求救!!!
我的電腦中毒了，
許多檔案的附檔名被增加了hcoxnfmb名稱，
刪除.hcoxnfmb後，
檔案均無法開啟，
請問有人會解嗎？
然後我發現這是勒索病毒，以下文章是在每個檔案夾裡面都有的readme檔案的勒索信。
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://e2a4b04812c48a10707.dzygpxj7khphhv6v.onion/hcoxnfmb
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://e2a4b04812c48a10707.keyever.site/hcoxnfmb
http://e2a4b04812c48a10707.menkeys.wales/hcoxnfmb
http://e2a4b04812c48a10707.cslead.fun/hcoxnfmb
http://e2a4b04812c48a10707.walkone.space/hcoxnfmb
Note! These are temporary addresses! They will be available for a limited amount of time!
readme病毒 在 [中毒] 好像中了加密病毒（勒索病毒？） - 看板AntiVirus 的推薦與評價
我電腦的好像中了加密病毒
請問該怎麼救？只有重灌能完全清除病毒嗎？
有備份檔，但若直接放回電腦後會不會再度受感染？
有人知道KARRHZE檔這是什麼病毒？
電腦目前所有WORD檔、EXCEL檔、PDF檔副檔名都變成了KARRHZE檔
如下：
然後都不能開
裡面出現了一個README文件
文件翻譯如下：
您的所有文件照片數據庫和其他重要文件都已加密！
====================================================
====================================================
您的文件沒有損壞！您的文件僅被修改。這種修改是可逆的。
解密文件的唯一方法是接收私鑰和解密程序。
任何使用第三方軟件恢復文件的嘗試都會對您的文件造成致命影響！
====================================================
====================================================
要接收私鑰和解密程序，請遵循以下說明：
1. 從 https://www.torproject.org/ 下載“Tor 瀏覽器”並安裝它。
2. 在“Tor 瀏覽器”中打開您的個人頁面：http:
//da70a6c85c147c1014karrhze.hqi4yxata3v5es3ocbniowfvbzcobro5s5ytk3dxn2rgjerjcjzjceid.onion/karrhze
注意！此頁面僅可通過“Tor 瀏覽器”訪問。
====================================================
====================================================
您也可以在您的個人頁面上使用臨時地址而不使用“Tor 瀏覽器”： http:
//da70a6c85c147c1014karrhze.sixtest.quest/karrhze
https://da70a6c85c147c1014karrhze.liecut.monster/karrhze
https://da70a6c85c147c1014karrhze.turnis.art/karrhze
https://da70a6c85c147c1014karrhze.diskwar.tech/karrhze注意！有臨時地址！它們將
在有限的時間內可用！
原文：
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN
ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification
is reversible.
The only 1 way to decrypt your files is to receive the private key and
decryption program.
Any attempts to restore your files with the third party software will be
fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions
below:
1. Download 'Tor Browser' from https://www.torproject.org/ and install it.
2. In the 'Tor Browser' open your personal page here:
https://da70a6c85c147c1014karrhze.hqi4yxata3v5es3ocbniowfvbzcobro5s5ytk3dxn2rgjerjcjzjceid.onion/karrhze
Note! This page is available via 'Tor Browser' only.
====================================================================================================
Also you can use temporary addresses on your personal page without using 'Tor
Browser':
https://da70a6c85c147c1014karrhze.sixtest.quest/karrhze
https://da70a6c85c147c1014karrhze.liecut.monster/karrhze
https://da70a6c85c147c1014karrhze.turnis.art/karrhze
https://da70a6c85c147c1014karrhze.diskwar.tech/karrhze
Note! There are temporary addresses! They will be available for a limited
amount of time!
--
Now that I ask you earnestly and sincerely,
Now you answer me mercifully:
"To prevent the world from being destroyed,
To protect the peace of the world..."
--
※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 114.43.194.128 (臺灣)
※ 文章網址: https://www.ptt.cc/bbs/AntiVirus/M.1657426402.A.198.html
... <看更多>