Ransomware disposal methods are to isolate infected servers/hosts and prevent new infections. Detailed introduction: 1. Isolate the infected host. Isolation mainly includes two means: physical isolation and access control. Physical isolation mainly means disconnecting the network or power, and access control mainly refers to strict authentication and control of permissions to access network resources; 2. To prevent new infections, immediately change the login password of the infected server. Secondly, modify the security settings of databases, shared folders, user mailboxes, etc. to restrict access by illegal users.
The operating system for this tutorial: Windows 10 system, DELL G3 computer.
Ransomware is a new type of computer virus that is mainly spread through emails, program Trojans, and web page Trojans. The virus is bad in nature and extremely harmful. Once infected, it will cause immeasurable losses to users. This virus uses various encryption algorithms to encrypt files. The infected person generally cannot decrypt the files and must obtain the decrypted private key to crack them.
Method of propagation
Server intrusion propagation: Attackers invade the server through system or software vulnerabilities, or remotely log in to the server through RDP weak password brute force
Automatic propagation by exploiting vulnerabilities: Using the system's own vulnerabilities for diffusion and propagation
Software supply chain attack propagation: During the normal upgrade process of legitimate software, exploiting the vulnerabilities of the software supplier to hijack and tamper with legitimate software
E-mail attachment propagation: script files containing malicious code are included in email attachments
Use of horse-affiliated web pages to propagate: Most of the infected users do not have anti-virus software installed
Defense methods
Automatic document backup and isolation
Intelligent trapping: Intelligent trapping technology is a powerful tool for capturing ransomware viruses. The specific method is: the protection software sets trap files everywhere in the computer system; When a virus attempts to encrypt a file, it will first hit the set trap, exposing its attack behavior.
Behavior tracking technology: Multi-dimensional intelligent analysis of program behavior. Security software can back up or detect suspicious file operations. Once malicious modifications are discovered, the file content will be immediately blocked and restored
Intelligent file format analysis technology
Data flow analysis technology: Based on machine learning methods, we can analyze the read/write operations of ransomware on documents and the normal use of documents at the data flow level within the computer. The difference between read/write operations can be used to identify the attack behavior of the ransomware virus, thereby capturing and filtering the ransomware virus
How to deal with it
Isolation infection host. When it is confirmed that the server has been infected with the ransomware virus, the infected host should be immediately isolated. Isolation mainly includes two means: physical isolation and access control. Physical isolation mainly means disconnecting the network or power, and access control mainly refers to the permission to access network resources. Conduct strict certification and control.
Prevent new infections. It mainly includes changing login passwords, adding policies, etc. The main operations to change the login password are: immediately change the login password of the infected server; secondly, modify the security settings of databases, shared folders, user mailboxes, etc. to restrict access by illegal users. The main steps to add the policy are: use security equipment on the network side for further isolation, such as firewalls or terminal security monitoring systems; avoid exposing the Remote Desktop Service (RDP, default port is 3389) to the public network; close 445, 139, 135, etc. Unnecessary ports.
Error handling method
1: Use a mobile storage device
2: Read and write disk files in the "hit" server/host
The above is the detailed content of What is the method to deal with ransomware virus?. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

MinGW - Minimalist GNU for Windows
This project is in the process of being migrated to osdn.net/projects/mingw, you can continue to follow us there. MinGW: A native Windows port of the GNU Compiler Collection (GCC), freely distributable import libraries and header files for building native Windows applications; includes extensions to the MSVC runtime to support C99 functionality. All MinGW software can run on 64-bit Windows platforms.

PhpStorm Mac version
The latest (2018.2.1) professional PHP integrated development tool

SublimeText3 Linux new version
SublimeText3 Linux latest version

mPDF
mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),

Dreamweaver Mac version
Visual web development tools
