求助 - cerber病毒

[ppspper]

請問各位大大 如中了 cerber 有無可以解決的軟體

我的一堆檔案副檔名都被改變啦 ~~~

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 上午 09:14:52, on 2016/7/26
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\Program Files\Elex-tech\YAC\iSafeSvc.exe
C:\Program Files\Elex-tech\YAC\iSafeSvc2.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\windows\Explorer.EXE
C:\windows\system32\spoolsv.exe
C:\Program Files\Elex-tech\YAC\iSafeTray.exe
C:\windows\system32\conime.exe
C:\Program Files\USIM Editor\iconcs1376984.exe
C:\windows\system32\ctfmon.exe
C:\WINDOWS\system32\afasrv32.exe
C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe
C:\Documents and Settings\davud lin\Application Data\TSv\TSvr.exe
C:\windows\system32\KaraokeSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\PDF Architect 2\creator-ws.exe
C:\Program Files\TOTOLINK\Common\RaRegistry.exe
C:\Program Files\HTC\HTC Sync Manager\HTC Sync\adb.exe
C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe
C:\windows\system32\svchost.exe
C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
C:\Program Files\Uncheckit\UncheckitSvc.exe
C:\Documents and Settings\All Users\Application Data\SwinpS\WFini.exe
C:\Program Files\WinSaber\WinSaber.exe
C:\Program Files\TeamViewer\Version8\TeamViewer.exe
C:\Program Files\TeamViewer\Version8\tv_w32.exe
C:\windows\System32\svchost.exe
C:\Program Files\TheWorld 2.0\TheWorld.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\davud lin\My Documents\Downloads\HiJackThis.exe

O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - D:\TTMP\SOFT\迅雷 (Thunder)V5.8.3.533 繁中去廣告綠色心動版\Thunder.NoAD-Ayu\ComDlls\TDAtOnce_Now.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: QPMIEHelper - {50F4150A-48B2-417A-BE4C-C83F580FB904} - C:\Program Files\Common Files\Tencent\QQPhoneManager\2.0.201.3192\npQQPhoneManagerExt.dll
O2 - BHO: PDF Architect Helper - {691B33B0-B86E-47F3-81C7-56E4FE3B929C} - C:\Program Files\PDF Architect 2\creator-ie-helper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_77\bin\ssv.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\TTMP\SOFT\迅雷 (Thunder)V5.8.3.533 繁中去廣告綠色心動版\Thunder.NoAD-Ayu\ComDlls\xunleiBHO_Now.dll (file missing)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_77\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: PDF Architect Toolbar - {DEEB13D7-CEA9-45FB-B77C-E039BEC85221} - C:\Program Files\PDF Architect 2\creator-ie-plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [conhost.exe -start] C:\Documents and Settings\davud lin\Application Data\UPUpdata\conhost.exe -start
O4 - HKLM\..\Run: [USBestCR] C:\Program Files\USIM Editor\iconcs1376984.exe RunFromReg
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msiql] c:\documents and settings\all users\application data\msiql.exe /RUNNING
O4 - HKCU\..\Run: [Yeaplayer] C:\Program Files\Yeaplayer\Yeaplayermd.exe /autostart
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\davud lin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Google Photos Backup] "C:\Documents and Settings\davud lin\Local Settings\Application Data\Programs\Google\Google Photos Backup\Google Photos Backup.exe" /autostart
O4 - HKCU\..\Run: [logman] "C:\Documents and Settings\davud lin\Application Data\{CE603FC4-0ECC-B740-2739-B4A134EA14D0}\logman.exe"
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1343024091-287218729-1801674531-1005\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'UpdatusUser')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: 使用迅雷下載 - D:\TTMP\SOFT\迅雷 (Thunder)V5.8.3.533 繁中去廣告綠色心動版\Thunder.NoAD-Ayu\Program\geturl.htm
O8 - Extra context menu item: 使用迅雷下載全部鏈接 - D:\TTMP\SOFT\迅雷 (Thunder)V5.8.3.533 繁中去廣告綠色心動版\Thunder.NoAD-Ayu\Program\getallurl.htm
O8 - Extra context menu item: 匯出至 Microsoft Excel(&X) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 轉換為 Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 轉換連結目標為 Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: 透過Mipony下載 - file://C:\Program Files\MiPony\Browser\IEContext.htm
O8 - Extra context menu item: 附加至現有 PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: 附加連結目標至現有 PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: 把σ戈 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://*.hola.org
O15 - Trusted Zone: http://*.gogobox.com.tw (HKLM)
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {1E525898-EE12-4002-9374-82D15147F762} (UpdateInstaller Class) - http://player.cntv.cn/flashplayer/co...NTVLive212.dll
O16 - DPF: {4D390092-2A93-4E4D-BE7F-12E7C8C245EB} (BugreportX Control) - http://www.muonline.com.tw/Support/B.../Bugreport.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1355994084984
O16 - DPF: {71B44BBE-3018-11D6-A100-0000E2384C92} (ckecsp Class) - https://rao.tradevan.com.tw/checkcsp.cab
O16 - DPF: {9B5EDF62-3E01-11D5-9F9F-0000E2384C92} (manage Class for two key) - https://rao.tradevan.com.tw/ctrl6.cab
O16 - DPF: {A6132015-5796-48B5-B776-16D009021D81} (FirstBankATM Class) - https://teatm.firstbank.com.tw/firstbankATM.CAB
O16 - DPF: {AB2DC89D-07D9-43EE-9A0E-F3C36F3D7B5E} (Seednet 線上列印郵局及便利商店繳款單) - https://service.seed.net.tw/BarCodeProj1.cab
O16 - DPF: {B3D9D1FB-35BC-4C95-BC20-347CD337A71C} (TaishinBank Class) - https://my.taishinbank.com.tw/TIBTWW...aishinBank.CAB
O16 - DPF: {BD1492B2-3E06-11D5-9F9F-0000E2384C92} (pki Class for two key) - https://rao.tradevan.com.tw/transcom2.cab
O16 - DPF: {C44FFEB9-D841-437E-98AB-C58F1A466FD2} (P7CAPI_Light Control) - https://xmlra.firstbank.com.tw/raweb/P7CAPI_Light.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {FBF8F412-3DF3-11D5-9F9F-0000E2384C92} (Genkey Class for two key) - https://rao.tradevan.com.tw/atl9.cab
O16 - DPF: {FC0A62EE-547F-47BE-9B05-F88F61E1BCF7} (Pkcs7Sign Control) - https://edesk.bli.gov.tw/na/SmartPKI...9OY!1288043596
O18 - Protocol: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (file missing)
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Afa Card Reader Service (AfaService) - Unknown owner - C:\WINDOWS\system32\afasrv32.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: cktSvc - EVANGEL TECHNOLOGY (HK) LIMITED - C:\Program Files\Uncheckit\cktSvc.exe
O23 - Service: FLEXnet Licensing Service - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleChromeUpService - Unknown owner - (no file)
O23 - Service: Google更新 服務 (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google更新 服務 (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HTCMonitorService - Nero AG - C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: IhPul - Trend Corp. - C:\Documents and Settings\davud lin\Application Data\TSv\TSvr.exe
O23 - Service: YAC Service (iSafeService) - Elex do Brasil Participacoes Ltda - C:\Program Files\Elex-tech\YAC\iSafeSvc.exe
O23 - Service: VIA Karaoke digital mixer Service (KaraokeService) - VIA Technologies, Inc. - C:\windows\system32\KaraokeSer.exe
O23 - Service: shoujizhushou service (kphonesvc) - Unknown owner - (no file)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
O23 - Service: PDF Architect 2 - pdfforge GmbH - C:\Program Files\PDF Architect 2\ws.exe
O23 - Service: PDF Architect 2 Creator - pdfforge GmbH - C:\Program Files\PDF Architect 2\creator-ws.exe
O23 - Service: pdfforge CrashHandler - pdfforge GmbH - C:\Program Files\PDF Architect 2\crash-handler-ws.exe
O23 - Service: qkseeService - QUALCOMM Incorporated - (no file)
O23 - Service: RalinkRegistryWriter - Ralink Technology, Corp. - C:\Program Files\TOTOLINK\Common\RaRegistry.exe
O23 - Service: Ralink UPnP Media Server (RaMediaServer) - Ralink - C:\Program Files\TOTOLINK\Common\RaMediaServer.exe
O23 - Service: Reimage Real Time Protector (ReimageRealTimeProtector) - ReimageR - C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe
O23 - Service: SolidConverterPDFReadSpool (SCPDFReadSpool) - Unknown owner - C:\WINDOWS\Installer\MSI3D.tmp (file missing)
O23 - Service: Search Module Update (SMUpd) - Unknown owner - C:\Program Files\Common Files\Soobzo\GDUpdate\smu.exe (file missing)
O23 - Service: Sony PC Companion - Unknown owner - (no file)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
O23 - Service: UncheckitSvc - evangel technology (hk) limited - C:\Program Files\Uncheckit\UncheckitSvc.exe
O23 - Service: WFini WdMan Service (WdMan) - WFini LIMITED - C:\Documents and Settings\All Users\Application Data\SwinpS\WFini.exe
O23 - Service: winsaber - Unknown owner - C:\Program Files\WinSaber\WinSaber.exe
O23 - Service: Double Spaced Firewall (zigipyro) - Unknown owner - C:\Documents.exe (file missing)

--
End of file - 13831 bytes

[a471]

被加密就無解啦~~~

[ppspper]

我這各有被加密嗎 檔案很多副檔名都變成 cerber 可以改副檔名嗎

[mini]

這是 勒索病毒根據搜尋結果出現時期一年左右
算是蠻新的病毒
所以目前沒有公眾解密工具可救 (如有改版那更...)

根據他家論壇
有兩人中毒兩位都選擇付錢了事
但其一付了錢但解密失敗
(根據每個人的電腦複雜度，會有演算解密金鑰時失敗的可能
所以收錢的渣其金鑰也是不正確的...?)

如果他(cerber)未來變的很猖狂，或許會有能人開發出 公眾解密工具
不過要等多久...?

你現在能做的是系統殺毒
(其一方式是用工具掃毒，另一為建議把windows那一磁區重建...)
接著
如有空間把所有的 .cerber(是這個名稱嗎？) 都搬到那保留吧 (或選擇重要的，不然檔案實在很多)
等看看運勢會不會來到解救...
最後重裝 windows後要找個能防該病毒的軟體
安裝之

哪一套能防？我也不知，自己是用自己寫的軟體(只能防不能解)，只是目前也還沒再碰到勒索過，所以不敢100%保證
理論上可行，只是目前針對新點的windows還需改進 (正嘗試用.net改寫程式碼，重學好累...)
做過渡還好... (xp以上請放棄使用)

[ppspper]

謝謝板大熱心回覆

我大概知道了 可能真的無解了 我的檔案可能就此 GG 這檔案真的太恐怖了 而且我還是xp的系統