Follow along with the video below to see how to install our site as a web app on your home screen.
Примечание: This feature may not be available in some browsers.
Внимание. Восстановление баз 1С7, 1C8 и Mssql после атаки шифровальщика, подробности и отзывы читайте в профильной теме.
Внимание. Восстановление архивов RAR и ZIP, образов Acronis и виртуальных машин, баз почтовых программ после атаки шифровальщика, подробности и отзывы читайте в профильной теме.
Start::
CreateRestorePoint:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
2019-10-31 02:53 - 2019-10-31 02:53 - 000000172 _____ C:\Users\User\AppData\Roaming\kWYZrzIYZR.html
2019-10-31 02:52 - 2019-10-31 02:52 - 000004969 _____ C:\Users\User\Desktop\=_BACK_FILES_~.html
2019-10-31 02:51 - 2019-10-31 02:52 - 000004969 _____ C:\Users\User\Documents\=_BACK_FILES_~.html
2019-10-31 02:51 - 2019-10-31 02:52 - 000004969 _____ C:\Users\User\AppData\Roaming\=_BACK_FILES_~.html
2019-10-31 02:51 - 2019-10-31 02:52 - 000004969 _____ C:\Users\User\AppData\LocalLow\=_BACK_FILES_~.html
2019-10-31 02:48 - 2019-10-31 02:52 - 000004969 _____ C:\Users\User\AppData\Local\=_BACK_FILES_~.html
2019-10-31 02:48 - 2019-10-31 02:52 - 000004969 _____ C:\Users\User\AppData\=_BACK_FILES_~.html
2019-10-31 02:48 - 2019-10-31 02:52 - 000004969 _____ C:\Users\User\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Public\Documents\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Public\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\DefaultAppPool\Documents\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\DefaultAppPool\AppData\Roaming\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\DefaultAppPool\AppData\Local\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\DefaultAppPool\AppData\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\DefaultAppPool\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Default\Documents\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Default\AppData\Roaming\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Default\AppData\Local\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Default\AppData\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Default\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Default User\Documents\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Default User\AppData\Roaming\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Default User\AppData\Local\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Default User\AppData\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Default User\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Classic .NET AppPool\Documents\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Classic .NET AppPool\AppData\Roaming\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Classic .NET AppPool\AppData\Local\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Classic .NET AppPool\AppData\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Classic .NET AppPool\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v4.5\Documents\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v4.5\AppData\Roaming\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v4.5\AppData\Local\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v4.5\AppData\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v4.5\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v4.5 Classic\Documents\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v4.5 Classic\AppData\Roaming\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v4.5 Classic\AppData\Local\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v4.5 Classic\AppData\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v4.5 Classic\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v2.0\Documents\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v2.0\AppData\Roaming\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v2.0\AppData\Local\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v2.0\AppData\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v2.0\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v2.0 Classic\Documents\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v2.0 Classic\AppData\Roaming\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v2.0 Classic\AppData\Local\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v2.0 Classic\AppData\=_BACK_FILES_~.html
2019-10-31 02:47 - 2019-10-31 02:52 - 000004969 _____ C:\Users\.NET v2.0 Classic\=_BACK_FILES_~.html
2019-10-31 02:46 - 2019-10-31 02:52 - 000004969 _____ C:\Users\Все пользователи\=_BACK_FILES_~.html
2019-10-31 02:46 - 2019-10-31 02:52 - 000004969 _____ C:\ProgramData\=_BACK_FILES_~.html
2019-10-31 02:42 - 2019-10-31 02:52 - 000004969 _____ C:\Program Files (x86)\=_BACK_FILES_~.html
2019-10-31 02:40 - 2019-10-31 02:52 - 000004969 _____ C:\Program Files\Common Files\=_BACK_FILES_~.html
2019-10-31 02:37 - 2019-10-31 02:52 - 000004969 _____ C:\Program Files\=_BACK_FILES_~.html
2019-10-31 02:36 - 2019-10-31 02:52 - 000004969 _____ C:\=_BACK_FILES_~.html
2019-10-31 02:36 - 2019-10-31 02:36 - 000001612 _____ C:\Users\User\Documents\kfGnrbH.html
2019-10-31 02:36 - 2019-10-31 02:36 - 000001612 _____ C:\Users\User\AppData\Roaming\kfGnrbH.html
2019-10-31 02:36 - 2019-10-31 02:36 - 000001612 _____ C:\Program Files\kfGnrbH.html
2019-10-31 02:36 - 2019-10-31 02:36 - 000000002 _____ C:\Users\User\AppData\Roaming\GavyZYQ.html
FirewallRules: [TCP Query User{48273817-E8F1-438A-87BA-8AEFA71AC6F0}C:\users\user\downloads\anydesk.exe] => (Allow) C:\users\user\downloads\anydesk.exe No File
FirewallRules: [UDP Query User{DB791D82-C3C7-423F-A68A-E8669A7F26D1}C:\users\user\downloads\anydesk.exe] => (Allow) C:\users\user\downloads\anydesk.exe No File
Reboot:
End::
из интересного там только батник который удаляет файл (по идее тело шифровальщика) v4_40_.exeТак же нашел следующие файлы в папке "Изображения"