嚴重系統安全問題，用戶必須閱讀 05/13更新

中毒的是PowerShell 剛剛我Kill Process掉, 勒索病毒已停止(之後我不知道 剛用掉的)

而且找到一個叫"SVCHOST.EXE"的 正常的是"svchost.exe" 大小不一樣
那個有外連到一個IP: 94.73.36.254 不知是不是毒的伺服端

(PID:6548 Protocal:TCP Remote_Port:1601 Statuus:SYN_SENT)

所以下是用那個IP 我拿到的資料
-
NetRange:       94.0.0.0 - 94.255.255.255
CIDR:           94.0.0.0/8
NetName:        94-RIPE
NetHandle:      NET-94-0-0-0-1
Parent:          ()
NetType:        Allocated to RIPE NCC
OriginAS:
Organization:   RIPE Network Coordination Centre (RIPE)
RegDate:        2007-07-30
Updated:        2009-05-18
Comment:        These addresses have been further assigned to users in
Comment:        the RIPE NCC region. Contact information can be found in
Comment:        the RIPE database at ripe.net/whois
Ref:            whois.arin.net/rest/net/NET-94-0-0-0-1

ResourceLink:  apps.db.ripe.net/search/query.html
ResourceLink:  whois.ripe.net

OrgName:        RIPE Network Coordination Centre
OrgId:          RIPE
Address:        P.O. Box 10096
City:           Amsterdam
StateProv:
PostalCode:     1001EB
Country:        NL
RegDate:
Updated:        2013-07-29
Ref:            whois.arin.net/rest/org/RIPE

ReferralServer:  whois:// whois.ripe.net
ResourceLink:  apps.db.ripe.net/search/query.html

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName:   Abuse Contact
OrgAbusePhone:  +31205354444
OrgAbuseEmail:  abuse@ ripe.net
OrgAbuseRef:    whois.arin.net/rest/poc/ABUSE3850-ARIN

OrgTechHandle: RNO29-ARIN
OrgTechName:   RIPE NCC Operations
OrgTechPhone:  +31 20 535 4444
OrgTechEmail:  hostmaster@ ripe.net
OrgTechRef:    whois.arin.net/rest/poc/RNO29-ARIN

補充內容 (2017-5-3 11:15 PM):
不過是沒什麼用吧

PowerShell 連接IP:


剛刪後又重新回來 看來是要刪掉他的files

補充內容 (2017-5-3 11:22 PM):
62.210.36.16
80.67.172.162
138.201.247.18
185.170.112.183
46.101.169.151