{"id":3047,"date":"2013-10-14T11:01:33","date_gmt":"2013-10-14T03:01:33","guid":{"rendered":"http:\/\/w3c.weblink.com.tw\/ks010\/?p=3047"},"modified":"2013-10-14T12:03:22","modified_gmt":"2013-10-14T04:03:22","slug":"%e3%80%90%e6%83%a1%e6%84%8f%e7%a8%8b%e5%bc%8f%e3%80%91%e5%8b%92%e8%b4%96%e8%bb%9f%e9%ab%94-troj_ceeinject-ea-%e6%88%96-troj_crilock-af","status":"publish","type":"post","link":"https:\/\/w3c.weblink.com.tw\/ks010\/?p=3047","title":{"rendered":"\u3010\u60e1\u610f\u7a0b\u5f0f\u3011\u52d2\u8d16\u8edf\u9ad4 – TROJ_CEEINJECT.EA \u6216 TROJ_CRILOCK.AF"},"content":{"rendered":"\n\n\n\n
\n

\u75c5\u6bd2\u901a\u77e5 – \u6700\u65b0\u52d2\u8d16\u8edf\u9ad4 (TROJ_CEEINJECT.EA \u6216 TROJ_CRILOCK.AF)<\/strong><\/b><\/p>\n<\/td>\n<\/tr>\n

\n

\u6700\u8fd1\u6709\u8a31\u591a\u4f7f\u7528\u8005\u611f\u67d3\u65b0\u7684\u52d2\u8d16\u8edf\u9ad4\u75c5\u6bd2\uff0c\u906d\u5230\u8a72\u75c5\u6bd2\u611f\u67d3\u5f8c\uff0c\u4f5c\u696d\u7cfb\u7d71\u4e2d\u6709\u591a\u7a2e\u6a94\u6848\u6703\u88ab\u52a0\u5bc6\uff0c\u906d\u5230\u611f\u67d3\u7684\u4f7f\u7528\u8005\u9700\u8981\u652f\u4ed8$300\u7f8e\u91d1\u6216\u6b50\u5143\u300c\u8d16\u6b3e\u300d\u7372\u53d6\u91d1\u9470\u624d\u80fd\u5c07\u6a94\u6848\u89e3\u5bc6\u3002\u53d7\u5bb3\u8005\u6703\u770b\u5230\u4ee5\u4e0b\u8996\u7a97\uff1a <\/p>\n

\"clip_image002\"<\/a> <\/p>\n

\u751a\u81f3\u9023\u684c\u9762\u4e5f\u6703\u88ab\u9396\u5b9a\u800c\u9020\u6210\u7121\u6cd5\u4f7f\u7528\u96fb\u8166\uff08\u5982\u4e0b\u5716\uff09 <\/p>\n

\"clip_image004\"<\/a> <\/p>\n

  <\/p>\n

\u6b64\u75c5\u6bd2\u8a73\u7d30\u8cc7\u8a0a\u5982\u4e0b\uff1a <\/p>\n

<\/strong> <\/p>\n

\u6563\u64ad\u7ba1\u9053\uff1a<\/strong> <\/p>\n

\u6b64\u52d2\u8d16\u8edf\u9ad4\u53ef\u80fd\u901a\u904e\u804a\u5929\u5de5\u5177\u3001\u96fb\u5b50\u90f5\u4ef6\u3001\u60e1\u610f\u7db2\u7ad9\u6563\u64ad\uff0c\u6216\u7531\u5176\u4ed6\u75c5\u6bd2\u91cb\u653e\u800c\u4f86\u3002 <\/p>\n

  <\/p>\n

<\/strong> <\/p>\n

\u75c5\u6bd2\u884c\u70ba\uff1a<\/strong> <\/p>\n

1. \u5c07\u81ea\u5df1\u8907\u88fd\u5f8c\u7f6e\u653e\u5230\u4e0b\u5217\u76ee\u9304\u4e0b\uff1a
%Application Data%\\{\u96a8\u6a5f\u5b57\u6bcd\u7684\u6a94\u6848\u540d\u7a31}.exe
(\u6ce8\u610f: %Application Data%<\/em> \u662f\u76ee\u524d\u7528\u6236\u7684Application Data\u8cc7\u6599\u593e\uff0c\u5728Windows 2000\u3001XP\u3001Server 2003\u4e2d\u901a\u5e38\u70baC:\\Documents and Settings\\{\u5e33\u865f\u540d\u7a31}\\Application Data\uff0c\u5728Windows 7\u53ca\u4ee5\u4e0a\u7248\u672c\u4f5c\u696d\u7cfb\u7d71\u4e2d\u901a\u5e38\u70ba C:\\Users\\{user name}\\AppData\\Roaming.)\u3002 <\/p>\n

2. \u907f\u514d\u81ea\u5df1\u91cd\u8907\u57f7\u884c\u3002 <\/p>\n

3. \u6703\u5728\u6a5f\u78bc\u4e2d\u6dfb\u52a0\u81ea\u52d5\u555f\u52d5\u9805\u76ee\u3002
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
CryptoLocker = “%Application Data%\\{\u96a8\u6a5f\u6a94\u6848\u540d\u7a31}.exe”\u3002 <\/p>\n

4. \u6703\u65b0\u589e\u4ee5\u4e0b\u767b\u9304\u503c\uff1a
HKEY_CURRENT_USER\\Software\\CryptoLocker
HKEY_CURRENT_USER\\Software\\CryptoLocker\\Files <\/p>\n

\"clip_image006\"<\/a> <\/p>\n

\u5176\u4e2d\u5b50\u76ee\u9304\u300cFiles\u300d\u4e2d\u5217\u51fa\u7684\u662f\u5df2\u88ab\u52a0\u5bc6\u7684\u6a94\u6848\u5217\u8868 <\/p>\n

\"clip_image008\"<\/a> <\/p>\n

5. \u8a72\u75c5\u6bd2\u6703\u9023\u63a5\u4ee5\u4e0b\u7db2\u57df\u4ee5\u7372\u53d6\u52a0\u5bc6\u7684\u91d1\u9470\uff1a <\/p>\n

    gktibioivpqbot.net
    mlernipmrlrnjj.com
    lnjaadfliwshke.info
    kktvnsdykphojs.co.uk
    jmyeansxbbiibw.org
    qnamcbakhsitnw.ru
    ppfuovpjxejnoy.biz <\/font> <\/p>\n

    \u9019\u4e9b\u7db2\u57df\u4e2d\u4efb\u610f\u500b\u53ef\u9023\u63a5\u7684\u7db2\u5740\u6700\u7d42\u6703\u6307\u5411IP\u4f4d\u5740 93.189.44.187<\/font> \u7684\u4f3a\u670d\u5668\u3002 <\/p>\n

6. \u5728\u7372\u53d6\u52a0\u5bc6\u91d1\u9470\u5f8c\u4ee5\u4e0b\u985e\u578b\u6a94\u6848\u5c07\u88ab\u52a0\u5bc6\uff1a
*.3fr  *.accdb  *.arw  *.bay  *.cdr  *.cer  *.cr2  *.crt  *.crw  *.dbf  *.dcr  *.der *.dng *.doc *.docm *.docx *.dwg *.dxf *.dxg*.eps *.erf *.indd *.kdc *.mdb *.mdf *.mef *.mrw *.nef *.nrw *.odb *.odc *.odm *.odp *.ods *.odt *.orf *.p12 *.p7b *.p7c *.pdd *.pef *.pem *.pfx *.ppt *.pptm *.pptx *.psd *.pst *.ptx *.r3d *.raf  *.raw *.rtf *.rw2 *.rwl *.sr2 *.srf *.srw *.wb2 *.wpd *.wps *.x3f *.xlk *.xls *.xlsb .xlsm  *.xlsx <\/p>\n

7. \u52d2\u7d22\u8005\u63a5\u53d7\u4ee5\u4e0b\u4ed8\u6b3e\u65b9\u5f0f\uff1a <\/p>\n

Bitcoin
cashU
MoneyPak
Ukash <\/p>\n

<\/strong> <\/p>\n

<\/strong>  <\/p>\n

\u9632\u8b77\u63aa\u65bd\uff1a<\/strong> <\/p>\n

1. \u5f9e\u9598\u9053\u8655\u963b\u6b62\u9023\u63a5\u60e1\u610f\u7db2\u5740\uff08\u4e0a\u8ff0\u7b2c\u4e94\u9805\u4e2d\u4e4b\u7db2\u57df\u53caIP\uff09\uff1b<\/font>
2. \u4fdd\u6301\u9632\u6bd2\u8edf\u9ad4\u75c5\u6bd2\u78bc\u66f4\u65b0\u81f3\u6700\u65b0\uff1b
3. \u8acb\u52ff\u96a8\u610f\u9ede\u95b1\u4f86\u6e90\u4e0d\u660e\u7684\u90f5\u4ef6\u9644\u4ef6\uff1b
4. \u8acb\u52ff\u96a8\u610f\u63a5\u6536\u4e26\u57f7\u884c\u804a\u5929\u5de5\u5177\u4e2d\u767c\u9001\u7684\u6a94\u6848\uff08\u5305\u62ec\u5716\u7247\u6a94\u6216office\u6a94\u6848\uff09\uff1b
5. \u8acb\u52ff\u96a8\u610f\u700f\u89bd\u672a\u77e5\u7684\u570b\u5916\u7db2\u7ad9\uff0c\u5c24\u5176\u662f\u60c5\u8272\u7db2\u7ad9\u6216\u591a\u5a92\u9ad4\u4e0b\u8f09\u7db2\u7ad9\uff1b
6. \u8acb\u5b9a\u671f\u5099\u4efd\u91cd\u8981\u6a94\u6848\u3002 <\/p>\n

<\/strong> <\/p>\n

<\/strong>  <\/p>\n

\u89e3\u6c7a\u65b9\u6cd5\uff1a<\/strong> <\/p>\n

1. \u5f9e\u9598\u9053\u8655\u963b\u6b62\u9023\u63a5\u60e1\u610f\u7db2\u5740\/IP<\/strong><\/font>\u3002<\/p>\n

    gktibioivpqbot.net
    mlernipmrlrnjj.com
    lnjaadfliwshke.info
    kktvnsdykphojs.co.uk
    jmyeansxbbiibw.org
    qnamcbakhsitnw.ru
    ppfuovpjxejnoy.biz <\/font><\/p>\n

    93.189.44.187<\/font> <\/p>\n

2. \u76ee\u524d\u8da8\u52e2\u79d1\u6280\u6700\u65b0\u75c5\u6bd2\u78bc 10.331.00 \u5df2\u53ef\u5075\u6e2c\u6b64\u985e\u60e1\u610f\u7a0b\u5f0f\uff0c\u75c5\u6bd2\u540d\u7a31\u70ba\uff1aTROJ_CEEINJECT.EA \u6216 TROJ_CRILOCK.AF\u3002
\u8acb\u6ce8\u610f\uff1a\u906d\u5230\u52a0\u5bc6\u9396\u5b9a\u7684\u6a94\u6848\u76ee\u524d\u4ecd\u7121\u6cd5\u89e3\u5bc6\u3002<\/font><\/strong><\/p>\n

3. \u672a\u5b89\u88dd\u8da8\u52e2\u79d1\u6280\u9632\u6bd2\u8edf\u9ad4\u7684\u4f7f\u7528\u8005\u53ef\u81f3\u4ee5\u4e0b\u7db2\u7ad9\u4e0b\u8f09ATTK\u5de5\u5177\u9032\u884c\u6383\u63cf
\uff08\u8acb\u6ce8\u610f\uff1a\u6b64\u5de5\u5177\u70ba\u4f7f\u7528\u96f2\u7aef\u75c5\u6bd2\u78bc\uff0c\u6545\u96fb\u8166\u9700\u9023\u4e0a\u7db2\u8def\u624d\u80fd\u6709\u6548\u6383\u7784\uff09\uff1a<\/p>\n