NOD32_user

itman: Would you provide a warning message, when NOD users visit this websites: at begining with hxxp: and hxxp://katfile.com . Thank you very much.

itman: Firstly, I search the stretch book in pdf format in google for this name: 酸痛拉筋解剖书.pdf Secondly, I visit this website: https://ck101.com/thread-4210452-1-1.html Thirdly, I click this website: hxxp://katfile.com/vlbmqz07mvf5 Forthly, I click a icon to download pdf. But I do not download pdf, nor open pdf. I find that it is so slow and something strange. I close all internet browsers. Finally, I find that my word and excel files in desktop is shown in white color. My computer is corrupted. Please help Please let know who do this virus. I will find someone to beat him.

I do not pay "ransom" payment.

What is meaning of item 1 , Payment instructions?

email is already sent to samples@eset.com

Thank you. Sir. I have scanned by NOD32 and find Filecoder.Magniber existed. May I delete it?

Dear All I am NOD32 user in Win 7. I just visit China's website to download a pdf file. My computer is corrupted. Excel and word files are ended with .roauwhd How to clean? Please help. Also my every directory is added a file named README in txt file, showing as following. ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: hxxp://0026dh0x08403r670ge.rsda7v45tqyvqocp.onion/roauwhd Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": hxxp://0026dh0x08403r670ge.growboy.site/roauwhd hxxp://0026dh0x08403r670ge.stonere.host/roauwhd hxxp://0026dh0x08403r670ge.hellput.pw/roauwhd hxxp://0026dh0x08403r670ge.amam.space/roauwhd Note! These are temporary addresses! They will be available for a limited amount of time! README.txt