Excel使用時にPC内のファイル形式が自動でWindows Media Playerのプログラム既定に変化

Question

Excel作業時に、エクセルファイル及び、PDF、テキスト等のファイル形式のアイコンが全て変わり、既定プログラムがWindows Media Playerになってしまって各ファイルを開けない。(Excel　→　WMP 、PDF→　WMP...etc)

ファイル自体の形式は変わりなし(末尾が.xlsx,pdf,txt.)

加えてデスクトップにテキスト形式でこのような文が自動で保存されます。

タイトル：_ReCoVeRy_+cjdxv

NOT YOUR LANGUAGE? USE https://translate.google.com

What happened to your files ?

All of your files were protected by a strong encryption with RSA4096

More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA\_(cryptosystem)

How did this happen ?

!!! Specially for your PC was generated personal RSA4096 Key , both public and private.

!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.

!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server

What do I do ?

So , there are two ways you can choose: wait for a miracle and get your price doubled , or start obtaining BITCOIN NOW !!!!! , and restore your data easy way

If You have really valuable data, you better not waste your time, because there is no other way to get your files , except make a payment

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below

* http://t54ndnku456ngkwsudqer.wallymac.com/EBC650B353B266E8

* http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/EBC650B353B266E8

* http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/EBC650B353B266E8

If for some reasons the addresses are not available, follow these steps

* Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en

* After a successful installation, run the browser 

* Type in the address bar: xlowfznrg4wf7dli.onion/EBC650B353B266E8

* Follow the instructions on the site

IMPORTANT INFORMATION

Your personal pages

http://t54ndnku456ngkwsudqer.wallymac.com/EBC650B353B266E8

http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/EBC650B353B266E8

http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/EBC650B353B266E8

早急ご対応宜しく御願い致します。

Answer 1

ランサムウェアに感染していませんか？

そうであれば、Excel や Office、マイクロソフトとは関係ありません。

http://about-threats.trendmicro.com/RelatedThreats.aspx?language=jp&name=Ransomware+Raises+the+Stakes+With+CryptoLocker

http://www.trendmicro.co.jp/jp/security-intelligence/threat-solution/ransomware/index.html