lecp 0 Posted December 8, 2016 Report Share Posted December 8, 2016 Hi, looks like we have had a server compromised through RDP, I don't suppose they left any keys lying around?? Thanks for any help in advance. Cheers. scan_161208-211744.txt FRST.txt Addition.txt DBCE17647B35F3A842D442D8A0FBE538C0.TXT Encrypted File.zip Unencrypted Copy.zip Link to post Share on other sites
Kevin Zoll 309 Posted December 8, 2016 Report Share Posted December 8, 2016 Hello, It is highly unlikely that they left any encryption keys behind. Make sure that RDP is configured properly and change all passwords on this server. You can try using our Apocalypse decryption tool https://decrypter.emsisoft.com/apocalypse Not that Apocalypse implements the Windows CryptoAPI in a flawed manner resulting in a 1-in-3 chance that the files were encrypted using garbage data, making the files undecryptable. Copy the below code to Notepad; Save As fixlist.txt to your Desktop. HKLM\...\Policies\Explorer: [ShowSuperHidden] 1 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 2016-12-08 15:38 - 2016-12-08 15:38 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\nssE2D4.tmp 2016-12-08 15:38 - 2016-12-08 15:38 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\~nsu.tmp 2016-12-08 15:04 - 2016-12-08 15:04 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\{465DDE98-DC37-419B-A8AE-E5BD95AB3144} 2016-12-08 15:04 - 2007-01-20 06:46 - 00455600 _____ (Macrovision Corporation) C:\Users\Administrator\AppData\Local\Temp\_is90BC.exe 2016-12-08 14:33 - 2016-12-06 10:14 - 00720085 ____N C:\Users\Administrator\AppData\Local\Temp\_iu14D2N.tmp 2016-12-08 12:55 - 2016-12-08 20:53 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\1 2016-12-06 14:43 - 2016-12-06 15:21 - 00228200 _____ (Bitdefender) C:\Users\Administrator\AppData\Local\Temp\pss5006.tmp 2016-12-06 12:16 - 2016-12-06 12:16 - 00016384 _____ C:\Users\Administrator\AppData\Local\Temp\~DF049AB729B4EE748B.TMP 2016-12-06 11:22 - 2016-12-06 11:22 - 00016384 _____ C:\Users\Administrator\AppData\Local\Temp\~DF11C26362DD6CF806.TMP 2016-12-06 11:05 - 2016-12-06 11:05 - 00016384 _____ C:\Users\Administrator\AppData\Local\Temp\~DF2D59C60A31B9EC7C.TMP 2016-12-04 01:21 - 2016-12-04 01:21 - 00001408 _____ C:\DBCE17647B35F3A842D442D8A0FBE538C0.TXT 2016-11-08 15:47 - 2016-12-06 10:03 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\{15A46CFA-BBE3-496D-A375-1AC227583B8C} 2016-11-08 15:47 - 2016-11-08 15:50 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\{3B85F3EE-4B25-4C40-93EA-BF5D5EAF349B} 2016-11-08 15:49 - 2016-06-09 18:09 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\{7D198B6F-187F-4FED-B97A-E6214345E416} 2012-05-29 13:50 - 2012-05-29 13:50 - 0001733 _____ () C:\Users\Administrator\AppData\Local\axejejif.dll 2012-05-30 14:03 - 2012-05-30 14:03 - 0001744 _____ () C:\Users\Administrator\AppData\Local\ekitejed.dll 2012-05-30 12:45 - 2012-05-30 12:45 - 0001735 _____ () C:\Users\Administrator\AppData\Local\uzufokeyibewere.dll MSCONFIG\startupreg: Decryption Instructions => C:\Windows\system32\notepad.exe "C:\DBCE17647B35F3A842D442D8A0FBE538C0.TXT" Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{0A45DB4D-BD0D-11D2-8D14-00104B9E072A}" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{0A45DB4D-BD0D-11D2-8D14-00104B9E072A}" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E91E27A2-C5AE-11D2-8D1B-00104B9E072A}" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{E91E27A2-C5AE-11D2-8D1B-00104B9E072A}" /fClose Notepad.NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST64 and press the Fix button just once and wait. If the tool needed a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply. Note: If the tool warns you about an outdated version please download and run the updated version. Link to post Share on other sites
Kevin Zoll 309 Posted December 12, 2016 Report Share Posted December 12, 2016 Thread Closed Reason: Lack of Response PM either Kevin, Elise, or Arthur to have this thread reopened. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE if you don't we are just going to send you back to this thread. Link to post Share on other sites
Recommended Posts