收银系统中了medical勒索病毒成功修复

分享到:

2021-04-18 22:51:13

问题现象:2021年4月17日,接到中山老客户求助,其名下的一个客户的收银系统中了勒索病毒,全部文件被篡改为medical后缀。贴出该勒索病毒信件信息:



What Happen to my computer?
Your important files are encrypted. Many of your documents, photos, passwords, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for way to recover your files , but do not waste your time. Nobody can recover your files without our decryption KEY (if somebody will tell that they can do it, they will also contact me and I will make the price so much expensive than if you contact directly).
 
DON USE GMAIL.COM TO CONTACT US
 
!!!THE DATARECOVERY COMPANIES JUST WANT YOUR MONEY!!!
!!DATA RECOVERY COMPANIES WILL ONLY INCREASE THE DECRYPTION TIME!!
 
Can i Recover My Files?
Sure. We guarantee that you can recover all your files safely and easily But You have not so enough time . So If you want to decrypt all your data, you need to pay .As fast you pay as fast all of your data will be back as before encryption.
 
 
 
USE CHAT TO CONTACT US : https://supportdatarecovery.cc
 
LOGIN : Medical
 
 
PASSWORD: ed0Z0BaS
 
 
 
Send e-mail to this address: yourdata@RecoveryGroup.at
 
You have to pay for decryption in Bitcoins.
 
ATTENTION
Do not rename encrypted files. 
Do not try to decrypt your data using third party software, it may cause permanent data loss. 
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
 
If you want to try datarecovery company just ask for testfile.They have to give it for you if they can do something.
 
They will not.
 
 
该后缀近期刚刚出现,算是一种新型勒索病毒。通过分析,该后缀的勒索病毒对数据库文件加密有限,整体加密程度在5%以内,通过和客户深入沟通交流,客户提供了之前相同的老库,我们通过底层分析,通过不断的比对,和客户确认相关重要的表记录数据,基本敲定了底层修复的方案。通过2天时基本完成了数据修复,个别表结构被破坏,好在不是重要的业务数据,客户基本满意。


防护建议:
1.多台机器,不要使用相同的账号和口令
2.登录口令要有足够的长度和复杂性,并定期更换登录口令
3.重要资料的共享文件夹应设置访问权限控制,并进行定期备份
4.定期检测系统和软件中的安全漏洞,及时打上补丁。
5.定期到服务器检查是否存在异常。查看范围包括:
a)是否有新增账户
b) Guest是否被启用
c) Windows系统日志是否存在异常
d)杀毒软件是否存在异常拦截情况
6.安装安全防护软件,并确保其正常运行。
7.从正规渠道下载安装软件。
8.对不熟悉的软件,如果已经被杀毒软件拦截查杀,不要添加信任继续运行。  



您的服务器不幸中了勒索病毒,第一时间断网,备份,联系我们:18910108696,王工,微信同号,同时,提供样本文件,可以qq或者微信,后者百度云。我们第一时间为您检查文件,确定处理方案。
声明:此篇为用友服务中心文章,转载请标明出处链接:
  • 相关文章
  • 热门下载
  • 数据修复
  • 热门标签
合作伙伴