Chengdu citizens' computer files were hijacked by Bitcoin virus, and the ransom was 3 Bitcoins

All files are encrypted and cannot be cracked.

Anti-virus experts: The damage caused by Bitcoin virus is irreversible, and it may not be solved even if the ransom is paid <br/>Mr. Li from Chengdu recently encountered a strange thing. His computer seemed to be controlled by hackers. All files could not be opened, and a mysterious English dialogue appeared on the computer screen. It turned out that Mr. Li's computer was kidnapped by a Bitcoin virus. The "kidnapper" proposed to use 3 Bitcoins as "ransom" to buy decryption software. Anti-virus experts remind that the damage caused by this ransomware virus is irreversible and needs to be carefully prevented.

After a paragraph of English recitation, all computer files were encrypted

"On the afternoon of October 4, my child was doing English homework on the computer. He left the computer on after finishing it. After about an hour, the computer suddenly made a sound in English, like a recitation," Mr. Li recalled. "Because the child was doing English homework, I didn't think too much about it at the time, but later I saw that the computer desktop had been modified."

Six days have passed, and Mr. Li's computer desktop remains the same as it was that afternoon. The desktop background has turned white, with a few lines of green English in the middle of the screen. Every file on the desktop, including Word documents, JPG pictures and videos, has been formatted differently. "These files cannot be opened. When you click to open them, a prompt will appear saying that there is no corresponding software."

Mr. Li then realized that his computer might be infected with a virus, and he quickly tried to translate the English on the desktop. "The English roughly means that the files and data have been encrypted, and the only way to safely decrypt the files is to pay 3 bitcoins and buy a decryption file. If you use third-party software to decrypt the files, you will suffer irreparable losses," said Mr. Li.

There are several URLs attached to the text. Clicking on these URLs will allow you to purchase the decryption software. "I didn't click on these links because I was worried that I would get into more trouble." Mr. Li told the reporter that it was the first time he encountered such a strange thing and he couldn't figure out what was going on.

One Bitcoin costs 4100 yuan. It is impossible to pay and it hurts.

With doubts, Mr. Li consulted relevant experts from the University of Electronic Science and Technology. After looking at Mr. Li's computer, the experts concluded that the virus implanted in Mr. Li's computer was most likely a Bitcoin virus. "This virus is also called a Bitcoin Trojan. It will encrypt 114 types of files in the infected computer, making them unable to open normally, and will also pop up a window to 'blackmail' the owner."

It is understood that the Bitcoin virus appeared abroad as early as 2014 and began to appear in China in early 2015. It is called the Bitcoin virus because the virus requires victims to pay 3 Bitcoins as a ransom to purchase decryption software. Bitcoin, a virtual currency, can only be used in the digital world, making transactions difficult to track.

Moreover, the encryption method of this virus is quite complicated. "It would take hundreds of thousands of years to crack it by brute force, and more than ten years or even decades to crack it by supercomputers." "I have also consulted several IT experts, and they all said that this virus is difficult to decrypt, and suggested that I negotiate with the hacker and buy the decryption software at a suitable price." Mr. Li said helplessly.

The reporter found that the current price of each Bitcoin is about 4,100 yuan, which means that Mr. Li needs to spend 12,000 yuan to buy the decryption software. "All the files I have stored in my computer for more than 10 years, as well as the photos of my life and work in recent years, have been illegally destroyed." Mr. Li felt distressed when he thought of this.

At present, Mr. Li has reported the case to the local police station and is waiting for the police investigation.

The damage caused by ransomware is irreversible

Li Tiejun, an anti-virus expert at Kingsoft, told reporters that ransomware viruses such as Bitcoin Trojans have become more common recently. "This virus uses the encryption inside the system, and it is an irreversible encryption that can only be cracked with the decryption key. In other words, it is impossible for anyone other than the virus developer to decrypt it."

According to reports, ransomware viruses are usually spread through emails, disguised as work documents inside computer systems, and tricking computer users into opening documents. "If users do not pay attention to security warnings, the virus program may run." Li Tiejun said, "In early versions of ransomware viruses, the decryption key may exist in the system registry, but we have analyzed the popular virus versions now and found that they cannot be removed." Li Tiejun said that what is more serious is that the principles and methods of Bitcoin viruses have long been made public on the Internet, "many hackers have modified and developed more virus variants."

As for Mr. Li's claim of paying for decryption software, Li Tiejun said that the virus developer's claim is not credible. "Virus encryption is irreversible, and the damage caused is also irreversible," Li Tiejun said. "And we don't know who the other party is. Even if we pay the ransom, it may not be able to be decrypted."

Therefore, Li Tiejun reminded that important files should be backed up in time. In addition, special care should be taken when handling emails. "Don't open suspicious programs on your computer." "Also, install security software on your local computer. Some security software can intercept newly emerged ransomware. Even if the virus signature is not found, the virus can intercept the encryption action during the file encryption process." Huaxi Metropolis Daily reporter Dong Xingsheng