Recently, Yuntian Data Recovery Center discovered during the process of accepting user consultations that a new type of ransomware has quietly appeared on the market - crypt ransomware. Next, we will conduct a comprehensive analysis of this type of ransomware.
1. Characteristics of being infected by crypt ransomware virus
- There is an html webpage named how_to_back_files on the desktop and multiple folders, which can be opened normally with a browser;
- The extension of all data in the server or computer changes to *.crypt. For example, the original file is kuaijiemi.sql, but after being infected with the ransomware virus, it will become kuaijiemi.sql.crypt. Double-clicking it will show that there is no application that can be opened.
3. All software in the server cannot run, the shortcut icons of the software will be messed up, or an error will be reported during operation.
2. Crypt ransomware attack target
According to statistics from Yuntian Data Recovery Center, the main attack targets of crypt ransomware are enterprise servers, and users have been infected by both physical servers and cloud servers. The types of data that users want to recover are mainly financial data or important data in OA systems. We have not yet received any personal data recovery requests from personal computers, but this does not mean that the other party will not attack personal computers.
3. Solutions and steps for being infected by crypt ransomware virus
- Prepare a mobile hard drive with sufficient capacity to back up important data in the server. The purpose is to retain the original data. If the client is a cloud server, you can just take a snapshot. The validity period of the snapshot should be set as long as possible.
- Seek help from a professional. Do not do meaningless work such as modifying the extension of the data to be recovered without permission to prevent the data from suffering secondary damage. If you really want to try it yourself, you can operate from the backup and try not to make changes to the original machine.
3. Format and reinstall the system. To avoid secondary poisoning, the best solution is to format and reinstall the system, which can completely remove any hidden ransomware programs and allow the system to function normally.