GandCrab v5.0.4 (18.11.30)

显示全部楼层 · 发表于 2018-11-30 15:11:58

infected

---= GANDCRAB V5.0.4 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .KUOIWVLP
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/b6314679c4ba3647
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW

复制代码

显示全部楼层 · 发表于 2018-11-30 15:14:15

eset Miss

显示全部楼层 · 发表于 2018-11-30 15:18:47

卡巴扫描MISS

显示全部楼层 · 发表于 2018-11-30 15:21:03

eset Miss

卡巴扫描MISS

显示全部楼层 · 发表于 2018-11-30 15:27:14

显示全部楼层 · 发表于 2018-11-30 15:30:33

火绒

显示全部楼层 · 发表于 2018-11-30 15:38:21

双击后未见反应 wscript和powershell都运行起来但是退出了

可能我电脑上的东西没有价值吧

显示全部楼层 · 发表于 2018-11-30 15:39:18

avast free
执行
idp-block

显示全部楼层 · 发表于 2018-11-30 15:42:00

chrome拦掉了……

显示全部楼层 · 发表于 2018-11-30 15:55:21

KIS2019

30.11.2018 15.53.45;偵測到的物件 ( 處理記憶體 ) 已刪除;c:\users\use\documents\egdownloads\123\123.js;c:\users\use\documents\egdownloads\123\123.js;PDM:Exploit.Win32.Generic.nblk;木馬程式;11/30/2018 15:53:45

复制代码

[病毒样本] GandCrab v5.0.4 (18.11.30)