Шифровальщик файлов [email protected] или [email protected] .XTBL

[wildrk]

Ваши файлы были зашифрованы.
Чтобы расшифровать их, Вам необходимо отправить код:
49849A00EACA94725CAD|0
на электронный адрес [email protected] или [email protected] .
Далее вы получите все необходимые инструкции.
Попытки расшифровать самостоятельно не приведут ни к чему, кроме безвозвратной потери информации.




All the important files on your computer were encrypted.
To decrypt the files you should send the following code:
49849A00EACA94725CAD|0
to e-mail address [email protected] or [email protected] .
Then you will receive all necessary instructions.
All the attempts of decryption by yourself will result only in irrevocable loss of your data.

- - - - -Добавлено - - - - -

Вот
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 18:30:19, on 19.02.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17126)


Boot mode: Normal

Running processes:
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\38.0.2125.10034\crash_service.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\AppData\Local\Yandex\YandexBrowser\A pplication\browser.exe
C:\Users\Иван\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://yamdex.net/?searchid=1&l10n=ru&fromsearch=1&imsid=75f4a1c956b 412b6f9ae825fae999e19&text={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://yamdex.net/?searchid=1&l10n=ru&fromsearch=1&imsid=75f4a1c956b 412b6f9ae825fae999e19&text={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.gboxapp.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.gboxapp.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://yamdex.net/?searchid=1&l10n=ru&fromsearch=1&imsid=75f4a1c956b 412b6f9ae825fae999e19&text=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://yamdex.net/?searchid=1&l10n=ru&fromsearch=1&imsid=75f4a1c956b 412b6f9ae825fae999e19&text=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {0633EE93-D776-472f-A0FF-E1416B8B2E3D} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: shoipndroP - {0ba06c4a-6361-4ad3-8108-5699c8a5a53d} - C:\ProgramData\shoipndroP\Rx6K2x5ogM9XqE.dll
O2 - BHO: daOOwnlOadIatkeep - {18cb3e8c-28b6-4c4a-b193-4335226d2040} - C:\ProgramData\daOOwnlOadIatkeep\CkE23VxvPhrdNR.dl l
O2 - BHO: tperfectcoupon - {7a0577e6-a9b9-47d3-9840-9e9e68b71a7a} - C:\ProgramData\tperfectcoupon\oJm3fFP4pVgmok.dll
O2 - BHO: CoolSaleCoupon - {9d790bd4-4e2d-43bc-9793-4f838f638b5a} - C:\ProgramData\CoolSaleCoupon\o8pVmD8PobgHzv.dll
O2 - BHO: coupOnpeeak - {9e13fdba-587d-4abb-be32-0912fae0178d} - C:\Program Files (x86)\coupOnpeeak\xuWY9RkLdk348v.dll
O2 - BHO: Визуальные закладки - {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} - C:\Program Files (x86)\Yandex\FastDial\fastdialhost.dll
O2 - BHO: CoupScAnnNer - {efaab935-2cde-4dfa-80ba-246f730b2325} - C:\ProgramData\CoupScAnnNer\RjIMIYNieAeMO2.dll
O3 - Toolbar: Элементы Яндекса - {91397D20-1446-11D4-8AF4-0040CA1127B6} - C:\Program Files (x86)\Yandex\Elements\bartabhost.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe] C:\Program Files\Java\Adobe Acrobat Update Service.exe
O4 - HKCU\..\Run: [Inbox Storage] "C:\Program Files (x86)\Inbox Storage\InboxStorage.exe" /STARTUP
O4 - HKCU\..\Run: [My Logon Manager] "C:\Program Files (x86)\My Logon Manager\MLMan.exe" /STARTUP
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O13 - DefaultPrefix: http://yamdex.net/?searchid=1&l10n=ru&fromsearch=1&imsid=75f4a1c956b 412b6f9ae825fae999e19&text=
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\progra~3\intere~1\intere~1.dll
O23 - Service: Adguard Service - Performix LLC - C:\Program Files (x86)\Adguard\AdguardSvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AntiWinLocker - Unknown owner - C:\Program Files (x86)\AntiWinLocker\ServiceAntiWinLocker.exe
O23 - Service: CodeMeter Runtime Server (CodeMeter.exe) - WIBU-SYSTEMS AG - C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
O23 - Service: Disc Soft Bus Service - Disc Soft Ltd - C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Служба Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Служба Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files (x86)\Origin\OriginClientService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: CA Service component (serverca) - Unknown owner - C:\Users\Иван\AppData\Local\ConvertAd\CASrv.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Spyware Terminator 2015 Realtime Shield Service (ST2012_Svc) - Crawler Group - C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9089 bytes

[Info_bot]

Уважаемый(ая) wildrk, спасибо за обращение на наш форум!

Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в правилах оформления запроса о помощи.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

[thyrex]

http://virusinfo.info/showthread.php?t=121951