Tablitsa infection

[edgi]

Today caught exactly the same virus on the server. database and ms word exel encrypted.

But in these files: 

Tablitsa.xls.id-{VDVPQGVKFVNFVJYNCRHYMBPESGWNCQETHWLD-30.07.2014 1 @ 26 @ 39464585}-email-deskr1000 @ gmail.com.cbf

 

Malwarebytes Anti-Malwarewww.malwarebytes.orgПроверка Дата: 30.07.2014Время сканирования: 16:11:52Logfile: 11111.txtАдминистратор: ДаВерсия: 2.00.2.1012Malware Database: v2014.07.30.03Rootkit Database: v2014.07.17.01Лицензия: БесплатноЗащита от вредоносных программ: ИнвалидовЗащита вредоносных веб-сайтов: ИнвалидовSelf-protection: ИнвалидовOS: Windows Server 2008 R2 Service Pack 1ПРОЦЕССОР: x64Файловая система: NTFSПользователь: ????????????N?N?N??°N???N?Тип сканирования: Угроза сканированияРезультат: ЗавершеноПроверенных объектов: 1282641Прошедшее время: 15 мин, 40 секПамять: ВключеноЗапуск: ВключеноFilesystem: ВключеноАрхивы: ВключеноРуткиты: ИнвалидовHeuristics: ВключеноЩЕНОК: WarnPUM: ВключеноПроцессы: 0(No malicious items detected)Модули: 0(No malicious items detected)Ключи реестра: 0(No malicious items detected)Значения реестра: 0(No malicious items detected)Данные реестра: 0(No malicious items detected)Папки: 0(No malicious items detected)Файлы: 1Trojan.Ransom.FC, C:\Users\USR1CV82\AppData\Local\Temp\18\RarLab\explorer.exe, , [affcd9ccb6c50432232f5059ad57ca36], Physical Sectors: 0(No malicious items detected)(end)

 

[edgi]

English

[edgi]

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 30.07.2014

Scan Time: 16:11:52

Logfile: 11111.txt

Administrator: Yes

Version: 2.00.2.1012

Malware Database: v2014.07.30.03

Rootkit Database: v2014.07.17.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows Server 2008 R2 Service Pack 1

CPU: x64

File System: NTFS

User: Administrator

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 1282641

Time Elapsed: 15 min, 40 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Warn

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 1

Trojan.Ransom.FC, C:\Users\USR1CV82\AppData\Local\Temp\18\RarLab\explorer.exe, , [affcd9ccb6c50432232f5059ad57ca36],

Physical Sectors: 0

(No malicious items detected)

(end)

[edgi]

1.  Log set 1 Farbar RST

2. Log Set 2 mbam-check log

 

FRST.txt

Addition.txt

11111.txt

[Firefox]

Hi, and , edgi:

Sorry to hear you are having issues.

Each computer is unique.

Problems that sound "the same" most often are not.

The same is true for solutions.

They most often need to be individualized.

It is less confusing for everyone if we try to stick to "one user per topic".

Please start a NEW, SEPARATE topic using the button. (where we can help you in your own topic)

The staff and experts will be able to more easily provide both you and the OP with individual help to get you both up and running.

Thanks for your patience and understanding,

Firefox

That being said....

Your computer is most likely infected, feel free to follow the instructions below to receive free, one-on-one expert assistance in checking your system and clearing out any infections and correcting any damage done by the malware.

Please see the following pinned topic which has information on how to get help with this: Available Assistance for Possibly Infected Computers

Thank you

[AdvancedSetup]

Hello and

 

OS: Windows Server 2008 R2 Service Pack 1

 

As this is a business system you should contact Business Support and they can assist you. The 2.0 product has not been released for business and the use of the Consumer version in a business is against the End User License Agreement.

 

http://www.malwarebytes.org/support/business/contact/

 

Thank you