.job','32');
 DeleteFile('C:\Windows\Tasks\BlockAndSurf Update.job','32');
 DeleteFile('C:\Program Files\ver0BlockAndSurf\J4BlockAndSurfJ52.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-7.exe','32');
 DeleteFile('C:\Program Files\Cinema Plus Pro 3.2cV25.03\b200321a-3845-42bf-9257-929d1fd12462-6.exe','32');
 DeleteFile('C:\Users\Станислав\AppData\Roaming\RYNX.exe,'32');
 DeleteFile('C:\Users\Станислав\AppData\Roaming\WUTHPZ.exe','32');
 DeleteFile('C:\Users\Станислав\AppData\Roaming\XASSLL.exe','32');
 DeleteFile('C:\Windows\Tasks\RYNX.job','32');
 DeleteFile('C:\Windows\Tasks\WUTHPZ.job','32');
 DeleteFile('C:\Windows\Tasks\XASSLL.job','32');
 DeleteFile('C:\Windows\system32\Tasks\29955a1d-dad0-40f2-a840-3b123e78e959-11','32');
 DeleteFile('C:\Windows\system32\Tasks\29955a1d-dad0-40f2-a840-3b123e78e959-3','32');
 DeleteFile('C:\Windows\system32\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-1-6','32');
 DeleteFile('C:\Windows\system32\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-1-7','32');
 DeleteFile('C:\Windows\system32\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-11','32');
 DeleteFile('C:\Windows\system32\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-3','32');
 DeleteFile('C:\Windows\system32\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-5','32');
 DeleteFile('C:\Windows\system32\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-6','32');
 DeleteFile('C:\Windows\system32\Tasks\6a1342ee-b38d-4d50-a2aa-31d99af81a13-7','32');
 DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP1','32');
 DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP2','32');
 DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP3','32');
 DeleteFile('C:\Windows\system32\Tasks\b200321a-3845-42bf-9257-929d1fd12462-1-6','32');
 DeleteFile('C:\Windows\system32\Tasks\b200321a-3845-42bf-9257-929d1fd12462-1-7','32');
 DeleteFile('C:\Windows\system32\Tasks\b200321a-3845-42bf-9257-929d1fd12462-11','32');
 DeleteFile('C:\Windows\system32\Tasks\b200321a-3845-42bf-9257-929d1fd12462-3','32');
 DeleteFile('C:\Windows\system32\Tasks\b200321a-3845-42bf-9257-929d1fd12462-5','32');
 DeleteFile('C:\Windows\system32\Tasks\b200321a-3845-42bf-9257-929d1fd12462-6','32');
 DeleteFile('C:\Windows\system32\Tasks\b200321a-3845-42bf-9257-929d1fd12462-7','32');
 DeleteFile('C:\Windows\system32\Tasks\BlockAndSurf Update','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(15);
RebootWindows(false);
end.

Компьютер перезагрузится.

Пришлите карантин согласно Приложения 2 правил по красной ссылке Прислать запрошенный карантин над первым сообщением темы.

Обновите базы AVZ

Сделайте новые логи по правилам

Сделайте лог Check Browsers' LNK