全球主机交流论坛

 找回密码
 注册

QQ登录

只需一步,快速开始

CeraNetworks网络延迟测速工具IP归属甄别会员请立即修改密码
查看: 3353|回复: 16
打印 上一主题 下一主题

vultr用原版安装的WIN2008R2,改了端口被入侵了

[复制链接]
跳转到指定楼层
1#
发表于 2017-4-17 19:48:28 | 只看该作者 回帖奖励 |正序浏览 |阅读模式
桌面放了个文件,进系统时还有此服务器被入侵了的英文提示。

我是用ITELLYOU上的原版系统装的,改了端口,没开任何其他服务,防火墙手动关闭了

===============================# aes-ni ransomware #===============================

                   █████╗ ███████╗███████╗      ███╗   ██╗██╗
                  ██╔══██╗██╔════╝██╔════╝      ████╗  ██║██║
                  ███████║█████╗  ███████╗█████╗██╔██╗ ██║██║
                  ██╔══██║██╔══╝  ╚════██║╚════╝██║╚██╗██║██║
                  ██║  ██║███████╗███████║      ██║ ╚████║██║
                  ╚═╝  ╚═╝╚══════╝╚══════╝      ╚═╝  ╚═══╝╚═╝

SPECIAL VERSION: NSA EXPLOIT EDITION

INTRO: If you are reading it, your server was attacked with NSA exploits.
Make World Safe Again.

SORRY! Your files are encrypted.
File contents are encrypted with random key (AES-256 bit; ECB mode).
Random key is encrypted with RSA public key (2048 bit).

We STRONGLY RECOMMEND you NOT to use any "decryption tools".
These tools can damage your data, making recover IMPOSSIBLE.

Also we recommend you not to contact data recovery companies.
They will just contact us, buy the key and sell it to you at a higher price.

If you want to decrypt your files, you have to get RSA private key.
In order to get private key, write here:

[email protected]
[email protected]
[email protected]

IMPORTANT: In some cases malware researchers can block our e-mails.
If you did not receive any answer on e-mail in 48 hours,
please do not panic and write to BitMsg (https://bitmsg.me) address:
BM-2cVgoJS8HPMkjzgDMVNAGg5TG3bb1TcfhN
or create topic on https://www.bleepingcomputer.com/ and we will find you there.

If someone else offers you files restoring, ask him for test decryption.
Only we can successfully decrypt your files; knowing this can protect you from fraud.

You will receive instructions of what to do next.
You MUST refer this ID in your message:

WIN-FLQSU2IC69O#E2DA760BEBEE201F3CC75B33967FC365

Also you MUST send all ".key.aes_ni_0day" files from C:\ProgramData if there are any.


===============================# aes-ni ransomware #===============================
17#
 楼主| 发表于 2017-4-18 20:15:41 | 只看该作者
robit 发表于 2017-4-18 17:11
只开了iis,改了远程桌面端口,改了默认账户,防火墙规则除远程桌面外全为默认...只是没打补丁... ...

补丁的话太频繁了,不方便 经常打
16#
发表于 2017-4-18 17:11:50 | 只看该作者
doors 发表于 2017-4-18 15:50
,,你开了哪些服务呢?

只开了iis,改了远程桌面端口,改了默认账户,防火墙规则除远程桌面外全为默认...只是没打补丁...
15#
发表于 2017-4-18 16:06:12 | 只看该作者
提示: 作者被禁止或删除 内容自动屏蔽
14#
 楼主| 发表于 2017-4-18 15:50:09 | 只看该作者
robit 发表于 2017-4-18 14:12
我没关的一样中招了

,,你开了哪些服务呢?
13#
发表于 2017-4-18 14:12:29 | 只看该作者
我没关的一样中招了
12#
发表于 2017-4-18 08:11:19 来自手机 | 只看该作者
叫你关防火墙……我家用电脑都不敢关
11#
发表于 2017-4-18 08:08:22 | 只看该作者
还有人把服务器的防火墙关了的???
10#
发表于 2017-4-18 02:12:35 | 只看该作者
同vultr同中招 俺已经把小鸡删了
9#
发表于 2017-4-17 23:17:36 | 只看该作者
vultr的端估计都被盯完了
您需要登录后才可以回帖 登录 | 注册

本版积分规则

Archiver|手机版|小黑屋|全球主机交流论坛

GMT+8, 2025-12-24 17:23 , Processed in 0.090244 second(s), 11 queries , Gzip On, MemCache On.

Powered by Discuz! X3.4

© 2001-2023 Discuz! Team.

快速回复 返回顶部 返回列表