奇埃胡病毒 (.qehu 文件) 勒索軟體

什麼是 QEHU 病毒?

QEHU 一種 STOP/Djvu 勒索軟體, 加密計算機上的文件, making them inaccessible. It targets a variety of file types, appending a “.qehu” extension to them, which renders the files unusable without a decryption key.

After infecting a system, Qehu demands a ransom in Bitcoin for decrypting files. Victims find a “_自述文件.txt” guide on desktops and within folders that instructs them on how to make the payment, though payment does not guarantee recovery.

The virus employs the Salsa20 encryption algorithm, which complicates decryption efforts without the attacker’s cooperation. 然而, if Qehu cannot connect to its server before starting the encryption, it uses a standard offline key, offering a potential avenue for decryption.

以下, an image shows the appearance of encrypted files, marked by the “.qehu” 擴大:

Encrypted Qehu Files: Windows PC

Qehu Virus Overview

Qehu ransomware executes a set of procedures on a victim’s computer upon arrival. It launches winupdate.exe as one of the initial processes, which displays a fraudulent Windows update prompt during the attack to convince the victim their PC is slowing down due to a Windows update.

同時, the ransomware runs another process (named with 4 random chars), which begins scanning the computer for target files and encrypting them. It then removes Volume Shadow Copies from the system using the following CMD command:

vssadmin.exe Delete Shadows /All /Quiet

Once removed, it becomes impossible to retrieve the computer’s previous state using System Restore Points. The ransomware operators eliminate any built-in Windows approaches that could help the victim restore files for free. 另外, they modify the Windows HOSTS file by adding a list of domains to it, redirecting them to the localhost IP, which results in a DNS_PROBE_FINISHED_NXDOMAIN error when the victim tries to open one of the blocked websites.

We’ve observed that the ransomware tries to restrict websites from publishing various how-to guides for computer users. Clearly, by limiting specific domains, the attackers attempt to prevent victims from accessing relevant and helpful online information related to ransomware attacks. The virus also stores two .txt files on the victim’s computer providing attack-related information – the public key of this victim and a personal ID, named bowsakkdestx.txt 和 PersonalID.txt.

After all these modifications, the malware doesn’t stop. Variants of STOP/DJVU often deploy the Vidar password-stealing Trojan on compromised systems, a threat with a vast list of capabilities, 包括:

• Infiltrating and executing malware on the victim’s computer to gain unauthorized access.
• Obtaining unauthorized access to login credentials of Steam, Telegram, and Skype.
• Manipulating and viewing files on the victim’s computer without their consent.
• Stealing cryptocurrency wallets from the victim’s system.
• Granting the hackers remote control over the victim’s computer for various malicious purposes.
• Extracting sensitive information such as browser cookies, saved passwords, and browsing history.

The cryptography algorithm in STOP/Djvu ransomware is Salse20. So, once it encrypts your data with an online decryption key, the chances of getting your files back become quite low. This key is unique for each victim, and finding a suitable one would take an impractical amount of time.

Retrieving the online key in another way is also nearly impossible. The hackers spread the Qehu infection on the server where it is stored. To receive the decrypting code, the payment should be $999. For payment details, the victims must contact the hackers by email (support@fishmail.top).

勒索信: _自述文件.txt

如何刪除?

Remove Qehu Virus with Gridinsoft Anti-Malware

從那時起我們就一直在我們的系統上使用這個軟體, 而且在檢測病毒方面一直很成功. 它阻止了最常見的勒索軟體： 從我們的測試中可以看出 與軟體, and we assure you that it can remove Qehu Virus as well as other malware hiding on your computer.

使用 Gridinsoft 刪除惡意威脅, 請依照以下步驟操作:

1. 首先下載 Gridinsoft Anti-Malware, 透過下面的藍色按鈕或直接從官方網站訪問 網格軟體.

2.一旦 Gridinsoft 安裝文件 (安裝-gridinsoft-fix.exe) 已下載, 透過點擊該檔案來執行它. Follow the installation setup wizard's instructions diligently.

3. 訪問 "掃描選項卡" on the application's start screen and launch a comprehensive "全碟掃描" 檢查您的整台計算機. 這種包容性掃描涵蓋了內存, 啟動項, 註冊表, 服務, 司機, 和所有文件, 確保它檢測到隱藏在所有可能位置的惡意軟體.

要有耐心, as the scan duration depends on the number of files and your computer's hardware capabilities. 利用這段時間放鬆或處理其他任務.

4. 完成後, 反惡意軟體將提供一份詳細報告，其中包含您 PC 上偵測到的所有惡意專案和威脅.

5. 從報告中選擇所有已識別的項目，然後放心地單擊 "立即清潔" 按鈕. 此操作將從您的電腦中安全地刪除惡意文件, 將它們轉移到反惡意軟體程式的安全隔離區，以防止任何進一步的有害行為.

6. 如果出現提示, 重新啟動電腦以完成完整的系統掃描過程. 此步驟對於確保徹底消除任何剩餘威脅至關重要. 重啟後, Gridinsoft Anti-Malware 將會開啟並顯示一則訊息，確認 掃描完成.

請記住 Gridinsoft 提供 6 天免費試用. 這意味著您可以免費利用試用期體驗軟體的全部優勢，並防止您的系統將來受到任何惡意軟體感染. Embrace this opportunity to fortify your computer's security without any financial commitment.

影片指南

How To Decrypt .qehu Files?

第一的, 嘗試刪除 “.qehu” 幾個大檔案的副檔名，然後打開它們. 該惡意軟體難以加密大文件. 病毒要么無法在訪問時鎖定文件，要么遇到錯誤而忽略添加文件標記. 如果您的檔案大小超過 2GB, 後一種情況更有可能發生.

犯罪分子在八月底左右發布了最新的擴展 2019 進行多次更改後.

犯罪分子所做的更改使 STOPDecrypter 不再受支持, 導致其被 Emsisoft 開發的 STOP Djvu 勒索軟體 Emsisoft Decryptor 取代.

1. 下載並執行解密工具: 下載 解密工具. 確保您以管理員身份執行解密實用程式並同意透過點擊出現的授權條款 “是的” 按鈕. 接受許可條款後.
2. 選擇要解密的資料夾: 解密器, 預設情況下, 自動選擇已連接的網路磁碟機上的目錄進行解密. 使用 “添加” 按鈕選擇其他位置. 取決於惡意軟件家族, 解密器提供各種選項, 您可以在“選項”選項卡中打開或關閉它. 以下, 您將找到當前活動選項的詳細列表.
3. 單擊開始解密 “解密” 按鈕. 將所有所需位置添加到列表後, 單擊 “解密” 按鈕開始解密過程. 解密器將在完成解密過程後通知您. 如果需要文檔, 您可以通過單擊保存報告 “保存日誌” 按鈕. 還可以將報告複製到剪貼板以粘貼到電子郵件或消息中.

How to Restore .qehu Files?

在某些情況下, 勒索軟件無法加密您的文件…

The Qehu ransomware encryption process involves encrypting each file byte-by-byte, 創建一個副本, 然後刪除 (不覆蓋) 原始文件. 此刪除意味著物理磁盤不再在其係統中列出該文件, 儘管原始文件仍保留在驅動器上. 保存文件的扇區可能仍然包含它, 但由於系統沒有列出它, 新數據可以覆蓋它. 然而, 特殊軟件可以恢復您的文件.

布倫丹·史密斯

IT安全專家

試試使用 GridinSoft 反惡意軟體

不要忘記分享您解決問題的經驗. 請在此發表評論! 這可以幫助其他受害者了解他們並不孤單. 我們將共同找到解決這個問題的方法.

現在下載

Gridinsoft Anti-Malware 提供 6 天試用版.
最終用戶許可協議 | 隱私權政策 | 10% 優惠券

Recover Qehu Files with PhotoRec

攝影記錄, 專為從損壞的磁盤或意外刪除中恢復文件而設計, 現在支持恢復 400 文件類型, making it useful after a Qehu attack.

第一的, 下載照片記錄. 免費, 但開發商不保證文件恢復. PhotoRec 與 TestDisk 一起打包, 來自同一開發人員的另一個工具, 在 TestDisk 名稱下. 然而, PhotoRec 包含在存檔中.

啟動照片錄製, 打開 “qphotorec_win.exe” 文件. 無需安裝，因為該程式包含所有必需的文件, 允許它從 USB 驅動器運行.

1. 我的文件被勒索軟件加密, 我現在該怎麼辦?