Virus Ransomware

Résolu
steve15 -  
Bonjour,

J'ai attrapé un virus de type "Ransomware"
Celui-ci m'a bousillé tous mes fichiers .JPG photos, .pdf, .doc, .docx Word ... Bref la totale
J'ai cherché un peu sur internet on trouve beaucoup de logiciels pour décrypter mais après je sais pas trop comment distinguer "les vrais des faux" , histoire de pas retomber sur un autre virus en cherchant un logiciel pour les décrypter ...

Le virus m'a renommé tous mes fichiers en *.jpg.ezz

Pouvez-vous s.v.pl m'aider à
1) Shooter le virus
2) Récupérer les photos ? Est-ce possible ?

Par avance merci.

11 réponses

  1.  Malekal_morte- Modérateur
    Salut,

    Tu as été infecté par un Ransomware chiffreurs de fichiers.

    Ces derniers vont essentiellement par des pièces jointes malicieux dans des emails ou des Exploits WEB.

    Il n'y a pas vraiment de solution pour récupérer les documents.

    Si tu veux vérifier l'ordinateur :

    Suis ce tutoriel FRST: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/
    Télécharge et lance le scan FRST, cela va générer trois rapports FRST :
    • FRST.txt
    • Shortcut.txt
    • Additionnal.txt


    Envoie comme expliqué, ces trois rapports sur le site http://pjjoint.malekal.com et donne les trois liens pjjoint de ces rapports afin qu'ils puissent être consultés.

    1. steve15
      Salut

      merci pour ta réponse rapide

      Vraiment aucun moyen de récupérer les fichiers déjà cryptés ?

      J'ai fait tourner le soft en mode sans échec pour éviter que le virus continue à tourner et me bousiller des fichiers

      Voici les 3 rapports :

      http://pjjoint.malekal.com/files.php?id=20150501_c14w10y6c6v15
      http://pjjoint.malekal.com/files.php?id=20150501_b10s12c15q8j11
      http://pjjoint.malekal.com/files.php?id=20150501_j13s8f5u11o7

      Dans l'attente d'une réponse de ta part
      Merci
      1. Malekal_morte- Modérateur
        y a un Trojan Miner qui tourne qui a été téléchargé par des cracks/keygen.

        Voici la correction à effectuer avec FRST.
        Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

        Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
        Copie/colle dedans ce qui suit :

        HKLM\...\Run: [AVSvc] => C:\Users\FABBY\AppData\Roaming\aeymrvb.exe [352768 2015-05-01] ()
        HKU\S-1-5-21-1690268873-1756398334-584139300-1001\...\Run: [AVSvc] => C:\Users\FABBY\AppData\Roaming\aeymrvb.exe [352768 2015-05-01] ()
        HKU\S-1-5-21-1690268873-1756398334-584139300-1001\...\Run: [BluetoothManager] => rundll32.exe "%appdata%\Microsoft\bstack.dll",bs_init
        2015-05-01 12:30 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\Downloads\HELP_TO_SAVE_FILES.txt
        2015-05-01 12:30 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\Documents\HELP_TO_SAVE_FILES.txt
        2015-05-01 12:30 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\AppData\Roaming\Microsoft\Windows\Start Menu\HELP_TO_SAVE_FILES.txt
        2015-05-01 12:30 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\AppData\Local\HELP_TO_SAVE_FILES.txt
        2015-05-01 12:26 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\Desktop\HELP_TO_SAVE_FILES.txt
        2015-05-01 12:26 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\AppData\Roaming\HELP_TO_SAVE_FILES.txt
        2015-05-01 12:26 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\AppData\HELP_TO_SAVE_FILES.txt
        2015-05-01 12:24 - 2015-05-01 12:44 - 00002678 _____ () C:\Users\Public\Documents\HELP_TO_SAVE_FILES.txt
        2015-05-01 12:24 - 2015-05-01 12:44 - 00002678 _____ () C:\ProgramData\HELP_TO_SAVE_FILES.txt
        2015-05-01 12:15 - 2015-05-01 12:44 - 00000232 _____ () C:\Users\FABBY\Documents\RECOVERY_FILE.TXT
        2015-05-01 12:15 - 2015-05-01 12:15 - 00002678 _____ () C:\Users\HELP_TO_SAVE_FILES.txt
        2015-05-01 12:15 - 2015-05-01 12:15 - 00000752 _____ () C:\Users\FABBY\AppData\Roaming\key.dat
        2015-05-01 12:14 - 2015-05-01 12:14 - 00352768 _____ () C:\Users\FABBY\AppData\Roaming\aeymrvb.exe
        2015-04-30 16:43 - 2015-05-01 12:30 - 00047252 _____ () C:\Users\FABBY\Downloads\HELP_DECRYPT.PNG.ezz
        2015-04-30 16:43 - 2015-05-01 12:30 - 00004740 _____ () C:\Users\FABBY\Downloads\HELP_DECRYPT.TXT.ezz
        2015-04-30 16:43 - 2015-04-30 16:43 - 00009036 _____ () C:\Users\FABBY\Downloads\HELP_DECRYPT.HTML
        2015-04-30 16:43 - 2015-04-30 16:43 - 00000280 _____ () C:\Users\FABBY\Downloads\HELP_DECRYPT.URL
        2015-04-30 16:40 - 2015-05-01 12:27 - 00047252 _____ () C:\Users\FABBY\Documents\HELP_DECRYPT.PNG.ezz
        2015-04-30 16:40 - 2015-05-01 12:27 - 00004740 _____ () C:\Users\FABBY\Documents\HELP_DECRYPT.TXT.ezz
        2015-04-30 16:40 - 2015-04-30 16:40 - 00009036 _____ () C:\Users\FABBY\Documents\HELP_DECRYPT.HTML
        2015-04-30 16:40 - 2015-04-30 16:40 - 00000280 _____ () C:\Users\FABBY\Documents\HELP_DECRYPT.URL
        2015-04-30 16:33 - 2015-05-01 12:25 - 00047252 _____ () C:\Users\FABBY\AppData\HELP_DECRYPT.PNG.ezz
        2015-04-30 16:33 - 2015-05-01 12:25 - 00004740 _____ () C:\Users\FABBY\AppData\HELP_DECRYPT.TXT.ezz
        2015-04-30 16:33 - 2015-04-30 16:33 - 00009036 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.HTML
        2015-04-30 16:33 - 2015-04-30 16:33 - 00009036 _____ () C:\Users\FABBY\AppData\HELP_DECRYPT.HTML
        2015-04-30 16:33 - 2015-04-30 16:33 - 00004706 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.TXT
        2015-04-30 16:33 - 2015-04-30 16:33 - 00000280 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.URL
        2015-04-30 16:33 - 2015-04-30 16:33 - 00000280 _____ () C:\Users\FABBY\AppData\HELP_DECRYPT.URL
        2015-04-30 16:20 - 2015-04-30 16:20 - 00009036 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.HTML
        2015-04-30 16:20 - 2015-04-30 16:20 - 00004706 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.TXT
        2015-04-30 16:20 - 2015-04-30 16:20 - 00000280 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.URL
        2015-04-30 15:46 - 2015-04-30 15:46 - 00009036 _____ () C:\ProgramData\HELP_DECRYPT.HTML
        2015-04-30 15:46 - 2015-04-30 15:46 - 00004706 _____ () C:\ProgramData\HELP_DECRYPT.TXT
        2015-04-30 15:46 - 2015-04-30 15:46 - 00000280 _____ () C:\ProgramData\HELP_DECRYPT.URL
        2015-05-01 12:14 - 2015-05-01 12:14 - 0352768 _____ () C:\Users\FABBY\AppData\Roaming\aeymrvb.exe
        2015-04-30 16:33 - 2015-04-30 16:33 - 0009036 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.HTML
        2015-04-30 16:33 - 2015-04-30 16:33 - 0047231 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.PNG
        2015-04-30 16:33 - 2015-04-30 16:33 - 0004706 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.TXT
        2015-04-30 16:33 - 2015-04-30 16:33 - 0000280 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.URL
        2015-05-01 12:26 - 2015-05-01 12:45 - 0002678 _____ () C:\Users\FABBY\AppData\Roaming\HELP_TO_SAVE_FILES.txt
        2015-05-01 12:15 - 2015-05-01 12:15 - 0000752 _____ () C:\Users\FABBY\AppData\Roaming\key.dat
        2015-05-01 12:15 - 2015-05-01 13:02 - 0721204 _____ () C:\Users\FABBY\AppData\Roaming\log.html
        2012-02-04 17:53 - 2012-02-04 17:53 - 0022927 _____ () C:\Users\FABBY\AppData\Roaming\UserTile.png
        2015-04-30 16:20 - 2015-04-30 16:20 - 0009036 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.HTML
        2015-04-30 16:20 - 2015-04-30 16:20 - 0047231 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.PNG
        2015-04-30 16:20 - 2015-04-30 16:20 - 0004706 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.TXT
        2015-04-30 16:20 - 2015-04-30 16:20 - 0000280 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.URL
        2015-05-01 12:30 - 2015-05-01 12:45 - 0002678 _____ () C:\Users\FABBY\AppData\Local\HELP_TO_SAVE_FILES.txt
        2015-04-29 10:51 - 2015-04-29 10:51 - 0016896 _____ () C:\Users\FABBY\AppData\Local\lopmber.dll
        2015-04-30 15:46 - 2015-04-30 15:46 - 0009036 _____ () C:\ProgramData\HELP_DECRYPT.HTML
        2015-04-30 15:46 - 2015-04-30 15:46 - 0047231 _____ () C:\ProgramData\HELP_DECRYPT.PNG
        2015-04-30 15:46 - 2015-04-30 15:46 - 0004706 _____ () C:\ProgramData\HELP_DECRYPT.TXT
        2015-04-30 15:46 - 2015-04-30 15:46 - 0000280 _____ () C:\ProgramData\HELP_DECRYPT.URL
        2015-05-01 12:24 - 2015-05-01 12:44 - 0002678 _____ () C:\ProgramData\HELP_TO_SAVE_FILES.txt
        Task: {84CD9CE9-89B2-4A99-B8A5-70AB56079FC0} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
        Task: {FBF06D08-BD51-4A88-8715-40161E95A786} - System32\Tasks\4537 => Wscript.exe C:\Users\FABBY\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION

        Une fois, le texte coller dans le bloc-note.
        Menu Fichier puis Enregistrer sous.
        A gauche, place toi sur le bureau.

        Dans le champs en bas, nom du fichier mets : fixlist.txt
        Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.

        Relance FRST qui doit se trouver sur le bureau et clic sur le bouton Fix
        Selon comment un redémarrage est nécessaire (pas obligatoire).
        Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

        Redémarre l'ordinateur

        Scan Malwarebytes (temps : environ 40min de scan):
        ==================================================
        Télécharge et installe Malwarebyte : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
        Mets le à jour puis lance un examen.

        A la fin du scan, clic sur "Mettre tout en quarantaine" en bas à gauche.
        Redémarre l'ordinateur si besoin.
        Après redémarrage, relance Malwarebytes.
        Vas chercher le rapport dans l'onglet Historique.
        A gauche Journal d'application.
        Dans la liste, prends le scan log le plus récent.
        Puis en bas Copier dans le presse papier
        Vas sur http://pjjoint.malekal.com et en bas, clic droit / coller pour coller le rapport du scan Malwarebytes.
        Clic sur envoyer.
        Dans un nouveau message ici en réponse, donne le lien pjjoint afin de pouvoir consulter le rapport.

        1. steve15
          Voila

          Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 29-04-2015 01
          Ran by FABBY at 2015-05-01 15:52:50 Run:1
          Running from C:\Users\FABBY\Desktop
          Loaded Profiles: FABBY (Available profiles: FABBY)
          Boot Mode: Safe Mode (with Networking)

          ==============================================

          Content of fixlist:
          HKLM\...\Run: [AVSvc] => C:\Users\FABBY\AppData\Roaming\aeymrvb.exe [352768 2015-05-01] ()
          HKU\S-1-5-21-1690268873-1756398334-584139300-1001\...\Run: [AVSvc] => C:\Users\FABBY\AppData\Roaming\aeymrvb.exe [352768 2015-05-01] ()
          HKU\S-1-5-21-1690268873-1756398334-584139300-1001\...\Run: [BluetoothManager] => rundll32.exe "%appdata%\Microsoft\bstack.dll",bs_init
          2015-05-01 12:30 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\Downloads\HELP_TO_SAVE_FILES.txt
          2015-05-01 12:30 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\Documents\HELP_TO_SAVE_FILES.txt
          2015-05-01 12:30 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\AppData\Roaming\Microsoft\Windows\Start Menu\HELP_TO_SAVE_FILES.txt
          2015-05-01 12:30 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\AppData\Local\HELP_TO_SAVE_FILES.txt
          2015-05-01 12:26 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\Desktop\HELP_TO_SAVE_FILES.txt
          2015-05-01 12:26 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\AppData\Roaming\HELP_TO_SAVE_FILES.txt
          2015-05-01 12:26 - 2015-05-01 12:45 - 00002678 _____ () C:\Users\FABBY\AppData\HELP_TO_SAVE_FILES.txt
          2015-05-01 12:24 - 2015-05-01 12:44 - 00002678 _____ () C:\Users\Public\Documents\HELP_TO_SAVE_FILES.txt
          2015-05-01 12:24 - 2015-05-01 12:44 - 00002678 _____ () C:\ProgramData\HELP_TO_SAVE_FILES.txt
          2015-05-01 12:15 - 2015-05-01 12:44 - 00000232 _____ () C:\Users\FABBY\Documents\RECOVERY_FILE.TXT
          2015-05-01 12:15 - 2015-05-01 12:15 - 00002678 _____ () C:\Users\HELP_TO_SAVE_FILES.txt
          2015-05-01 12:15 - 2015-05-01 12:15 - 00000752 _____ () C:\Users\FABBY\AppData\Roaming\key.dat
          2015-05-01 12:14 - 2015-05-01 12:14 - 00352768 _____ () C:\Users\FABBY\AppData\Roaming\aeymrvb.exe
          2015-04-30 16:43 - 2015-05-01 12:30 - 00047252 _____ () C:\Users\FABBY\Downloads\HELP_DECRYPT.PNG.ezz
          2015-04-30 16:43 - 2015-05-01 12:30 - 00004740 _____ () C:\Users\FABBY\Downloads\HELP_DECRYPT.TXT.ezz
          2015-04-30 16:43 - 2015-04-30 16:43 - 00009036 _____ () C:\Users\FABBY\Downloads\HELP_DECRYPT.HTML
          2015-04-30 16:43 - 2015-04-30 16:43 - 00000280 _____ () C:\Users\FABBY\Downloads\HELP_DECRYPT.URL
          2015-04-30 16:40 - 2015-05-01 12:27 - 00047252 _____ () C:\Users\FABBY\Documents\HELP_DECRYPT.PNG.ezz
          2015-04-30 16:40 - 2015-05-01 12:27 - 00004740 _____ () C:\Users\FABBY\Documents\HELP_DECRYPT.TXT.ezz
          2015-04-30 16:40 - 2015-04-30 16:40 - 00009036 _____ () C:\Users\FABBY\Documents\HELP_DECRYPT.HTML
          2015-04-30 16:40 - 2015-04-30 16:40 - 00000280 _____ () C:\Users\FABBY\Documents\HELP_DECRYPT.URL
          2015-04-30 16:33 - 2015-05-01 12:25 - 00047252 _____ () C:\Users\FABBY\AppData\HELP_DECRYPT.PNG.ezz
          2015-04-30 16:33 - 2015-05-01 12:25 - 00004740 _____ () C:\Users\FABBY\AppData\HELP_DECRYPT.TXT.ezz
          2015-04-30 16:33 - 2015-04-30 16:33 - 00009036 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.HTML
          2015-04-30 16:33 - 2015-04-30 16:33 - 00009036 _____ () C:\Users\FABBY\AppData\HELP_DECRYPT.HTML
          2015-04-30 16:33 - 2015-04-30 16:33 - 00004706 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.TXT
          2015-04-30 16:33 - 2015-04-30 16:33 - 00000280 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.URL
          2015-04-30 16:33 - 2015-04-30 16:33 - 00000280 _____ () C:\Users\FABBY\AppData\HELP_DECRYPT.URL
          2015-04-30 16:20 - 2015-04-30 16:20 - 00009036 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.HTML
          2015-04-30 16:20 - 2015-04-30 16:20 - 00004706 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.TXT
          2015-04-30 16:20 - 2015-04-30 16:20 - 00000280 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.URL
          2015-04-30 15:46 - 2015-04-30 15:46 - 00009036 _____ () C:\ProgramData\HELP_DECRYPT.HTML
          2015-04-30 15:46 - 2015-04-30 15:46 - 00004706 _____ () C:\ProgramData\HELP_DECRYPT.TXT
          2015-04-30 15:46 - 2015-04-30 15:46 - 00000280 _____ () C:\ProgramData\HELP_DECRYPT.URL
          2015-05-01 12:14 - 2015-05-01 12:14 - 0352768 _____ () C:\Users\FABBY\AppData\Roaming\aeymrvb.exe
          2015-04-30 16:33 - 2015-04-30 16:33 - 0009036 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.HTML
          2015-04-30 16:33 - 2015-04-30 16:33 - 0047231 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.PNG
          2015-04-30 16:33 - 2015-04-30 16:33 - 0004706 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.TXT
          2015-04-30 16:33 - 2015-04-30 16:33 - 0000280 _____ () C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.URL
          2015-05-01 12:26 - 2015-05-01 12:45 - 0002678 _____ () C:\Users\FABBY\AppData\Roaming\HELP_TO_SAVE_FILES.txt
          2015-05-01 12:15 - 2015-05-01 12:15 - 0000752 _____ () C:\Users\FABBY\AppData\Roaming\key.dat
          2015-05-01 12:15 - 2015-05-01 13:02 - 0721204 _____ () C:\Users\FABBY\AppData\Roaming\log.html
          2012-02-04 17:53 - 2012-02-04 17:53 - 0022927 _____ () C:\Users\FABBY\AppData\Roaming\UserTile.png
          2015-04-30 16:20 - 2015-04-30 16:20 - 0009036 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.HTML
          2015-04-30 16:20 - 2015-04-30 16:20 - 0047231 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.PNG
          2015-04-30 16:20 - 2015-04-30 16:20 - 0004706 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.TXT
          2015-04-30 16:20 - 2015-04-30 16:20 - 0000280 _____ () C:\Users\FABBY\AppData\Local\HELP_DECRYPT.URL
          2015-05-01 12:30 - 2015-05-01 12:45 - 0002678 _____ () C:\Users\FABBY\AppData\Local\HELP_TO_SAVE_FILES.txt
          2015-04-29 10:51 - 2015-04-29 10:51 - 0016896 _____ () C:\Users\FABBY\AppData\Local\lopmber.dll
          2015-04-30 15:46 - 2015-04-30 15:46 - 0009036 _____ () C:\ProgramData\HELP_DECRYPT.HTML
          2015-04-30 15:46 - 2015-04-30 15:46 - 0047231 _____ () C:\ProgramData\HELP_DECRYPT.PNG
          2015-04-30 15:46 - 2015-04-30 15:46 - 0004706 _____ () C:\ProgramData\HELP_DECRYPT.TXT
          2015-04-30 15:46 - 2015-04-30 15:46 - 0000280 _____ () C:\ProgramData\HELP_DECRYPT.URL
          2015-05-01 12:24 - 2015-05-01 12:44 - 0002678 _____ () C:\ProgramData\HELP_TO_SAVE_FILES.txt
          Task: {84CD9CE9-89B2-4A99-B8A5-70AB56079FC0} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
          Task: {FBF06D08-BD51-4A88-8715-40161E95A786} - System32\Tasks\4537 => Wscript.exe C:\Users\FABBY\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION

          HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\AVSvc => value deleted successfully.
          HKU\S-1-5-21-1690268873-1756398334-584139300-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AVSvc => value deleted successfully.
          HKU\S-1-5-21-1690268873-1756398334-584139300-1001\Software\Microsoft\Windows\CurrentVersion\Run\\BluetoothManager => value deleted successfully.
          C:\Users\FABBY\Downloads\HELP_TO_SAVE_FILES.txt => Moved successfully.
          C:\Users\FABBY\Documents\HELP_TO_SAVE_FILES.txt => Moved successfully.
          C:\Users\FABBY\AppData\Roaming\Microsoft\Windows\Start Menu\HELP_TO_SAVE_FILES.txt => Moved successfully.
          C:\Users\FABBY\AppData\Local\HELP_TO_SAVE_FILES.txt => Moved successfully.
          C:\Users\FABBY\Desktop\HELP_TO_SAVE_FILES.txt => Moved successfully.
          C:\Users\FABBY\AppData\Roaming\HELP_TO_SAVE_FILES.txt => Moved successfully.
          C:\Users\FABBY\AppData\HELP_TO_SAVE_FILES.txt => Moved successfully.
          C:\Users\Public\Documents\HELP_TO_SAVE_FILES.txt => Moved successfully.
          C:\ProgramData\HELP_TO_SAVE_FILES.txt => Moved successfully.
          C:\Users\FABBY\Documents\RECOVERY_FILE.TXT => Moved successfully.
          C:\Users\HELP_TO_SAVE_FILES.txt => Moved successfully.
          C:\Users\FABBY\AppData\Roaming\key.dat => Moved successfully.
          C:\Users\FABBY\AppData\Roaming\aeymrvb.exe => Moved successfully.
          C:\Users\FABBY\Downloads\HELP_DECRYPT.PNG.ezz => Moved successfully.
          C:\Users\FABBY\Downloads\HELP_DECRYPT.TXT.ezz => Moved successfully.
          C:\Users\FABBY\Downloads\HELP_DECRYPT.HTML => Moved successfully.
          C:\Users\FABBY\Downloads\HELP_DECRYPT.URL => Moved successfully.
          C:\Users\FABBY\Documents\HELP_DECRYPT.PNG.ezz => Moved successfully.
          C:\Users\FABBY\Documents\HELP_DECRYPT.TXT.ezz => Moved successfully.
          C:\Users\FABBY\Documents\HELP_DECRYPT.HTML => Moved successfully.
          C:\Users\FABBY\Documents\HELP_DECRYPT.URL => Moved successfully.
          C:\Users\FABBY\AppData\HELP_DECRYPT.PNG.ezz => Moved successfully.
          C:\Users\FABBY\AppData\HELP_DECRYPT.TXT.ezz => Moved successfully.
          C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.HTML => Moved successfully.
          C:\Users\FABBY\AppData\HELP_DECRYPT.HTML => Moved successfully.
          C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.TXT => Moved successfully.
          C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.URL => Moved successfully.
          C:\Users\FABBY\AppData\HELP_DECRYPT.URL => Moved successfully.
          C:\Users\FABBY\AppData\Local\HELP_DECRYPT.HTML => Moved successfully.
          C:\Users\FABBY\AppData\Local\HELP_DECRYPT.TXT => Moved successfully.
          C:\Users\FABBY\AppData\Local\HELP_DECRYPT.URL => Moved successfully.
          C:\ProgramData\HELP_DECRYPT.HTML => Moved successfully.
          C:\ProgramData\HELP_DECRYPT.TXT => Moved successfully.
          C:\ProgramData\HELP_DECRYPT.URL => Moved successfully.
          "C:\Users\FABBY\AppData\Roaming\aeymrvb.exe" => File/Directory not found.
          "C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.HTML" => File/Directory not found.
          C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.PNG => Moved successfully.
          "C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.TXT" => File/Directory not found.
          "C:\Users\FABBY\AppData\Roaming\HELP_DECRYPT.URL" => File/Directory not found.
          "C:\Users\FABBY\AppData\Roaming\HELP_TO_SAVE_FILES.txt" => File/Directory not found.
          "C:\Users\FABBY\AppData\Roaming\key.dat" => File/Directory not found.
          C:\Users\FABBY\AppData\Roaming\log.html => Moved successfully.
          C:\Users\FABBY\AppData\Roaming\UserTile.png => Moved successfully.
          "C:\Users\FABBY\AppData\Local\HELP_DECRYPT.HTML" => File/Directory not found.
          C:\Users\FABBY\AppData\Local\HELP_DECRYPT.PNG => Moved successfully.
          "C:\Users\FABBY\AppData\Local\HELP_DECRYPT.TXT" => File/Directory not found.
          "C:\Users\FABBY\AppData\Local\HELP_DECRYPT.URL" => File/Directory not found.
          "C:\Users\FABBY\AppData\Local\HELP_TO_SAVE_FILES.txt" => File/Directory not found.
          C:\Users\FABBY\AppData\Local\lopmber.dll => Moved successfully.
          "C:\ProgramData\HELP_DECRYPT.HTML" => File/Directory not found.
          C:\ProgramData\HELP_DECRYPT.PNG => Moved successfully.
          "C:\ProgramData\HELP_DECRYPT.TXT" => File/Directory not found.
          "C:\ProgramData\HELP_DECRYPT.URL" => File/Directory not found.
          "C:\ProgramData\HELP_TO_SAVE_FILES.txt" => File/Directory not found.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{84CD9CE9-89B2-4A99-B8A5-70AB56079FC0}" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{84CD9CE9-89B2-4A99-B8A5-70AB56079FC0}" => Key deleted successfully.
          C:\Windows\System32\Tasks\0 => Moved successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FBF06D08-BD51-4A88-8715-40161E95A786}" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FBF06D08-BD51-4A88-8715-40161E95A786}" => Key deleted successfully.
          C:\Windows\System32\Tasks\4537 => Moved successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\4537" => Key deleted successfully.

          End of Fixlog 17:21:22

          2. Malekal_morte- Modérateur
            ok, voici la suite :

            Scan Malwarebytes (temps : environ 40min de scan):
            ==================================================
            Télécharge et installe Malwarebyte : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
            Mets le à jour puis lance un examen.

            A la fin du scan, clic sur "Mettre tout en quarantaine" en bas à gauche.
            Redémarre l'ordinateur si besoin.
            Après redémarrage, relance Malwarebytes.
            Vas chercher le rapport dans l'onglet Historique.
            A gauche Journal d'application.
            Dans la liste, prends le scan log le plus récent.
            Puis en bas Copier dans le presse papier
            Vas sur http://pjjoint.malekal.com et en bas, clic droit / coller pour coller le rapport du scan Malwarebytes.
            Clic sur envoyer.
            Dans un nouveau message ici en réponse, donne le lien pjjoint afin de pouvoir consulter le rapport.

            1. steve15
              Voici le rapport Scan Log de Malwarebytes :

              http://pjjoint.malekal.com/files.php?id=20150501_e14t11w5u5w10
              1. Malekal_morte- Modérateur
                fais une recherche de fichiers sur HELP_DECRYPT.TXT
                et supprime tout.

                Il reste quoi comme problème ?
            2. steve15
              Salut

              HELP_DECRYPT.TXT je ne trouve pas de fichiers à ce nom

              Après je sais pas si il reste des problèmes si ce virus est parti les rapports disent qu ils en restent d autres ??

              J aurais souhaiter recuprer mes fichiers aussi ... vraiment aucunes solutions ??

              Merci beaucoup pour ton aide
              1. Malekal_morte- Modérateur
                Non aucune solution pour les documents.
            4. Malekal_morte- Modérateur
              oui,

              Fais attention aux emails,

              Le reste de la sécurité : http://forum.malekal.com/comment-securiser-son-ordinateur.html

              1. Steve15
                Bonjour

                Et avec ce type de soft : https://www.technibble.com/panda-ransomware-decrypt-tool-restore-encrypted-files/. Impossible de décrypter les fichiers ?

                Merci
                1. Malekal_morte- Modérateur
                  Ca ne devrait pas fonctionner.
              2. Steve15
                Ok merci
                Et sait-on d'ou est venu le virus ?
                Je ne telecharge Aucun keygen ni crackk depuis CET ordi je fais tout avec l'autre ..?
                1. Malekal_morte- Modérateur
                  Tout est expliqué dans mon premier message.

              Discussions similaires

              Softonic,est-ce un virus ?
              techmel1

              6 réponses
              Chrome://newtab
              Nova

              14 réponses
              Désinstaller Softonic
              Diguimette

              5 réponses
              Supprimer New Tab
              tysaozon

              8 réponses
              Bouton pause/break
              frans003

              3 réponses