{"id":6469,"date":"2013-10-17T16:57:05","date_gmt":"2013-10-17T08:57:05","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=6469"},"modified":"2013-10-25T12:15:26","modified_gmt":"2013-10-25T04:15:26","slug":"%e6%9c%80%e6%96%b0%e5%8b%92%e7%b4%a2%e8%bb%9f%e9%ab%94%e8%82%86%e8%99%90%e8%87%ba%e7%81%a3","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=6469","title":{"rendered":"\u7db2\u8def\u5371\u6a5f~\u6700\u65b0\u52d2\u7d22\u8edf\u9ad4\u8086\u8650\u81fa\u7063,\u53d7\u99ed\u8005\u9700\u8981\u652f\u4ed8 $300 \u7f8e\u91d1\u300c\u8d16\u6b3e\u300d\u624d\u80fd\u5c07\u6a94\u6848\u89e3\u5bc6"},"content":{"rendered":"

\u6700\u8fd1\u6709\u8a31\u591a\u4f7f\u7528\u8005\u611f\u67d3\u65b0\u7684\u52d2\u8d16\u8edf\u9ad4\u75c5\u6bd2\uff0c\u906d\u5230\u8a72\u75c5\u6bd2\u611f\u67d3\u5f8c\uff0c\u4f5c\u696d\u7cfb\u7d71\u4e2d\u6709\u591a\u7a2e\u6a94\u6848\u6703\u88ab\u52a0\u5bc6\uff0c\u906d\u5230\u611f\u67d3\u7684\u4f7f\u7528\u8005\u9700\u8981\u652f\u4ed8$300\u7f8e\u91d1\u6216\u6b50\u5143\u300c\u8d16\u6b3e\u300d\u7372\u53d6\u91d1\u9470\u624d\u80fd\u5c07\u6a94\u6848\u89e3\u5bc6\u3002\u53d7\u5bb3\u8005\u6703\u770b\u5230\u4ee5\u4e0b\u8996\u7a97\uff1a
\n\"\u52d2\u7d22\u8edf\u9ad4\u8086\u8650\u81fa\u7063\"<\/a><\/p>\n

\u751a\u81f3\u9023\u684c\u9762\u4e5f\u6703\u88ab\u9396\u5b9a\u800c\u9020\u6210\u7121\u6cd5\u4f7f\u7528\u96fb\u8166\uff08\u5982\u4e0b\u5716\uff09<\/p>\n

\"\u52d2\u7d22\u8edf\u9ad4\u8086\u8650\u81fa\u7063\"<\/a><\/p>\n

\u00a0\u6563\u64ad\u7ba1\u9053\uff1a<\/strong><\/p>\n

\u6b64\u52d2\u8d16\u8edf\u9ad4\u53ef\u80fd\u901a\u904e\u804a\u5929\u5de5\u5177\u3001\u96fb\u5b50\u90f5\u4ef6\u3001\u60e1\u610f\u7db2\u7ad9\u6563\u64ad\uff0c\u6216\u7531\u5176\u4ed6\u75c5\u6bd2\u91cb\u653e\u800c\u4f86\u3002<\/p>\n

\u75c5\u6bd2\u884c\u70ba\uff1a<\/strong><\/p>\n

1.\u00a0\u00a0\u00a0\u00a0\u5c07\u81ea\u5df1\u8907\u88fd\u5f8c\u7f6e\u653e\u5230\u4e0b\u5217\u76ee\u9304\u4e0b\uff1a
\n%Application Data%\\{\u96a8\u6a5f\u5b57\u6bcd\u7684\u6a94\u6848\u540d\u7a31}.exe
\n(\u6ce8\u610f: %Application Data%<\/em> \u662f\u76ee\u524d\u7528\u6236\u7684Application Data\u8cc7\u6599\u593e\uff0c\u5728Windows 2000\u3001XP\u3001Server 2003\u4e2d\u901a\u5e38\u70baC:\\Documents and Settings\\{\u5e33\u865f\u540d\u7a31}\\Application Data\uff0c\u5728Windows 7\u53ca\u4ee5\u4e0a\u7248\u672c\u4f5c\u696d\u7cfb\u7d71\u4e2d\u901a\u5e38\u70ba C:\\Users\\{user name}\\AppData\\Roaming.)\u3002<\/p>\n

2.\u00a0\u00a0\u00a0\u00a0 \u907f\u514d\u81ea\u5df1\u91cd\u8907\u57f7\u884c\u3002<\/p>\n

3.\u00a0\u00a0\u00a0\u00a0 \u6703\u5728\u6a5f\u78bc\u4e2d\u6dfb\u52a0\u81ea\u52d5\u555f\u52d5\u9805\u76ee\u3002
\nHKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
\nCryptoLocker = “%Application Data%\\{\u96a8\u6a5f\u6a94\u6848\u540d\u7a31}.exe”\u3002<\/p>\n

4.\u00a0\u00a0\u00a0\u00a0 \u6703\u65b0\u589e\u4ee5\u4e0b\u767b\u9304\u503c\uff1a
\nHKEY_CURRENT_USER\\Software\\CryptoLocker
\nHKEY_CURRENT_USER\\Software\\CryptoLocker\\Files<\/p>\n

\u00a0\"Ransome3\"<\/a><\/p>\n

\u5176\u4e2d\u5b50\u76ee\u9304\u300cFiles\u300d\u4e2d\u5217\u51fa\u7684\u662f\u5df2\u88ab\u52a0\u5bc6\u7684\u6a94\u6848\u5217\u8868<\/p>\n

 <\/p>\n

5.\u00a0\u00a0\u00a0\u00a0\u8a72\u75c5\u6bd2\u6703\u9023\u63a5\u4ee5\u4e0b\u7db2\u57df\u4ee5\u7372\u53d6\u52a0\u5bc6\u7684\u91d1\u9470\uff1a<\/p>\n

gktibioivpqbot.net
\nmlernipmrlrnjj.com
\nlnjaadfliwshke.info
\nkktvnsdykphojs.co.uk
\njmyeansxbbiibw.org
\nqnamcbakhsitnw.ru
\nppfuovpjxejnoy.biz<\/p>\n

\u9019\u4e9b\u7db2\u57df\u4e2d\u4efb\u610f\u500b\u53ef\u9023\u63a5\u7684\u7db2\u5740\u6700\u7d42\u6703\u6307\u5411IP\u4f4d\u5740 93.189.44.187 \u7684\u4f3a\u670d\u5668\u3002\u3002<\/p>\n

6.\u00a0\u00a0\u00a0\u00a0\u00a0\u5728\u7372\u53d6\u52a0\u5bc6\u91d1\u9470\u5f8c\u4ee5\u4e0b\u985e\u578b\u6a94\u6848\u5c07\u88ab\u52a0\u5bc6\uff1a
\n*.3fr \u00a0*.accdb \u00a0*.arw \u00a0*.bay \u00a0*.cdr \u00a0*.cer \u00a0*.cr2 \u00a0*.crt \u00a0*.crw \u00a0*.dbf \u00a0*.dcr \u00a0*.der *.dng *.doc *.docm *.docx *.dwg *.dxf *.dxg*.eps *.erf *.indd *.kdc *.mdb *.mdf *.mef *.mrw *.nef *.nrw *.odb *.odc *.odm *.odp *.ods *.odt *.orf *.p12 *.p7b *.p7c *.pdd *.pef *.pem *.pfx *.ppt *.pptm *.pptx *.psd *.pst *.ptx *.r3d *.raf \u00a0*.raw *.rtf *.rw2 *.rwl *.sr2 *.srf *.srw *.wb2 *.wpd *.wps *.x3f *.xlk *.xls *.xlsb *.xlsm \u00a0*.xlsx<\/p>\n

7. \u52d2\u7d22\u8005\u63a5\u53d7\u4ee5\u4e0b\u4ed8\u6b3e\u65b9\u5f0f\uff1a<\/p>\n

Bitcoin
\ncashU
\nMoneyPak
\nUkash<\/p>\n

\u9632\u8b77\u63aa\u65bd\uff1a<\/strong><\/p>\n

1.\u00a0\u00a0\u00a0\u00a0 \u5f9e\u9598\u9053\u8655\u963b\u6b62\u9023\u63a5\u60e1\u610f\u7db2\u5740\uff08\u4e0a\u8ff0\u7b2c\u4e94\u9805\u4e2d\u4e4b\u7db2\u57df\u53caIP\uff09\uff1b
\n2.\u00a0\u00a0\u00a0\u00a0 \u4fdd\u6301\u9632\u6bd2\u8edf\u9ad4\u75c5\u6bd2\u78bc\u66f4\u65b0\u81f3\u6700\u65b0\uff1b
\n3.\u00a0\u00a0\u00a0\u00a0 \u8acb\u52ff\u96a8\u610f\u9ede\u95b1\u4f86\u6e90\u4e0d\u660e\u7684\u90f5\u4ef6\u9644\u4ef6\uff1b
\n4.\u00a0\u00a0\u00a0\u00a0 \u8acb\u52ff\u96a8\u610f\u63a5\u6536\u4e26\u57f7\u884c\u804a\u5929\u5de5\u5177\u4e2d\u767c\u9001\u7684\u6a94\u6848\uff08\u5305\u62ec\u5716\u7247\u6a94\u6216office\u6a94\u6848\uff09\uff1b
\n5.\u00a0\u00a0\u00a0\u00a0 \u8acb\u52ff\u96a8\u610f\u700f\u89bd\u672a\u77e5\u7684\u570b\u5916\u7db2\u7ad9\uff0c\u5c24\u5176\u662f\u60c5\u8272\u7db2\u7ad9\u6216\u591a\u5a92\u9ad4\u4e0b\u8f09\u7db2\u7ad9\uff1b
\n6.\u00a0\u00a0\u00a0\u00a0 \u8acb\u5b9a\u671f\u5099\u4efd\u91cd\u8981\u6a94\u6848\u3002<\/p>\n

\u89e3\u6c7a\u65b9\u6cd5\uff1a<\/strong><\/p>\n