dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
目录dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
前言:简介dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
一、什么是.[Rheinland01@privatemail.com].mkp勒索病毒?dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
二、中了.[Rheinland01@privatemail.com].mkp后缀勒索病毒文件怎么恢复?dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
三、恢复案例介绍:dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
1. 被加密数据情况dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
2. 数据恢复完成情况dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
四、系统安全防护措施建议:dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
前言:简介
.[Rheinland01@privatemail.com].mkp后缀勒索病毒是今年2月国外知名的勒索病毒家族开始传播的新型变种病毒,自今年该病毒传播以来,我们陆续有接到被该病毒感染加密数据企业咨询与求助,自病毒爆发以来,我们91数据恢复团队也深入研究该病毒的加密数据特征,发现其是已经传播一年多以来的.makop勒索病毒的升级。如果受感染的数据确实有恢复的价值与必要性,可添加我们的技术服务号(sjhf91)进行免费咨询获取数据恢复的相关帮助。接下来我们先来了解下[Rheinland01@privatemail.com].mkp勒索病毒。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[Rheinland01@privatemail.com].mkp病毒最初是由国外著名病毒分析师发现的,属于Makop勒索病毒家族。该勒索软件会加密 PC 上的所有用户数据(照片、文档、Excel 表格、音乐、视频等),将其特定扩展名添加到每个文件中,并在每个包含加密文件的文件夹中创建+README-WARNING+.txt文件。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[Rheinland01@privatemail.com].mkp加密后的文件将根据模式进行mkp重命名,该模式位于勒索病毒中。您的照片,以“me.jpg”为例,加密后将更改为“ me.jpg.[87C29B86].[Rheinland01@privatemail.com].mkp”。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[Rheinland01@privatemail.com].mkp等勒索病毒感染对于大多数杀毒软件识别来说可能非常具有挑战性,因为文件加密过程完成后不会损坏文件。因此,您的杀毒软件不太可能警告您系统后台正在进行文件加密过程。这是因为,实际上,加密程序是一种被广泛使用的数据保护技术,一般情况下不会造成文件损坏,所以杀毒软件都不会阻止这个过程,这也是为什么很多受害者反馈机器上有运行安全防护软件,但是却没有拦截住此文件加密行为。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
+README-WARNING+.txt说明文件内容:dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
::: Greetings :::dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
Little FAQ:dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.1. dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
Q: Whats Happen?dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen.dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.2. dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
Q: How to recover files?dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
A: If you wish to decrypt your files you will need to pay us.dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.3. dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
Q: What about guarantees?dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.4.dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
Q: How to contact with you?dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
A: You can write us to our mailbox: Rheinland01@privatemail.comdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.5.dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
Q: How will the decryption process proceed after payment?dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.6.dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
Q: If I don’t want to pay bad people like you?dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
:::BEWARE:::dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
DON'T try to change encrypted files by yourself! dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files!dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
经过我们研究发现,.mkp后缀勒索病毒是原传播很长时间的.makop勒索病毒的升级版,与该病毒同类的后缀病毒还有以下各种后缀,都是同一个病毒家族的,91数据恢复均可以恢复处理:dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[coleman.dec@tutanota.com].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[honestandhope@qq.com].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[yourfriendz@secmail.pro].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[helpmakop@cock.li].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[dino@rape.lol].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[daviderichardo@tutanota.com].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[filerecov3ry@keemail.me].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[helpmakop@cock.li].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[manage.file@messagesafe.io].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[Evilminded@privatemail.com].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[decrypt.makop.file@messagesafe.io].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[hopeandhonest@smime.ninja].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[daviderichardo@tutanota.com].makop dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[Goodhack@privatemail.com].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[ustedesfil@safeswiss.com].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[paybackformistake@qq.com].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[datapro@decoymail.com].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[ideapad@privatemail.com].makopdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[uSuppor@privatemail.com].mkpdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[tSuppor@privatemail.com].mkpdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[eSuppor@privatemail.com].mkpdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[hopeandhonest@smime.ninja].mkpdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[ideapad@privatemail.com].mkpdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[Rheinland01@privatemail.com].mkpdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[Harman@privatemail.com].mkpdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[aLPoint@privatemail.com].mkpdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[kongbang@privatemail.com].mkpdPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
.[Rheinland01@privatemail.com].mkp勒索病毒是如何传播感染的?dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
经过分析多家公司中毒后的机器环境判断,勒索病毒基本上是通过以下几种方式入侵,请大家可逐一了解并检查以下防范入侵方式,毕竟事前预防比事后恢复容易的多。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
远程桌面口令爆破dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
检查 Windows 日志中的安全日志以及防火墙日志等 dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
共享设置dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
检查是否只有共享出去的文件被加密。 dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
软件漏洞dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
根据系统环境,针对性进行排查,例如常见被攻击环境Java、通达 OA、致远 OA 等。查 web 日志、排查域控与设备补丁情况等。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
二、中了.[Rheinland01@privatemail.com].mkp后缀勒索病毒文件怎么恢复?
此后缀病毒文件由于加密算法的原因,每台感染的电脑服务器文件都不一样,需要独立检测与分析加密文件的病毒特征与加密情况,才能确定最适合的恢复方案。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
考虑到数据恢复需要的时间、成本、风险等因素,建议如果数据不太重要,建议直接全盘扫描杀毒后全盘格式化重装系统,后续做好系统安全防护工作即可。如果受感染的数据确实有恢复的价值与必要性,可添加我们的技术服务号(sjhf91)进行免费咨询获取数据恢复的相关帮助。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
三、恢复案例介绍:
1. 被加密数据情况
一台服务器,被加密的文件数据量约134万+个,数据量大约6T左右。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
2. 数据恢复完成情况
数据完成恢复,134万多个文件,全部文件均已恢复,恢复率等于100%。恢复完成的文件均可以正常打开及使用。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
四、系统安全防护措施建议:
预防远比救援重要,所以为了避免出现此类事件,强烈建议大家日常做好以下防护措施:dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
我们强烈建议将备份保存在多个单独的位置(例如,未插电的存储设备、远程服务器等)——以确保数据安全。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
1.多台机器,不要使用相同的账号和口令,以免出现“一台沦陷,全网瘫痪”的惨状;dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
2.登录口令要有足够的长度和复杂性,并定期更换登录口令;dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
3.严格控制共享文件夹权限,在需要共享数据的部分,尽可能的多采取云协作的方式。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
4.及时修补系统漏洞,同时不要忽略各种常用服务的安全补丁。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
5.关闭非必要的服务和端口如135、139、445、3389等高危端口。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
6.备份备份备份!!!重要资料一定要定期隔离备份。进行RAID备份、多机异地备份、混合云备份,对于涉及到机密或重要的文件建议选择多种方式来备份;dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
7.提高安全意识,不随意点击陌生链接、来源不明的邮件附件、陌生人通过即时通讯软件发送的文件,在点击或运行前进行安全扫描,尽量从安全可信的渠道下载和安装软件;dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b
8.安装专业的安全防护软件并确保安全监控正常开启并运行,及时对安全软件进行更新。dPj91数据恢复-勒索病毒数据恢复专家,360/malloxx/xollam/devos/halo/locked/mkp/b