全球主机交流论坛

 找回密码
 注册

QQ登录

只需一步,快速开始

CeraNetworks网络延迟测速工具IP归属甄别会员请立即修改密码
查看: 3351|回复: 16
打印 上一主题 下一主题

vultr用原版安装的WIN2008R2,改了端口被入侵了

[复制链接]
跳转到指定楼层
1#
发表于 2017-4-17 19:48:28 | 只看该作者 回帖奖励 |倒序浏览 |阅读模式
桌面放了个文件,进系统时还有此服务器被入侵了的英文提示。

我是用ITELLYOU上的原版系统装的,改了端口,没开任何其他服务,防火墙手动关闭了

===============================# aes-ni ransomware #===============================

                   █████╗ ███████╗███████╗      ███╗   ██╗██╗
                  ██╔══██╗██╔════╝██╔════╝      ████╗  ██║██║
                  ███████║█████╗  ███████╗█████╗██╔██╗ ██║██║
                  ██╔══██║██╔══╝  ╚════██║╚════╝██║╚██╗██║██║
                  ██║  ██║███████╗███████║      ██║ ╚████║██║
                  ╚═╝  ╚═╝╚══════╝╚══════╝      ╚═╝  ╚═══╝╚═╝

SPECIAL VERSION: NSA EXPLOIT EDITION

INTRO: If you are reading it, your server was attacked with NSA exploits.
Make World Safe Again.

SORRY! Your files are encrypted.
File contents are encrypted with random key (AES-256 bit; ECB mode).
Random key is encrypted with RSA public key (2048 bit).

We STRONGLY RECOMMEND you NOT to use any "decryption tools".
These tools can damage your data, making recover IMPOSSIBLE.

Also we recommend you not to contact data recovery companies.
They will just contact us, buy the key and sell it to you at a higher price.

If you want to decrypt your files, you have to get RSA private key.
In order to get private key, write here:

[email protected]
[email protected]
[email protected]

IMPORTANT: In some cases malware researchers can block our e-mails.
If you did not receive any answer on e-mail in 48 hours,
please do not panic and write to BitMsg (https://bitmsg.me) address:
BM-2cVgoJS8HPMkjzgDMVNAGg5TG3bb1TcfhN
or create topic on https://www.bleepingcomputer.com/ and we will find you there.

If someone else offers you files restoring, ask him for test decryption.
Only we can successfully decrypt your files; knowing this can protect you from fraud.

You will receive instructions of what to do next.
You MUST refer this ID in your message:

WIN-FLQSU2IC69O#E2DA760BEBEE201F3CC75B33967FC365

Also you MUST send all ".key.aes_ni_0day" files from C:\ProgramData if there are any.


===============================# aes-ni ransomware #===============================
2#
发表于 2017-4-17 19:51:16 | 只看该作者
你们这样好吓人啊。。。。。
3#
 楼主| 发表于 2017-4-17 19:54:39 | 只看该作者
我装完系统后就改了3389端口 ,关闭防火墙。
没做其他变动,相当于默认的系统也能被入侵
4#
发表于 2017-4-17 20:21:25 | 只看该作者
,关闭防火墙不就等于让人随便草??
改端口,禁用端口,防火墙肯定要打开
5#
发表于 2017-4-17 20:27:45 | 只看该作者
至少得windows update吧
6#
发表于 2017-4-17 20:29:31 来自手机 | 只看该作者
厉害了   
7#
发表于 2017-4-17 21:51:06 | 只看该作者
Windows服务器默认防火墙是除了规则内的其它一概阻止 所以防火墙只要花1分钟看/配一下就不会有任何事情发生

然而楼主你把它关了...关了...了..

远程桌面漏洞攻击的是Windows2003及以下系统 楼主你这明显是从SMB漏洞过来的
8#
发表于 2017-4-17 22:51:36 | 只看该作者
一大波黑客。。
9#
发表于 2017-4-17 23:17:36 | 只看该作者
vultr的端估计都被盯完了
10#
发表于 2017-4-18 02:12:35 | 只看该作者
同vultr同中招 俺已经把小鸡删了
您需要登录后才可以回帖 登录 | 注册

本版积分规则

Archiver|手机版|小黑屋|全球主机交流论坛

GMT+8, 2025-12-17 09:35 , Processed in 0.090158 second(s), 10 queries , Gzip On, MemCache On.

Powered by Discuz! X3.4

© 2001-2023 Discuz! Team.

快速回复 返回顶部 返回列表