1. 叙述问题：
Attention!!!
Your BitCrypt ID:
xxx-123-4567890
All necessary files on your PC ( photos, documents, data bases and other) were encoded with a unique RSA-1024 key.
Decoding of your files is only possible by a special programm that is unique for each BitCrypt ID.
Specialists from computer repair services and anti-virus labs won't be able to help you.
In order to receive the program decryptor you need to follow this links.
If current link doesn't work but you need to restore files please follow the directions:
1. Try to open link . If you failed proceed to step 2.
2. Download and install tor browser
3. After installation, start tor browser and put in the following address
Remember, the faster you act the more chances to recover your files undamaged.
在每个资料夹下建立两个档案(包含每个磁区)
上面为内容物已去掉网址及修改对方所给的ID
BitCrypt.txt
BitCrypt.txt.bitcrypt
除了.exe没被改之外大部份的档案类型都被修改为BitCrypt
请问还有救吗Orz
2. 系统资料：
使用的作业系统 Windows XP SP 3
使用的防毒软件 小红伞
3. 分析报告：
2.13:
启动的项目全部关了重开机又自己挂上去 发现有档案会自已挂上去
已送virustotal分析
http://goo.gl/kbjVrL
分析结果 但是不是这只不清楚...
已先拿掉没办法反推回去只好从头再来了...Orz