[中毒] 好像中了加密病毒（勒索病毒？）

看板AntiVirus (防毒)作者geofrania (過勞鼠)時間2年前 (2022/07/10 12:13)推噓6(6推 0噓 9→)

留言15則, 10人參與討論串1/1

我電腦的好像中了加密病毒請問該怎麼救？只有重灌能完全清除病毒嗎？有備份檔，但若直接放回電腦後會不會再度受感染？有人知道KARRHZE檔這是什麼病毒？電腦目前所有WORD檔、EXCEL檔、PDF檔副檔名都變成了KARRHZE檔如下： https://imgur.com/98uraS6

然後都不能開裡面出現了一個README文件文件翻譯如下：您的所有文件照片數據庫和其他重要文件都已加密！ ==================================================== ==================================================== 您的文件沒有損壞！您的文件僅被修改。這種修改是可逆的。解密文件的唯一方法是接收私鑰和解密程序。任何使用第三方軟件恢復文件的嘗試都會對您的文件造成致命影響！ ==================================================== ==================================================== 要接收私鑰和解密程序，請遵循以下說明： 1. 從 https://www.torproject.org/ 下載“Tor 瀏覽器”並安裝它。 2. 在“Tor 瀏覽器”中打開您的個人頁面：http: //da70a6c85c147c1014karrhze.hqi4yxata3v5es3ocbniowfvbzcobro5s5ytk3dxn2rgjerjcjzjceid.onion/karrhze 注意！此頁面僅可通過“Tor 瀏覽器”訪問。 ==================================================== ==================================================== 您也可以在您的個人頁面上使用臨時地址而不使用“Tor 瀏覽器”： http: //da70a6c85c147c1014karrhze.sixtest.quest/karrhze http://da70a6c85c147c1014karrhze.liecut.monster/karrhze http://da70a6c85c147c1014karrhze.turnis.art/karrhze http://da70a6c85c147c1014karrhze.diskwar.tech/karrhze注意！有臨時地址！它們將在有限的時間內可用！原文： ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download 'Tor Browser' from https://www.torproject.org/ and install it. 2. In the 'Tor Browser' open your personal page here: http://da70a6c85c147c1014karrhze.hqi4yxata3v5es3ocbniowfvbzcobro5s5ytk3dxn2rgjerjcjzjceid.onion/karrhze Note! This page is available via 'Tor Browser' only. ==================================================================================================== Also you can use temporary addresses on your personal page without using 'Tor Browser': http://da70a6c85c147c1014karrhze.sixtest.quest/karrhze http://da70a6c85c147c1014karrhze.liecut.monster/karrhze http://da70a6c85c147c1014karrhze.turnis.art/karrhze http://da70a6c85c147c1014karrhze.diskwar.tech/karrhze Note! There are temporary addresses! They will be available for a limited amount of time! -- Now that I ask you earnestly and sincerely, Now you answer me mercifully: "To prevent the world from being destroyed, To protect the peace of the world..." -- ※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 114.43.194.128 (臺灣) ※ 文章網址: https://www.ptt.cc/bbs/AntiVirus/M.1657426402.A.198.html