- Katılım
- 17 Mayıs 2013
- Mesajlar
- 1.538
- Tepkime puanı
- 0
- Puan
- 0
nasıl yedim bilmiyorum ama win10 güncelleme ile ilgili olabiliyormuş..
internete araştırma yaptım saadece nasıl silinebilir onu yazıyor ama dosyalarımı nasıl kurtarabilirm onda pek bişey bulamadım.
700 usd istiyorlar dosyaları geri acmak icin. muhtemelen acmazlar parasını ödesem bile. bitcoin üzerine istiyorlar.
istanbulda veya sizlerden bu işi professyonal yapabilen varmı ? dosyalarımı kurtarabilmem icin. (ücretli)
"The following is current technical details we have on the infection:
Encryption based on elliptic curves
Infection file is stored in the %Temp% folder as a random file name. For example, utrswsb.exe.
A hidden and random named job is created that launches the malware executable when you logon. You can view the jobs by selecting Show Hidden Tasks.
When the infection starts it will show you a screen that tells you how much time is left before you are no longer able to pay the ransom
Encrypts all of your data files and saves them as a file with a .ctbl extension.
Generates a user id for your infected computer. This user id will be embedded in a variety of filenames listed below.
Creates a image file called AllFilesAreLocked <user_id>.bmp in the My Documents/Documents folder that the infection will use as your wall paper. This contains the ransom alert.
Creates a text file called DecryptAllFiles <user_id>.txt in the My Documents/Documents folder that contains ransom instructions.
Creates a html file called <random name>.html in the My Documents/Documents folder that contains ransom instructions.
Ransom notes contain a personal key that you must input in a TOR decryption site that will then tell you how to to pay the ransom.
Ransoms are paid in bitcoins and the addresses are randomly generated.
You have 72 hours to pay the ransom.
Current rate of the ransom .2 BTC or about $120 USD.
Detected by Kaspersky as Trojan-Ransom.Win32.Onion. Also known as Critroni
Communicates with the C2 server via TOR network.
On reboot will copy itself to a new name in the %Temp% folder and create a new job to launch it.
Screenshot of the ransom screen is below:"
internete araştırma yaptım saadece nasıl silinebilir onu yazıyor ama dosyalarımı nasıl kurtarabilirm onda pek bişey bulamadım.
700 usd istiyorlar dosyaları geri acmak icin. muhtemelen acmazlar parasını ödesem bile. bitcoin üzerine istiyorlar.
istanbulda veya sizlerden bu işi professyonal yapabilen varmı ? dosyalarımı kurtarabilmem icin. (ücretli)
"The following is current technical details we have on the infection:
Encryption based on elliptic curves
Infection file is stored in the %Temp% folder as a random file name. For example, utrswsb.exe.
A hidden and random named job is created that launches the malware executable when you logon. You can view the jobs by selecting Show Hidden Tasks.
When the infection starts it will show you a screen that tells you how much time is left before you are no longer able to pay the ransom
Encrypts all of your data files and saves them as a file with a .ctbl extension.
Generates a user id for your infected computer. This user id will be embedded in a variety of filenames listed below.
Creates a image file called AllFilesAreLocked <user_id>.bmp in the My Documents/Documents folder that the infection will use as your wall paper. This contains the ransom alert.
Creates a text file called DecryptAllFiles <user_id>.txt in the My Documents/Documents folder that contains ransom instructions.
Creates a html file called <random name>.html in the My Documents/Documents folder that contains ransom instructions.
Ransom notes contain a personal key that you must input in a TOR decryption site that will then tell you how to to pay the ransom.
Ransoms are paid in bitcoins and the addresses are randomly generated.
You have 72 hours to pay the ransom.
Current rate of the ransom .2 BTC or about $120 USD.
Detected by Kaspersky as Trojan-Ransom.Win32.Onion. Also known as Critroni
Communicates with the C2 server via TOR network.
On reboot will copy itself to a new name in the %Temp% folder and create a new job to launch it.
Screenshot of the ransom screen is below:"
Son düzenleme:
win10 güncellemesi yapmıştım win8 duruyor en son secenek olarak win8 e geri dönüş yapmayı denerim..