Welcome Guest ( Log In | Register )

3 Pages V   1 2 3 >  
 Reply to this topicStart new topic
> Trojan.ransom.hm, .EnCiPhErEd.
Rating 5 V
Doru_Neo
post Apr 16 2012, 06:52 AM
Post #1


Newbie


Group: Members
Posts: 3
Joined: 16-April 12
Member No.: 103,512
Buna ziua
Am avut un virus pe calculator cred ca Trojan.Ransom.HM am folosit Bitdefender IS 2012 s-a eliminat virusul dar marea majoritate a fisierelor din calculator sunt criptate si au extensia .EnCiPhErEd. Am nevoie de un utilitar pentru decriptare
Go to the top of the page
 
+Quote Post
Christian
post Apr 16 2012, 07:11 AM
Post #2


Bitdefender Support
******

Group: Root Admin
Posts: 13,563
Joined: 27-January 08
From: BitDefender HQ
Member No.: 9,374
Salut Doru (IMG:style_emoticons/default/smile.gif)

Bine ai venit pe forum.

Lucram la asta, revin in cateva ore cu un raspuns.

Multumim.
Go to the top of the page
 
+Quote Post
Doru_Neo
post Apr 16 2012, 07:59 AM
Post #3


Newbie


Group: Members
Posts: 3
Joined: 16-April 12
Member No.: 103,512
Ok astept un raspuns, am mare nevoie de o solutie. Am incercat un utilitar te94decrypt dar fara nici un rezultat
Go to the top of the page
 
+Quote Post
Christian
post Apr 16 2012, 08:12 AM
Post #4


Bitdefender Support
******

Group: Root Admin
Posts: 13,563
Joined: 27-January 08
From: BitDefender HQ
Member No.: 9,374
Salut (IMG:style_emoticons/default/smile.gif)

Utilitarul o sa fie gata in cam 48 ore.

Multumim.
Go to the top of the page
 
+Quote Post
Doru_Neo
post Apr 16 2012, 03:38 PM
Post #5


Newbie


Group: Members
Posts: 3
Joined: 16-April 12
Member No.: 103,512
Dr. Web s-a miscat mai repede (IMG:style_emoticons/default/rolleyes.gif)
Raspunsul lui:

Start it with commandline params -k 87
Report to the Police."

La mine a functionat pe cateva fisiere urmeaza sa aplic la toate datele.
Reason for edit: link scos
Go to the top of the page
 
+Quote Post
Christian
post Apr 17 2012, 06:44 AM
Post #6


Bitdefender Support
******

Group: Root Admin
Posts: 13,563
Joined: 27-January 08
From: BitDefender HQ
Member No.: 9,374
Salut Doru (IMG:style_emoticons/default/smile.gif)

Multumim pentru feedback.

Daca mai ai intrebari, te rog nu ezita.

O zi placuta!
Go to the top of the page
 
+Quote Post
tudose sorin
post Apr 17 2012, 09:28 AM
Post #7


Newbie


Group: Members
Posts: 5
Joined: 17-April 12
Member No.: 103,610
salutare, ati reusit sa faceti utilitarul pt fisierele criptate? multumes


QUOTE (Christian @ Apr 17 2012, 10:09 AM) *
Salut Doru (IMG:style_emoticons/default/smile.gif)

Multumim pentru feedback.

Daca mai ai intrebari, te rog nu ezita.

O zi placuta!
Go to the top of the page
 
+Quote Post
Christian
post Apr 17 2012, 09:37 AM
Post #8


Bitdefender Support
******

Group: Root Admin
Posts: 13,563
Joined: 27-January 08
From: BitDefender HQ
Member No.: 9,374
Salut Sorin (IMG:style_emoticons/default/smile.gif)

Bine ai venit pe forum.

Revin cu un raspuns in maxim 3 ore, multumim pentru rabdare.

O zi buna!
Go to the top of the page
 
+Quote Post
Divine_One
post Apr 17 2012, 09:57 AM
Post #9


Newbie


Group: Members
Posts: 3
Joined: 17-April 12
Member No.: 103,612
QUOTE (Christian @ Apr 17 2012, 01:02 PM) *
Salut Sorin (IMG:style_emoticons/default/smile.gif)

Bine ai venit pe forum.

Revin cu un raspuns in maxim 3 ore, multumim pentru rabdare.

O zi buna!


Salut,

Eu i-am contactat pe cei de la drweb in legatura cu problema mentionata pe data de 09 Aprilie si le-am si trimis niste fisiere pentru a incerca sa le decodeze. Din pacate utilitarul lor nu functioneaza pe fisierele ce au fost sterse si recuperate ulterior (gen unerased) - fisierele se corup in timpul conversiei. Am incercat acelasi utilitar si pe un fisier ce il aveam copiat local inainte sa se apuce unii inteligenti sa stearga fisierele .enciphered si pe acesta a functionat cu succes. Intrebarea mea este daca utilitarul pe care vreti voi sa il scoateti se va baza pe cel al celor de la drweb (aceasi metoda de decriptare) sau mergeti pe alta idee pentru a incerca sa il folosesc si eu pe fisierele recuperate cu unerase-ul.
Multumesc pentru raspuns!
Go to the top of the page
 
+Quote Post
tudose sorin
post Apr 17 2012, 11:01 AM
Post #10


Newbie


Group: Members
Posts: 5
Joined: 17-April 12
Member No.: 103,610
Multumesc pentru raspuns, eu nu am sters nimica de pe calculator dar toate documentele, fotografiile si linkurile sunt criptate.
eu am primit mesajul acesta:
ttention! All your files are encrypted!
You are using unlicensed programs!
To restore your files and access them,
send code Ukash or Paysafecard nominal value of EUR 50 to the e-mail Koeserg@gmail.com.
During the day you receive the answer with the code.
You have 5 attempts to enter the code. If you exceed this date all data is irretrievably spoiled. Be careful when you enter the code!
Go to the top of the page
 
+Quote Post
Divine_One
post Apr 17 2012, 11:21 AM
Post #11


Newbie


Group: Members
Posts: 3
Joined: 17-April 12
Member No.: 103,612
QUOTE (tudose sorin @ Apr 17 2012, 02:26 PM) *
Multumesc pentru raspuns, eu nu am sters nimica de pe calculator dar toate documentele, fotografiile si linkurile sunt criptate.
eu am primit mesajul acesta:
ttention! All your files are encrypted!
You are using unlicensed programs!
To restore your files and access them,
send code Ukash or Paysafecard nominal value of EUR 50 to the e-mail Koeserg@gmail.com.
During the day you receive the answer with the code.
You have 5 attempts to enter the code. If you exceed this date all data is irretrievably spoiled. Be careful when you enter the code!


Daca nu ai sters nimik, copiaza tool-ul asta de aici:

Deschizi cmd prompt din run mergi la locatia unde ai copiat fisierul downloadat si rulezi comanda urmatoare:



O sa iti decodeze toate fisierele .enciphered...la mine nu merge ca au fost sterse si recuperate...

This post has been edited by Christian: Apr 17 2012, 11:27 AM
Reason for edit: link scos
Go to the top of the page
 
+Quote Post
Christian
post Apr 17 2012, 11:44 AM
Post #12


Bitdefender Support
******

Group: Root Admin
Posts: 13,563
Joined: 27-January 08
From: BitDefender HQ
Member No.: 9,374
Salut Sorin (IMG:style_emoticons/default/smile.gif)

Cum nu pot sa te ajut via PM, o sa iti creez un tichet in sistem cu adresa de email cu care te-ai inregistrat pe forum si iti trimit in maxim 30 minute utilitarul atasat cu instructiuni.

Tichet: 201204171015321

Multumim.
Go to the top of the page
 
+Quote Post
Christian
post Apr 17 2012, 11:58 AM
Post #13


Bitdefender Support
******

Group: Root Admin
Posts: 13,563
Joined: 27-January 08
From: BitDefender HQ
Member No.: 9,374
Salut (IMG:style_emoticons/default/smile.gif)

Am revenit, mailul ajunge in 5 minute, multumim pentru rabdare.

O zi placuta!
Go to the top of the page
 
+Quote Post
Divine_One
post Apr 17 2012, 11:59 AM
Post #14


Newbie


Group: Members
Posts: 3
Joined: 17-April 12
Member No.: 103,612
QUOTE (Christian @ Apr 17 2012, 03:09 PM) *
Salut Sorin (IMG:style_emoticons/default/smile.gif)

Cum nu pot sa te ajut via PM, o sa iti creez un tichet in sistem cu adresa de email cu care te-ai inregistrat pe forum si iti trimit in maxim 30 minute utilitarul atasat cu instructiuni.

Tichet: 201204171015321

Multumim.


Salut,

Sa inteleg ca tool-ul pe care il dezvoltati nu va fi disponibil pentru toata lumea? Am avut si eu o intrebare mai devreme, macar un "da" sau "nu" se poate?

Merci!
Go to the top of the page
 
+Quote Post
Christian
post Apr 17 2012, 01:34 PM
Post #15


Bitdefender Support
******

Group: Root Admin
Posts: 13,563
Joined: 27-January 08
From: BitDefender HQ
Member No.: 9,374
Salut la toata lumea (IMG:style_emoticons/default/smile.gif)

Am trimis lui Sorin utilitarul, l-ai primit?

Tool-ul o sa fie in curand disponibil pentru toata lumea, momentan doar pentru cei ce ne contacteaza o sa fie trimis pe email.

Multumim pentru intelegere.
Go to the top of the page
 
+Quote Post
Christian
post Apr 17 2012, 02:13 PM
Post #16


Bitdefender Support
******

Group: Root Admin
Posts: 13,563
Joined: 27-January 08
From: BitDefender HQ
Member No.: 9,374
Salutare

Momentan, utilitarul a fost urcat aici:

http://www.malwarecity.com/community/index...amp;showfile=57

Este o locatie temporara, o sa fie lansat oficial in cateva zile.

Este numai pentru acest ransomware:

http://www.malwarecity.com/blog/ransomware...ansom-1280.html

Din motive de siguranta, utilitarul nu sterge fisierele criptate.

Multumim.
Go to the top of the page
 
+Quote Post
tudose sorin
post Apr 18 2012, 09:49 AM
Post #17


Newbie


Group: Members
Posts: 5
Joined: 17-April 12
Member No.: 103,610
Salutare, am primit utilitarul, multumesc mult. Am reusit sa decriptez fisierele dar sunt toate duplicate si e o munca f mare. De dimineata ma chinui sa le sterg si sa le redenumesc (am 3 extensii doc, doc(0) si .EnCiPhErEd si doar cele cu doc(0) sunt cele decriptate) si sunt cam in jur de 12000 de documente, fotografii, pdf si baze de date de la pragrame de conta...
Go to the top of the page
 
+Quote Post
Christian
post Apr 18 2012, 10:19 AM
Post #18


Bitdefender Support
******

Group: Root Admin
Posts: 13,563
Joined: 27-January 08
From: BitDefender HQ
Member No.: 9,374
Salut Sorin (IMG:style_emoticons/default/smile.gif)

Utilitarul a fost facut la cerere(cand a fost deschis topicul aici) in foarte putin timp si dupa cum vezi nu este chiar finisat(nu are interfata grafica).

Colegul meu de la laboratoare a muncit ceva la el, luand malware-ul, reusind sa-l sparga si sa scoata cheia de decriptare.

Asa cum am spus mai sus, utilitarul inca nu sterge fisierele criptate din motive de siguranta, nu vrem sa punem in pericol datele clientului.

Se lucreaza la o versiune oficiala, dar nu pot sa iti spun mai multe acum.

Poti sa folosesti un software extern sau Windows Search sa stergi acele fisiere.

Cauta dupa

QUOTE
*.EnCiPhErEd


in tot sistemul, selecteaza toate o data si apasa Delete.

O zi buna!
Go to the top of the page
 
+Quote Post
tudose sorin
post Apr 18 2012, 10:48 AM
Post #19


Newbie


Group: Members
Posts: 5
Joined: 17-April 12
Member No.: 103,610
M-am descurcat cu utilitare de find and rename;)
Go to the top of the page
 
+Quote Post
silviung
post Apr 18 2012, 02:31 PM
Post #20


Newbie


Group: Members
Posts: 2
Joined: 18-April 12
Member No.: 103,674
Buna ziua, as dori si eu utilitarul daca se poate
Go to the top of the page
 
+Quote Post
« Next Oldest · Devirusare · Next Newest »
 

3 Pages V   1 2 3 >
Reply to this topicStart new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

 

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

RSS Lo-Fi Version Time is now: 19th June 2013 - 09:27 AM
Powered By IP.Board © 2013  IPS, Inc.