Ransomware RSA-4096 (TeslaCrypt -!RecOveR!-) Fermé

Question

bonjour, Mon pc est infecté par ransomware et je ne sais pas ce qu'il faut faire pour récupérer les données et si c'est possible. Pouvez-vous m'aider ? Je ne sais pas si cela pourra vous aider mais j'ajoute ci-dessous les différents messages s'ouvrant sur mon PC. Merci d'avance pour vos réponses, Cordialement, Mumu NOT YOUR LANGUAGE? USE https://translate.google.com$ >>/#=+=."%,;,!(3:+*5;9*,=#7(: ------- $ >>/#=+=."%,;,!(3:+*5;9*,=#7(:What's the matter with your files?Your data was secured using a strong encryption with RSA-4096.Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means?$ >>/#=+=."%,;,!(3:+*5;9*,=#7(: ------- $ >>/#=+=."%,;,!(3:+*5;9*,=#7(:It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore .In other words they are useless , however , there is possibility to restore them with our help .$ >>/#=+=."%,;,!(3:+*5;9*,=#7(: ----- $ >>/#=+=."%,;,!(3:+*5;9*,=#7(:What exactly happened to your files ???!!! Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private.!!! All your data and files were encrypted by the means of the public key , which you received over the web .!!! In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers.!!! What should you do next ???$ >>/#=+=."%,;,!(3:+*5;9*,=#7(: ----- $ >>/#=+=."%,;,!(3:+*5;9*,=#7(:In case you have valuable files , we advise you to act fast as there is no other option ratherthan paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below :http://u24er.ovaarmor.com/EFD56F52E36DDCE4http://l123d.feustude.at/EFD56F52E36DDCE4http://k234s.ascotsprue.com/EFD56F52E36DDCE4$ >>/#=+=."%,;,!(3:+*5;9*,=#7(: ----- $ >>/#=+=."%,;,!(3:+*5;9*,=#7(:If you can't access your personal homepage or the addresses are not working, complete the following steps: Download and Install TOR Browser - https://www.torproject.org/download/*** Navigate yyhn7fpvq44cqcu3.onion/EFD56F52E36DDCE4$ >>/#=+=."%,;,!(3:+*5;9*,=#7(:----IMPORTANT INFORMATION---------$ >>/#=+=."%,;,!(3:+*5;9*,=#7(:Your personal homepages http://u24er.ovaarmor.com/EFD56F52E36DDCE4http://l123d.feustude.at/EFD56F52E36DDCE4http://k234s.ascotsprue.com/EFD56F52E36DDCE4 Your personal homepage Tor-Browser yyhn7fpvq44cqcu3.onion/EFD56F52E36DDCE4Your personal ID EFD56F52E36DDCE4$ >>/#=+=."%,;,!(3:+*5;9*,=#7(: ----- $ >>/#=+=."%,;,!(3:+*5;9*,=#7(:------------------------------------------------------------------------------------------------------------------------NOT YOUR LANGUAGE? USE https://translate.google.com*15)$49!2'(18017/#<"96,(.:+ +)- ------- *15)$49!2'(18017/#<"96,(.:+ +)-What's the matter with your files?Your data was secured using a strong encryption with RSA-4096.Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means?*15)$49!2'(18017/#<"96,(.:+ +)- ------- *15)$49!2'(18017/#<"96,(.:+ +)-It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore .In other words they are useless , however , there is possibility to restore them with our help .*15)$49!2'(18017/#<"96,(.:+ +)- ----- *15)$49!2'(18017/#<"96,(.:+ +)-What exactly happened to your files ???!!! Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private.!!! All your data and files were encrypted by the means of the public key , which you received over the web .!!! In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers.!!! What should you do next ???NOT YOUR LANGUAGE? USE https://translate.google.com. 399-?7,#$&6*=")?4(;>>'4;=1%6# ------- . 399-?7,#$&6*=")?4(;>>'4;=1%6#What's the matter with your files?Your data was secured using a strong encryption with RSA-4096.Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means?. 399-?7,#$&6*=")?4(;>>'4;=1%6# ------- . 399-?7,#$&6*=")?4(;>>'4;=1%6#It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore .In other words they are useless , however , there is possibility to restore them with our help .. 399-?7,#$&6*=")?4(;>>'4;=1%6# ----- . 399-?7,#$&6*=")?4(;>>'4;=1%6#What exactly happened to your files ???!!! Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private.!!! All your data and files were encrypted by the means of the public key , which you received over the web .!!! In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers.!!! What should you do next ???. 399-?7,#$&6*=")?4(;>>'4;=1%6# ----- . 399-?7,#$&6*=")?4(;>>'4;=1%6#In case you have valuable files , we advise you to act fast as there is no other option ratherthan paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below :http://u24er.ovaarmor.com/EFD56F52E36DDCE4http://l123d.feustude.at/EFD56F52E36DDCE4http://k234s.ascotsprue.com/EFD56F52E36DDCE4. 399-?7,#$&6*=")?4(;>>'4;=1%6# ----- . 399-?7,#$&6*=")?4(;>>'4;=1%6#If you can't access your personal homepage or the addresses are not working, complete the following steps:******** Download and Install TOR Browser - https://www.torproject.org/download/*** Navigate yyhn7fpvq44cqcu3.onion/EFD56F52E36DDCE4. 399-?7,#$&6*=")?4(;>>'4;=1%6#----IMPORTANT INFORMATION---------. 399-?7,#$&6*=")?4(;>>'4;=1%6#Your personal homepages http://u24er.ovaarmor.com/EFD56F52E36DDCE4http://l123d.feustude.at/EFD56F52E36DDCE4http://k234s.ascotsprue.com/EFD56F52E36DDCE4 Your personal homepage Tor-Browser yyhn7fpvq44cqcu3.onion/EFD56F52E36DDCE4Your personal ID EFD56F52E36DDCE4. 399-?7,#$&6*=")?4(;>>'4;=1%6# ----- . 399-?7,#$&6*=")?4(;>>'4;=1%6#----------------------------------------------------------------------------------------------------------------------------

Malekal_morte- · Answer

Salut,

Windows a été infecté par un ransomware / rançongiciel chiffreur de fichiers. Ces rançongiciels s'attrapent essentiellement par l'ouverture d'une pièce jointe malicieuse dans un e-mail ou par la visite d'une page internet piégée par des exploits WEB.

A l'heure actuelle, il n'y a pas vraiment de méthode pour récupérer les documents chiffrés. Si les données sont très importantes, les stocker temporairement à l'abri car peut-être qu'il y aura dans le futur une solution pour les récupérer.

Il faut d'abord vérifier qu'aucune menace ne soit encore active.
Par précaution, pense aussi à changer tous tes mots de passe.

1°) FRST
Suis le tutoriel FRST. ( prends le temps de lire attentivement - tout y est bien expliqué ).

Télécharge et lance le scan FRST, 3 rapports FRST seront générés :

 FRST.txt
 Shortcut.txt
 Additionnal.txt

Envoie ces 3 rapports sur le site http://pjjoint.malekal.com/ et en retour donne les 3 liens pjjoint qui mènent aux rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.

Malekal_morte- · Answer

Bon sans surprise, c'est le ransomware TeslaCrypt RSA-4096. Il n'est plus actif mais le mal est fait, tes fichiers sont chiffrés. Et vu ces fichiers, tu t'es fait avoir par un mail malicieux : 2016-04-26 23:04 - 2013-06-03 19:36 - 00000480 _____ C:\Users\Muriel\Downloads\pck0q1ld34a6fcde.js 2016-04-26 23:04 - 2013-04-03 17:48 - 00000656 _____ C:\Users\Muriel\Downloads\vrq0l49dbeb6b82f.js 2016-04-26 23:03 - 2013-02-20 12:10 - 00000480 _____ C:\Users\Muriel\Downloads 3ygmz8642cc1b84.js 2016-04-26 23:03 - 2013-02-19 23:12 - 00000480 _____ C:\Users\Muriel\Downloads 3ygmz869b7bec78.js Tu trouveras des exemples de mails sur cette page pour comprendre le principe des emails malicieux : https://forum.malekal.com/viewtopic.php?t=54467&start= Pour limiter leur portée, tu peux désactiver les scripts malicieux : Comment se protéger des scripts malicieux sur Windows. ~~ Voici la correction à effectuer avec FRST. Tu peux t'aider de cette note explicative avec des captures d'écran. Ouvre le bloc-notes : Touche Windows + R, Dans le champs "Exécuter", saisir notepad et OK. Copie/Colle dedans ce qui suit : CloseProcesses: 2016-04-27 17:03 - 2016-04-27 17:06 - 0011747 _____ () C:\ProgramData\-!RecOveR!-akjlx++.Htm 2016-04-27 17:03 - 2016-04-27 17:06 - 0076378 _____ () C:\ProgramData\-!RecOveR!-akjlx++.Png 2016-04-27 17:03 - 2016-04-27 17:06 - 0002528 _____ () C:\ProgramData\-!RecOveR!-akjlx++.Txt 2016-04-27 10:11 - 2016-04-27 10:13 - 0011747 _____ () C:\ProgramData\-!RecOveR!-cymqy++.Htm 2016-04-27 10:11 - 2016-04-27 10:13 - 0076148 _____ () C:\ProgramData\-!RecOveR!-cymqy++.Png 2016-04-27 10:11 - 2016-04-27 10:13 - 0002528 _____ () C:\ProgramData\-!RecOveR!-cymqy++.Txt 2016-04-26 00:54 - 2016-04-26 01:01 - 0011747 _____ () C:\ProgramData\-!RecOveR!-ihoxg++.Htm 2016-04-26 00:54 - 2016-04-26 01:01 - 0075395 _____ () C:\ProgramData\-!RecOveR!-ihoxg++.Png 2016-04-26 00:54 - 2016-04-26 01:01 - 0002528 _____ () C:\ProgramData\-!RecOveR!-ihoxg++.Txt 2016-04-27 11:33 - 2016-04-27 11:35 - 0011747 _____ () C:\ProgramData\-!RecOveR!-onlml++.Htm 2016-04-27 11:33 - 2016-04-27 11:35 - 0076058 _____ () C:\ProgramData\-!RecOveR!-onlml++.Png 2016-04-27 11:33 - 2016-04-27 11:35 - 0002528 _____ () C:\ProgramData\-!RecOveR!-onlml++.Txt 2016-04-26 22:00 - 2016-04-26 22:06 - 0011747 _____ () C:\ProgramData\-!RecOveR!-wyxng++.Htm 2016-04-26 22:00 - 2016-04-26 22:06 - 0075115 _____ () C:\ProgramData\-!RecOveR!-wyxng++.Png 2016-04-26 22:00 - 2016-04-26 22:06 - 0002528 _____ () C:\ProgramData\-!RecOveR!-wyxng++.Txt 2016-04-26 00:54 - 2016-04-26 00:54 - 0011747 _____ () C:\Program Files\-!RecOveR!-ihoxg++.Htm 2016-04-26 00:54 - 2016-04-26 00:54 - 0075395 _____ () C:\Program Files\-!RecOveR!-ihoxg++.Png 2016-04-26 00:54 - 2016-04-26 00:54 - 0002528 _____ () C:\Program Files\-!RecOveR!-ihoxg++.Txt 2016-04-26 00:52 - 2016-04-26 00:52 - 0011747 _____ () C:\Program Files\Common Files\-!RecOveR!-ihoxg++.Htm 2016-04-26 00:52 - 2016-04-26 00:52 - 0075395 _____ () C:\Program Files\Common Files\-!RecOveR!-ihoxg++.Png 2016-04-26 00:52 - 2016-04-26 00:52 - 0002528 _____ () C:\Program Files\Common Files\-!RecOveR!-ihoxg++.Txt 2016-04-27 17:23 - 2016-04-27 17:52 - 0011747 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-akjlx++.Htm 2016-04-27 17:23 - 2016-04-27 17:52 - 0076378 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-akjlx++.Png 2016-04-27 17:23 - 2016-04-27 17:52 - 0002528 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-akjlx++.Txt 2016-04-27 10:31 - 2016-04-27 10:31 - 0011747 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-cymqy++.Htm 2016-04-27 10:31 - 2016-04-27 10:31 - 0076148 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-cymqy++.Png 2016-04-27 10:31 - 2016-04-27 10:31 - 0002528 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-cymqy++.Txt 2016-04-27 11:52 - 2016-04-27 12:19 - 0011747 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-onlml++.Htm 2016-04-27 11:52 - 2016-04-27 12:19 - 0076058 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-onlml++.Png 2016-04-27 11:52 - 2016-04-27 12:19 - 0002528 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-onlml++.Txt 2016-04-26 22:27 - 2016-04-26 22:27 - 0011747 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-wyxng++.Htm 2016-04-26 22:27 - 2016-04-26 22:27 - 0075115 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-wyxng++.Png 2016-04-26 22:27 - 2016-04-26 22:27 - 0002528 _____ () C:\Users\Muriel\AppData\Roaming\-!RecOveR!-wyxng++.Txt 2015-04-14 18:28 - 2015-04-14 18:28 - 0004387 _____ () C:\Users\Muriel\AppData\Roaming\03nlB3rqIEe 2015-04-14 18:28 - 2015-04-14 18:28 - 0004387 _____ () C:\Users\Muriel\AppData\Roaming\SK88H3daBNKPp37jycBD 2016-04-27 17:21 - 2016-04-27 17:49 - 0011747 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-akjlx++.Htm 2016-04-27 17:21 - 2016-04-27 17:49 - 0076378 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-akjlx++.Png 2016-04-27 17:21 - 2016-04-27 17:49 - 0002528 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-akjlx++.Txt 2016-04-27 10:29 - 2016-04-27 11:00 - 0011747 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-cymqy++.Htm 2016-04-27 10:29 - 2016-04-27 11:00 - 0076148 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-cymqy++.Png 2016-04-27 10:29 - 2016-04-27 11:00 - 0002528 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-cymqy++.Txt 2016-04-27 11:50 - 2016-04-27 12:16 - 0011747 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-onlml++.Htm 2016-04-27 11:50 - 2016-04-27 12:16 - 0076058 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-onlml++.Png 2016-04-27 11:50 - 2016-04-27 12:16 - 0002528 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-onlml++.Txt 2016-04-26 22:25 - 2016-04-26 22:25 - 0011747 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-wyxng++.Htm 2016-04-26 22:25 - 2016-04-26 22:25 - 0075115 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-wyxng++.Png 2016-04-26 22:25 - 2016-04-26 22:25 - 0002528 _____ () C:\Users\Muriel\AppData\Roaming\Microsoft\-!RecOveR!-wyxng++.Txt 2016-04-27 11:08 - 2016-04-27 11:08 - 0037376 ___SH () C:\Users\Muriel\AppData\Roaming\Microsoft\Thumbs.db 2016-04-27 17:06 - 2016-04-27 17:44 - 0011747 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-akjlx++.Htm 2016-04-27 17:06 - 2016-04-27 17:44 - 0076378 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-akjlx++.Png 2016-04-27 17:06 - 2016-04-27 17:44 - 0002528 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-akjlx++.Txt 2016-04-27 10:13 - 2016-04-27 10:55 - 0011747 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-cymqy++.Htm 2016-04-27 10:13 - 2016-04-27 10:55 - 0076148 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-cymqy++.Png 2016-04-27 10:13 - 2016-04-27 10:55 - 0002528 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-cymqy++.Txt 2016-04-26 01:01 - 2016-04-26 01:01 - 0011747 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-ihoxg++.Htm 2016-04-26 01:01 - 2016-04-26 01:01 - 0075395 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-ihoxg++.Png 2016-04-26 01:01 - 2016-04-26 01:01 - 0002528 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-ihoxg++.Txt 2016-04-27 11:35 - 2016-04-27 12:12 - 0011747 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-onlml++.Htm 2016-04-27 11:35 - 2016-04-27 12:12 - 0076058 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-onlml++.Png 2016-04-27 11:35 - 2016-04-27 12:12 - 0002528 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-onlml++.Txt 2016-04-26 22:06 - 2016-04-26 23:04 - 0011747 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-wyxng++.Htm 2016-04-26 22:06 - 2016-04-26 23:04 - 0075115 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-wyxng++.Png 2016-04-26 22:06 - 2016-04-26 23:04 - 0002528 _____ () C:\Users\Muriel\AppData\Local\-!RecOveR!-wyxng++.Txt Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-ihoxg++.Htm [2016-04-26] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-ihoxg++.Png [2016-04-26] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-ihoxg++.Txt [2016-04-26] () Startup: C:\Users\Muriel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-akjlx++.Htm [2016-04-27] () Startup: C:\Users\Muriel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-akjlx++.Png [2016-04-27] () Startup: C:\Users\Muriel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-akjlx++.Txt [2016-04-27] () Startup: C:\Users\Muriel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-onlml++.Htm [2016-04-27] () Startup: C:\Users\Muriel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-onlml++.Png [2016-04-27] () Startup: C:\Users\Muriel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-onlml++.Txt [2016-04-27] () 2016-04-26 22:21 - 2015-09-04 23:06 - 00005104 _____ C:\Users\Muriel\AppData\LocalLow\HELP_DECRYPT.TXT 2016-04-26 23:04 - 2013-06-03 19:36 - 00000480 _____ C:\Users\Muriel\Downloads\pck0q1ld34a6fcde.js 2016-04-26 23:04 - 2013-04-03 17:48 - 00000656 _____ C:\Users\Muriel\Downloads\vrq0l49dbeb6b82f.js 2016-04-26 23:03 - 2013-02-20 12:10 - 00000480 _____ C:\Users\Muriel\Downloads 3ygmz8642cc1b84.js 2016-04-26 23:03 - 2013-02-19 23:12 - 00000480 _____ C:\Users\Muriel\Downloads 3ygmz869b7bec78.js S2 hqg; c:\windows\hqg.exe [X] S2 HSjxrxTnqgt; C:\ProgramData\IEtwnxJfYCD\HSjxrxTnqgt.exe [X] S2 mhqg; c:\windows\mhqg.exe [X] Task: C:\Windows\Tasks\RndFilter.job => c:\programdata\{e4c2c65e-9948-9be2-e4c2-2c65e994197a}\setup_668.exe <==== ATTENTIONTask: {8DD1D4F4-889A-4284-B8E9-3DD05757B89F} - System32\Tasks\{BFAF7BD1-C3F0-440E-B71F-5EE43B9D29CF} => pcalua.exe -a C:\ProgramData\ZombieNews\uninstall.exe -c /kb=y /ic=1Task: {8FD63452-A16A-4E09-B509-10CB8988BA3C} - System32\Tasks\RndFilter => c:\programdata\{e4c2c65e-9948-9be2-e4c2-2c65e994197a}\setup_668.exe <==== ATTENTIONTask: {E91BC00B-EFE8-4528-9CFD-824A7375C115} - System32\Tasks\{1DAEE83F-A70E-4971-A8FD-1402ABA6DC2F} => pcalua.exe -a C:\Users\Muriel\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=ill <==== ATTENTIONTask: {0687150D-14BB-4828-A5BB-59276A53F397} - System32\Tasks\{D246F088-55CA-41D0-AE2B-2DDBBC09A615} => pcalua.exe -a C:\Users\Muriel\AppData\Roaming\webssearches\UninstallManager.exe -c -ptid=obw <==== ATTENTIONReboot: Une fois, le texte collé dans le Bloc-notes, Menu "Fichier" puis "Enregistrer sous", A gauche, place toi sur le Bureau, Dans le champs en bas, nom du fichier mets : fixlist.txt Clique sur "Enregistrer", cela va créer fixlist.txt sur le Bureau. Relance FRST et clique sur le bouton "Corriger / Fix" Un redémarrage sera peut-être nécessaire ( pas obligatoire ) Un fichier texte apparait, copie/colle le contenu ici dans un nouveau message. Veuillez appuyer sur une touche pour continuer la désinfection...

Malekal_morte- · Answer

il faut supprimer tous les fichiers !RecOveR!.

Fais une recherche de fichiers sur Windows (aide : Comment rechercher des fichiers sur Windows) sur !RecOveR! et supprime les fichiers trouvés.

Malekal_morte- · Answer

Voici la correction à effectuer avec FRST. Tu peux t'aider de cette note explicative avec des captures d'écran.

Ouvre le bloc-notes : Touche Windows + R, 
Dans le champs "Exécuter", saisir notepad et OK.
Copie/Colle dedans ce qui suit : 

CreateRestorePoint:CloseProcesses:Task: {A68DF7BB-4EF8-42C0-A032-7C4568C921F4} - System32\Tasks\{9D4C0E19-2559-4107-87DF-BC651183C86D} => pcalua.exe -a C:\Users\Muriel\AppData\Roaming\istartsurf\UninstallManager.exe -c  -ptid=ill HKU\S-1-5-21-2230426328-3460877897-325707465-1001\...\Run: [hostslertqvgiun] => C:\Windows\SYSTEM32\CMD.EXE /C START C:\Users\Muriel\Documents\pdiorgatsivi.exe   HKU\S-1-5-21-2230426328-3460877897-325707465-1001\...\Run: [hostslertqiwuus] => C:\Windows\SYSTEM32\CMD.EXE /C START C:\Users\Muriel\Documents\pdiorgatsivi.exe   HKU\S-1-5-21-2230426328-3460877897-325707465-1001\...\Run: [hostslertukklwn] => C:\Windows\SYSTEM32\CMD.EXE /C START C:\Users\Muriel\Documents\pdiorgatsivi.exe   HKU\S-1-5-21-2230426328-3460877897-325707465-1001\...\Run: [hostslertwkqdue] => C:\Windows\SYSTEM32\CMD.EXE /C START C:\Users\Muriel\Documents\pdiorgatsivi.exe   HKU\S-1-5-21-2230426328-3460877897-325707465-1001\...\Run: [hostslertqlsmxn] => C:\Windows\SYSTEM32\CMD.EXE /C START C:\Users\Muriel\Documents\pdiorgatsivi.exe   HKU\S-1-5-21-2230426328-3460877897-325707465-1001\...\Run: [hostslertcqlsxy] => C:\Windows\SYSTEM32\CMD.EXE /C START C:\Users\Muriel\Documents\pdiorgatsivi.exe   HKU\S-1-5-21-2230426328-3460877897-325707465-1001\...\Run: [hostslertyiblot] => C:\Windows\SYSTEM32\CMD.EXE /C START C:\Users\Muriel\Documents\pdiorgatsivi.exe  Task: {ABA112D2-DF16-4D40-9DFA-6BC3C9E36758} - System32\Tasks\{B101DEA3-146A-4A20-9ED5-904D9184F970} => pcalua.exe -a C:\Users\Muriel\AppData\Roaming\mystartsearch\UninstallManager.exe -c  -ptid=cmiTask: {216F35CB-5B36-43E9-8BEA-930485052AED} - System32\Tasks\{6AB2A25B-0B40-44CA-B5BA-4C853A7F5AC4} => pcalua.exe -a C:\ProgramData\StormAlert\uninstall.exe -c /kb=y /ic=1reboot:
Une fois, le texte collé dans le Bloc-notes,
Menu "Fichier" puis "Enregistrer sous",
A gauche, place toi sur le Bureau,
Dans le champs en bas, nom du fichier mets : fixlist.txt
Clique sur "Enregistrer", cela va créer fixlist.txt sur le Bureau.

Relance FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire ( pas obligatoire )
Un fichier texte apparait, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur.

Ransomware RSA-4096 (TeslaCrypt -!RecOveR!-)

4 réponses

Fin de Fixlog 22:32:25

Discussions similaires