Jak odzyskać pliki doc, pdf, txt po infekcji CTB Locker

Dzień dobry,

Mam problem - wszystkie pliki na komputerze z rozszerzeniami m.in doc, pdf txt oraz rtf zmieniły sie na doc.paorkvb txt.paorkvb itd. nie mozna ich otworzyc. Prosze o instrucje co sie stalo i jak mozna je odzyskać. Dziekuje

Uruchomiles zainfekowany plik (zapewne zalacznik do maila), ktory zaszyfrowal pliki. Plikow nie da sie odszyfrowac. Infekcja to CTB Locker.

Mozesz probowac odzyskac usuniete pliki (infekcja usuwa oryginalny plik po zaszyfrowaniu), ale zapewne wiekszosc zostala juz nadpisana.

dziekuje. Fakealert.gen - pewnie to cos jest odpowiedzialne za zainstniala sytuacje, znalazem antywirusem. Jakim programem moge spróbować odzyskac usunięte pliki ?

Dodano po 13 [minuty]:

znalazel jeszcze plik z opisem jak nizej: zastosowac sie do instrukcji ?

Your documents, photos, databases and other important files have been encrypted
with strongest encryption and unique key, generated for this computer.

Private decryption key is stored on a secret Internet server and nobody can
decrypt your files until you pay and obtain the private key.

If you see the main locker window, follow the instructions on the locker.
Overwise, it's seems that you or your antivirus deleted the locker program.
Now you have the last chance to decrypt your files.

Open http://w7yue5dc5amppggs.onion.cab or http://w7yue5dc5amppggs.tor2web.org
in your browser. They are public gates to the secret server.

If you have problems with gates, use direct connection:

1. Download Tor Browser from http://torproject.org

2. In the Tor Browser open the http://w7yue5dc5amppggs.onion/
Note that this server is available via Tor Browser only.
Retry in 1 hour if site is not reachable.

Copy and paste the following public key in the input form on server. Avoid missprints.
L7VG3JZ-OJI2BNB-IO4F4MF-GXQ5SZF-VRZ2HI4-LFUAMMP-CTVWEND-GQIMRLV

Odszyfrowanie kosztuje ponad dwa tysiace zl, do tego nie masz gwarancji, ze dostaniesz klucz. Sam sie zastanow czy warto.

dziekuje. prosze jeszcze o zerkniecie na log po skanowaniu antywirusami.

Daj jeszcze addition.txt!

Yac to szkodliwy program.

Odinstaluj:
Ad-Aware Antivirus
Yac

Jezeli nie zamierzasz placic to usun tez:
2015-01-28 15:55 - 2015-01-28 18:41 - 03148854 _____ () C:\Users\KYNEK\Documents\Decrypt-All-Files-paorkvb.bmp
2015-01-28 15:55 - 2015-01-28 18:41 - 01220985 _____ () C:\ProgramData\eaxswec.html
2015-01-28 15:55 - 2015-01-28 18:41 - 00001266 _____ () C:\Users\KYNEK\Documents\Decrypt-All-Files-paorkvb.txt
2012-02-24 12:55 - 2010-10-06 18:45 - 0131984 _____ () C:\ProgramData\FullRemove.exe

Obok frst.exe utworz plik Fixlist.txt z zawartoscia:
CloseProcesses:
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc2.exe
() C:\Program Files (x86)\Tor\tor.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeTray.exe
() C:\Program Files (x86)\Elex-tech\YAC\iDesk.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafe.exe
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-3169467079-2108416694-2320416126-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-3169467079-2108416694-2320416126-1001\...\Run: [whdzsvd] => C:\Users\KYNEK\AppData\Local\Temp\jkbqipj.exe <===== ATTENTION
HKU\S-1-5-21-3169467079-2108416694-2320416126-1001\...\MountPoints2: {d93b2df2-340d-11e3-bbee-94dbc9b31635} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\start.exe
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
BHO-x32: No Name -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> No File
FF SearchPlugin: C:\Users\KYNEK\AppData\Roaming\Mozilla\Firefox\Profiles\c82pgfo6.default\searchplugins\avira-safesearch.xml
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [120128 2015-01-19] (Elex do Brasil Participações Ltda)
R2 tor; C:\Program Files (x86)\Tor\tor.exe [3233806 2013-09-04] () [File not signed] <==== ATTENTION
S2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [X]
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [249000 2015-01-19] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [45224 2015-01-19] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [99496 2015-01-19] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [42152 2015-01-19] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [93352 2015-01-19] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2015-01-03] (Elex do Brasil Participações Ltda)
U3 am7pdtx1; C:\Windows\System32\Drivers\am7pdtx1.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero size file/folder)
U3 atqczjp3; C:\Windows\System32\Drivers\atqczjp3.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero size file/folder)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
2015-01-28 19:24 - 2015-01-28 19:24 - 00001908 _____ () C:\Users\Public\Desktop\YAC.lnk
2015-01-28 19:24 - 2015-01-28 19:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YAC
2015-01-28 19:24 - 2015-01-19 12:04 - 00045224 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2015-01-28 19:24 - 2015-01-03 09:57 - 00052392 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys
2015-01-28 19:23 - 2015-01-28 19:23 - 00000000 ____D () C:\Users\KYNEK\AppData\Roaming\Elex-tech
2015-01-28 19:23 - 2015-01-28 19:23 - 00000000 ____D () C:\Program Files (x86)\Elex-tech
2015-01-28 19:22 - 2015-01-28 19:36 - 00000000 ____D () C:\Users\KYNEK\AppData\Roaming\eCyber
2015-01-28 19:22 - 2015-01-28 19:22 - 01978096 _____ (Elex do Brasil Participações Ltda) C:\Users\KYNEK\Downloads\yet_another_cleaner_sk_5828190.exe
2015-01-28 15:51 - 2013-10-15 17:10 - 00000000 ____D () C:\AdwCleaner
EmptyTemp:

W FRST wybierz Fix.

zrobilem wszystko zgodnie z instrukcja. przesylam pliki po modyfikacjach

Odinstaluj:
ASUS WebStorage (HKLM-x32\...\ASUS WebStorage) (Version: 3.0.108.222 - eCareme Technologies, Inc.)
YTD Video Downloader 4.8.5 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.8.5 - GreenTree Applications SRL) <==== ATTENTION

Nowy fixlist.txt dla FRST:
Task: {2D40FC84-9329-4144-AE3E-4550D9776E20} - \DSite No Task File <==== ATTENTION
Task: {5A13887C-6DF4-42AF-A942-14E50DDDB55B} - \BrowserProtect No Task File <==== ATTENTION
Task: {6AE473CC-D584-41B7-BBD6-EA9074F368D4} - \EPUpdater No Task File <==== ATTENTION
Task: {AF0B4874-C740-40EA-9F9E-99EA42232E2F} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION
Task: C:\Windows\Tasks\Registry Optimizer.job => C:\Program Files (x86)\WinZip Registry Optimizer\Winzipro.exe


Usun katalog C:\FRST i to wszystko.

raz jeszcze dziekuje. zamykam temat