【数据恢复】服务器感染.[Rheinland01@privatemail.com].mkp新型勒索病毒

客户名称：国内某公司
售前服务顾问：王顾问
恢复工程师：杨工
恢复工期：1天
恢复范围：一台服务器
恢复率：100%

.[Rheinland01@privatemail.com].mkp后缀勒索病毒是今年2月国外知名的勒索病毒家族开始传播的新型变种病毒，自今年该病毒传播以来，我们陆续有接到被该病毒感染加密数据企业咨询与求助，自病毒爆发以来，我们91数据恢复团队也深入研究该病毒的加密数据特征，发现其是已经传播一年多以来的.makop勒索病毒的升级。如果受感染的数据确实有恢复的价值与必要性，可添加我们的技术服务号（sjhf91）进行免费咨询获取数据恢复的相关帮助。接下来我们先来了解下[Rheinland01@privatemail.com].mkp勒索病毒。

微信

【数据恢复】服务器感染.[Rheinland01@privatemail.com].mkp新型勒索病毒

案例简介：

前言：简介

一、什么是.[Rheinland01@privatemail.com].mkp勒索病毒？

二、中了.[Rheinland01@privatemail.com].mkp后缀勒索病毒文件怎么恢复？

前言：简介

一、什么是.[Rheinland01@privatemail.com].mkp勒索病毒？

.[Rheinland01@privatemail.com].mkp病毒最初是由国外著名病毒分析师发现的，属于Makop勒索病毒家族。该勒索软件会加密 PC 上的所有用户数据（照片、文档、Excel 表格、音乐、视频等），将其特定扩展名添加到每个文件中，并在每个包含加密文件的文件夹中创建+README-WARNING+.txt文件。

.[Rheinland01@privatemail.com].mkp加密后的文件将根据模式进行mkp重命名，该模式位于勒索病毒中。您的照片，以“me.jpg”为例，加密后将更改为“ me.jpg.[87C29B86].[Rheinland01@privatemail.com].mkp”。

.[Rheinland01@privatemail.com].mkp等勒索病毒感染对于大多数杀毒软件识别来说可能非常具有挑战性，因为文件加密过程完成后不会损坏文件。因此，您的杀毒软件不太可能警告您系统后台正在进行文件加密过程。这是因为，实际上，加密程序是一种被广泛使用的数据保护技术，一般情况下不会造成文件损坏，所以杀毒软件都不会阻止这个过程，这也是为什么很多受害者反馈机器上有运行安全防护软件，但是却没有拦截住此文件加密行为。

+README-WARNING+.txt说明文件内容：

::: Greetings :::

Little FAQ:

.1.
Q: Whats Happen?
A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen.

.2.
Q: How to recover files?
A: If you wish to decrypt your files you will need to pay us.

.3.
Q: What about guarantees?
A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.
To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.

.4.
Q: How to contact with you?
A: You can write us to our mailbox: Rheinland01@privatemail.com

.5.
Q: How will the decryption process proceed after payment?
A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.

.6.
Q: If I don’t want to pay bad people like you?
A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.

:::BEWARE:::
DON'T try to change encrypted files by yourself!
If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files!
Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

经过我们研究发现，.mkp后缀勒索病毒是原传播很长时间的.makop勒索病毒的升级版，与该病毒同类的后缀病毒还有以下各种后缀，都是同一个病毒家族的，91数据恢复均可以恢复处理：

.[coleman.dec@tutanota.com].makop

.[honestandhope@qq.com].makop

.[yourfriendz@secmail.pro].makop

.[helpmakop@cock.li].makop

.[dino@rape.lol].makop

.[daviderichardo@tutanota.com].makop

.[filerecov3ry@keemail.me].makop

.[helpmakop@cock.li].makop

.[manage.file@messagesafe.io].makop

.[Evilminded@privatemail.com].makop

.[decrypt.makop.file@messagesafe.io].makop