鸿萌数据恢复

 昨天，鸿萌接到北京某客户工厂服务器遭受.ciphered后缀勒索者病毒侵袭，公司三台应用服务器均被加密，业务陷入停顿。

.ciphered后缀勒索者病毒出现！

如上图所示，所有有效文件均被添加.ciphered后缀，文件被加密。

释放病毒的人留言如下：

原文如下：

The only way of recovering your files is to buy a unique decryptor. 
A decryptor is fully automatical, all your data will be recovered within a few hours after it’s installation.
For purchasing a decryptor contact us by email:
邮箱隐去
If you will get no answer within 24 hours contact us by our alternate emails:
邮箱隐去
We assure full recovery after the payment. 
To verify the possibility of the recovery of your files we can decipher 1 file for free. 
Attach 1 file to the letter (no more than 25Mb). Indicate your personal ID on the letter:
75 A4 CC D4 3F 89 DF 3C D0 33 F8 9A 45 43 F8 10 50 67 B0 46 C3 9D D1 63 2B 72 53 59 75 BE 33 2A 65 EF 42 A3 BC 4A 5E 60 27 45 91 93 ED 6F E2 FB 5C 36 58 D3 C6 76 7D 92 8B 4A 4A 08 32 C3 80 9C 8F A8 FA BD 49 6D 33 41 61 90 B1 48 51 E3 A4 DA CF 28 54 89 87 4E 3E AE D2 82 3E AB BC CF D6 9E 1C 69 65 4C 93 F7 EC C1 0A B2 15 51 0E 5A 3C 7E 3A A4 7D F4 E8 D1 06 79 75 30 0E 93 72 4E 42 AD 49 7A 0C F3 0A FB 47 F3 71 0C F2 99 2C 88 0F 4F 3F A9 F1 3D 48 71 D4 C2 C0 D7 93 3F F3 96 12 55 91 07 56 00 81 DD 34 14 F6 50 7C 40 48 2B 80 BE 1F E6 4C 5E F6 4B 5F 80 0F DC 54 6A EC 24 74 AE B3 32 07 28 F7 98 E4 FE F7 25 73 7D 88 D3 62 7F 3D 3D 1B 65 84 60 39 40 A6 1D B7 FC CC 56 68 2C BB 49 84 AB F2 DF FA 89 D4 FB DE 30 F2 2D F9 B0 75 0D 63 A2 8B 4E D2 D0 51 67 E5 2A 07 34 80 B1 . 
In reply we will send you an deciphered file and an instruction for purchasing an automatical decryptor for all your files. After the payment we will send you a decryptor and an instructions for protecting your computer from network vulnerabilities..

      鸿萌工程师于4月30日下午赶到客户现场，已经成功为客户解决问题。

鸿萌------国内专业数据安全服务公司。专注数据恢复、数据备份、数据加密、数据取证等数据安全技术并提供企业及存储、备份解决方案。

我们的使命：为客户数据安全保驾护航！