qq_42993840的博客

2018年8月勒索病毒.arrow变种****@***.arrow解码工具 这是花2万从病毒发布者处获取的，根据作者所述先通过本工具点扫描，获得本机KEY，发给作者获得解密KEY，再次通过本工具解密，100%全部解开。 注意：本工具不能直接解密！！！！！必须根据扫描出的key再次生成解密代码，然后在本工具中执行解密，本工具只用于研究学习作者扫描和解密功能原理。 以下为作者邮件提示： 1) Change all user passwords to more harder. 2) Install strong antivirus like avg or eset - scan your infected machine. Protect your antivirus by pasword. 3) BEFORE decrypting system check your autorun list(and also look at the register). You must delete the virus if you find it! 4) Reboot your machines(one by one) and look to Task Manager. Does the virus will run again? If no - all is fine. 5) scan application（本工具） download this file, and add it to white list in your antivirus 6) run this application WITH ADMINISTRATOR RIGHTS 7) scan local machine (don't move your files - this may compromise the integrity of the decryption process) 8) push button "Save to file" 9) send to us this file with request key