What is the method to deal with ransomware virus?

Ransomware disposal methods are to isolate infected servers/hosts and prevent new infections. Detailed introduction: 1. Isolate the infected host. Isolation mainly includes two means: physical isolation and access control. Physical isolation mainly means disconnecting the network or power, and access control mainly refers to strict authentication and control of permissions to access network resources; 2. To prevent new infections, immediately change the login password of the infected server. Secondly, modify the security settings of databases, shared folders, user mailboxes, etc. to restrict access by illegal users.

The operating system for this tutorial: Windows 10 system, DELL G3 computer.

Ransomware is a new type of computer virus that is mainly spread through emails, program Trojans, and web page Trojans. The virus is bad in nature and extremely harmful. Once infected, it will cause immeasurable losses to users. This virus uses various encryption algorithms to encrypt files. The infected person generally cannot decrypt the files and must obtain the decrypted private key to crack them.

Method of propagation

Server intrusion propagation: Attackers invade the server through system or software vulnerabilities, or remotely log in to the server through RDP weak password brute force

Automatic propagation by exploiting vulnerabilities: Using the system's own vulnerabilities for diffusion and propagation

Software supply chain attack propagation: During the normal upgrade process of legitimate software, exploiting the vulnerabilities of the software supplier to hijack and tamper with legitimate software

E-mail attachment propagation: script files containing malicious code are included in email attachments

Use of horse-affiliated web pages to propagate: Most of the infected users do not have anti-virus software installed

Defense methods

Automatic document backup and isolation

Intelligent trapping: Intelligent trapping technology is a powerful tool for capturing ransomware viruses. The specific method is: the protection software sets trap files everywhere in the computer system; When a virus attempts to encrypt a file, it will first hit the set trap, exposing its attack behavior.

Behavior tracking technology: Multi-dimensional intelligent analysis of program behavior. Security software can back up or detect suspicious file operations. Once malicious modifications are discovered, the file content will be immediately blocked and restored

Intelligent file format analysis technology

Data flow analysis technology: Based on machine learning methods, we can analyze the read/write operations of ransomware on documents and the normal use of documents at the data flow level within the computer. The difference between read/write operations can be used to identify the attack behavior of the ransomware virus, thereby capturing and filtering the ransomware virus

How to deal with it

Isolation infection host. When it is confirmed that the server has been infected with the ransomware virus, the infected host should be immediately isolated. Isolation mainly includes two means: physical isolation and access control. Physical isolation mainly means disconnecting the network or power, and access control mainly refers to the permission to access network resources. Conduct strict certification and control.

Prevent new infections. It mainly includes changing login passwords, adding policies, etc. The main operations to change the login password are: immediately change the login password of the infected server; secondly, modify the security settings of databases, shared folders, user mailboxes, etc. to restrict access by illegal users. The main steps to add the policy are: use security equipment on the network side for further isolation, such as firewalls or terminal security monitoring systems; avoid exposing the Remote Desktop Service (RDP, default port is 3389) to the public network; close 445, 139, 135, etc. Unnecessary ports.

Error handling method

1: Use a mobile storage device

2: Read and write disk files in the "hit" server/host

The above is the detailed content of What is the method to deal with ransomware virus?. For more information, please follow other related articles on the PHP Chinese website!