作者Django (Cython)
看板AntiVirus
标题[问题] 中了勒索病毒可是什麽都没有被加密
时间Fri Aug 19 02:58:55 2016
如题
今天下午出门时还没事
半夜回来我切换到桌面(先前有其他家人在用电脑)
发现中了勒索病毒
NOT YOUR LANGUAGE? USE
https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA4096
More information about the encryption keys using RSA4096 can be found here:
http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA4096 Key , both public
and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been
transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private
key and decrypt program , which is on our Secret Server
What do I do ?
So , there are two ways you can choose: wait for a _miracle_ and get _your_
PRICE DOUBLED! Or start obtaining *BITCOIN NOW! , and restore _YOUR_ _DATA_
easy way
If You have really valuable _DATA_, you better _NOT_ _WASTE_ _YOUR_ _TIME_,
because there is _NO_ other way to get your files, except make a _PAYMENT_
Your personal ID: **********************************
For more specific instructions, please visit your personal home page, there
are a few different addresses pointing to your page below:
1 -
http://j24o****pgaorlxj.onion.to
2 -
http://j24o****pgaorlxj.onion.city
If for some reasons the addresses are not availablweropie, follow these steps:
(网址太多直接拿掉)
可是我再怎麽看 除了桌面被换 多了勒索信的txt跟jpg之外
完全没有东西被加密啊
桌面 c槽 桌面的资料夹 点进去 文件都是好的 打开也都正常的
究竟是怎麽回事@@
其实我的确没啥重要文件可以被勒索的 只是现在我有点犹豫要不要重灌...
还是就不理他把桌面换回来 当作没发生 = =
--
※ 发信站: 批踢踢实业坊(ptt.cc), 来自: 61.230.120.60
※ 文章网址: https://webptt.com/cn.aspx?n=bbs/AntiVirus/M.1471546740.A.EBD.html
1F：→ tsukiyo99: 有的勒索软体开机还会执行 可以先找一下移除工具或扫毒 08/19 03:27
2F：推 bgt5: 可以说一下你觉得是怎麽中这病毒的吗？ 08/19 10:12
目前实在不清楚 中的时候应该是家人在用
他平常就是上网听日文老歌 找歌词
看新闻
不太会下载东西更不会想载片之类的
只是要是不小心点到什麽 他可能也不记得@@
3F：→ dennisxkimo: 高要求的话 电脑被侵犯过 一般都选择备份重灌 08/19 10:38
我其实本来就有打算重灌...因为根本没有什麽重要的东西
只是後来把桌面改掉txt html jpg删掉 今天也没跑出来...
就有点犹豫了
※ 编辑: Django (36.227.254.36), 08/19/2016 12:58:27
4F：推 bgt5: 请问是用ie吗？有锁flash吗？有装防毒？哪牌？ 08/19 13:10
我自己用都是用Chrome 家人都是用ie 後面答案都是no no no
※ 编辑: Django (36.227.254.36), 08/19/2016 13:50:28
5F：推 bgt5: 谢谢你的资讯 08/19 13:56
6F：推 st20511: 应该是CrypMIC,很像CryptXXX，但只会加密C槽以外的档案 08/19 16:41
囧 是这个吗?
http://blog.trendmicro.com.tw/?p=25235#more-25235
※ 编辑: Django (140.112.16.141), 08/19/2016 18:33:35
7F：推 letni: 这个我之前有po文 查一下我的文章 08/19 22:09