病毒事故 (.檔案事故) 勒索軟體

什麼是 QEZA 病毒?

QEZA 一種 STOP/Djvu 勒索軟體, 加密計算機上的文件, making them inaccessible. It targets a variety of file types, appending a “.qeza” extension to them, which renders the files unusable without a decryption key.

After infecting a system, Qeza demands a ransom in Bitcoin for decrypting files. Victims find a “_readme.txt” guide on desktops and within folders that instructs them on how to make the payment, though payment does not guarantee recovery.

The virus employs the Salsa20 encryption algorithm, which complicates decryption efforts without the attacker’s cooperation. However, if Qeza cannot connect to its server before starting the encryption, it uses a standard offline key, offering a potential avenue for decryption.

Below, an image shows the appearance of encrypted files, marked by the “.qeza” 擴大:

名稱為 .Qeza 的加密文件

Qeza Virus Overview

Qeza ransomware executes a set of procedures on a victim’s computer upon arrival. It launches winupdate.exe as one of the initial processes, which displays a fraudulent Windows update prompt during the attack to convince the victim their PC is slowing down due to a Windows update.

Meanwhile, the ransomware runs another process (named with 4 random chars), which begins scanning the computer for target files and encrypting them. It then removes Volume Shadow Copies from the system using the following CMD command:

vssadmin.exe Delete Shadows /All /Quiet

Once removed, it becomes impossible to retrieve the computer’s previous state using System Restore Points. The ransomware operators eliminate any built-in Windows approaches that could help the victim restore files for free. 另外, they modify the Windows HOSTS file by adding a list of domains to it, redirecting them to the localhost IP, which results in a DNS_PROBE_FINISHED_NXDOMAIN error when the victim tries to open one of the blocked websites.

We’ve observed that the ransomware tries to restrict websites from publishing various how-to guides for computer users. Clearly, by limiting specific domains, the attackers attempt to prevent victims from accessing relevant and helpful online information related to ransomware attacks. The virus also stores two .txt files on the victim’s computer providing attack-related information – the public key of this victim and a personal ID, named bowsakkdestx.txt and PersonalID.txt.

After all these modifications, the malware doesn’t stop. Variants of STOP/DJVU often deploy the Vidar password-stealing Trojan on compromised systems, a threat with a vast list of capabilities, including:

• Infiltrating and executing malware on the victim’s computer to gain unauthorized access.
• Obtaining unauthorized access to login credentials of Steam, Telegram, and Skype.
• Manipulating and viewing files on the victim’s computer without their consent.
• Stealing cryptocurrency wallets from the victim’s system.
• Granting the hackers remote control over the victim’s computer for various malicious purposes.
• Extracting sensitive information such as browser cookies, saved passwords, and browsing history.

The cryptography algorithm in STOP/Djvu ransomware is Salse20. So, once it encrypts your data with an online decryption key, the chances of getting your files back become quite low. This key is unique for each victim, and finding a suitable one would take an impractical amount of time.

Retrieving the online key in another way is also nearly impossible. The hackers who spread the Qeza infection own the server where it is stored. To receive the decrypting code, the payment should be $999. For payment details, the victims must contact the hackers by email (support@fishmail.top).

Ransom Note: _readme.txt

How To Remove?

Remove Qeza Virus with Gridinsoft Anti-Malware

從那時起我們就一直在我們的系統上使用這個軟體, 而且在檢測病毒方面一直很成功. 它阻止了最常見的勒索軟體： 從我們的測試中可以看出 與軟體, and we assure you that it can remove Qeza Virus as well as other malware hiding on your computer.

使用 Gridinsoft 刪除惡意威脅, 請依照以下步驟操作:

1. 首先下載 Gridinsoft Anti-Malware, 透過下面的藍色按鈕或直接從官方網站訪問 網格軟體.

2.一旦 Gridinsoft 安裝文件 (安裝-gridinsoft-fix.exe) 已下載, 透過點擊該檔案來執行它. Follow the installation setup wizard's instructions diligently.

3. 訪問 "掃描選項卡" on the application's start screen and launch a comprehensive "全碟掃描" 檢查您的整台計算機. 這種包容性掃描涵蓋了內存, 啟動項, 註冊表, 服務, 司機, 和所有文件, 確保它檢測到隱藏在所有可能位置的惡意軟體.

要有耐心, as the scan duration depends on the number of files and your computer's hardware capabilities. 利用這段時間放鬆或處理其他任務.

4. 完成後, 反惡意軟體將提供一份詳細報告，其中包含您 PC 上偵測到的所有惡意專案和威脅.

5. 從報告中選擇所有已識別的項目，然後放心地單擊 "立即清潔" 按鈕. 此操作將從您的電腦中安全地刪除惡意文件, 將它們轉移到反惡意軟體程式的安全隔離區，以防止任何進一步的有害行為.

6. 如果出現提示, 重新啟動電腦以完成完整的系統掃描過程. 此步驟對於確保徹底消除任何剩餘威脅至關重要. 重啟後, Gridinsoft Anti-Malware 將會開啟並顯示一則訊息，確認 掃描完成.

請記住 Gridinsoft 提供 6 天免費試用. 這意味著您可以免費利用試用期體驗軟體的全部優勢，並防止您的系統將來受到任何惡意軟體感染. Embrace this opportunity to fortify your computer's security without any financial commitment.

影片指南

How To Decrypt .qeza Files?

第一的, 嘗試刪除 “.qeza” 幾個大檔案的副檔名，然後打開它們. 該惡意軟體難以加密大文件. The virus either failed to lock the file upon access or encountered a bug and omitted adding the file marker. 如果您的檔案大小超過 2GB, 後一種情況更有可能發生.

犯罪分子在八月底左右發布了最新的擴展 2019 進行多次更改後.

犯罪分子所做的更改使 STOPDecrypter 不再受支持, 導致其被 Emsisoft 開發的 STOP Djvu 勒索軟體 Emsisoft Decryptor 取代.

1. 下載並執行解密工具: 下載 解密工具. 確保您以管理員身份執行解密實用程式並同意透過點擊出現的授權條款 “是的” 按鈕. 接受許可條款後.
2. 選擇要解密的資料夾: 解密器, 預設情況下, 自動選擇已連接的網路磁碟機上的目錄進行解密. 使用 “添加” 按鈕選擇其他位置. Depending on the malware family, decryptors offer various options, which you can toggle on or off in the Options tab. Below, you will find a detailed list of the currently active options.
3. Initiate Decryption by Clicking on the “Decrypt” Button. After adding all desired locations to the list, click the “Decrypt” button to start the decryption process. The decryptor will inform you upon completing the decryption process. If needed for documentation, you can save the report by clicking the “Save log” 按鈕. It’s also possible to copy the report to your clipboard for pasting into emails or messages.

How to Restore .qeza Files?

In some case, ransomware fails to encrypt your files…

The Qeza ransomware encryption process involves encrypting each file byte-by-byte, creating a duplicate, and then deleting (not overwriting) the original file. This deletion means the physical disk no longer lists the file in its system, although the original file remains on the drive. The sector that held the file might still contain it, but since the system does not list it, new data can overwrite it. However, special software can recover your files.

布倫丹·史密斯

IT安全專家

試試使用 GridinSoft 反惡意軟體

不要忘記分享您解決問題的經驗. 請在此發表評論! 這可以幫助其他受害者了解他們並不孤單. 我們將共同找到解決這個問題的方法.

現在下載

Gridinsoft Anti-Malware 6-day trial available.
EULA | 隱私權政策 | 10% Off Coupon

Recover Your Files with PhotoRec

PhotoRec, designed for file recovery from damaged disks or accidental deletion, now supports restoring 400 file types, making it useful after a Qeza attack.

第一的, download PhotoRec. It’s free, but the developer offers no guarantee for file restoration. PhotoRec comes packaged with TestDisk, another tool from the same developer, under the TestDisk name. However, PhotoRec is included within the archive.

To start PhotoRec, open the “qphotorec_win.exe” 文件. 無需安裝，因為該程式包含所有必需的文件, 允許它從 USB 驅動器運行.

1. My files are encrypted by ransomware, what should I do now?