Today, with the rapid development of computer technology, more and more enterprises are moving towards a digital office model, which greatly facilitates the production and operation of enterprises and brings higher efficiency to enterprises. However, network threats are everywhere, and the means of network threats are increasing with the continuous development of computer technology. Recently, Yuntian Data Recovery Center has received requests for help from many companies. The company's computer servers were infected by the mkp ransomware virus, causing all the company's computers to be paralyzed and unable to work normally. The Mkp ransomware virus is a new variant of the makop ransomware virus. The encryption and attack methods of this virus have been greatly upgraded, bringing serious network threats to corporate computers. After Yuntian data recovery engineers decrypted the mkp ransomware virus, we have compiled the following relevant information about the virus for everyone.
- Characteristics of Mkp ransomware virus
- Symptoms of poisoning: when the computer is poisoned by the mkp ransomware virus, the suffix names of all files on the computer become mkp. For example, the jiemihuifu.mdf file will become jiemihuifu.mdf.[id].[email].mkp, and A README-WARNING.txt ransom note is left on the computer desktop.
- Poisoning effects: A computer infected with the mkp ransomware virus will lead to the leakage of important corporate information and personal privacy information on the computer. It will also bring serious economic losses to the company, create more difficulties for the company's work and business, and thus damage the company's reputation. Reputation damaged.
- Attack encryption upgrade. mkp is a newly upgraded variant of the makop ransomware virus. The attack encryption method has been upgraded. It has a stronger attack encryption form. It uses remote desktop weak passwords and email attachments to attack. Combined with the upgraded RSA and AES encryption algorithms, Encrypt files on all computers.
- Mkp ransomware decryption
- Disconnect the network connection. When it is found that the computer server is infected with the mkp ransomware virus, we should first disconnect the network connection and end all sharing and connection devices with the computer to prevent the horizontal spread of the ransomware virus within the intranet.
- End the encryption program. Generally, the mkp ransomware virus runs in a large memory. We click on the computer's task manager and end the encryption program. This makes it easier for us to perform other operations on the computer, otherwise it will cause new encryption.
- Back up the poisoned files. If there are files that need to be recovered on the infected computer, we need to copy them to the hard disk or USB flash drive to prevent accidental occurrences during the decryption and recovery process and reduce damage to the source files.
- There are three decryption methods for decrypting poisoned files. One is complete machine decryption, which can recover all files on the computer. The recovery is highly complete and the cost is not low. The second method is backup and recovery, which involves cleaning and formatting the entire computer, removing viruses, reinstalling the system, deploying application software, and then importing backup files. The third type is database decryption. Generally, ransomware viruses have their own encryption vulnerabilities. We can consult a team of professional technical engineers to formulate a reasonable database decryption plan.
- Do a good job of post-protection. Install reliable anti-ransomware software, conduct regular system scans, patch vulnerabilities, and regularly maintain weak system passwords to reduce the risk of secondary poisoning.
- Mkp ransomware virus prevention
(1) Network level: It is recommended to add a firewall and make security configurations. If there is no firewall, close all ports that are not necessary for mapping. Try not to open external network ports, such as high-risk ports such as 3389 and 445.
(2) System level: Harden the operating system (the specific hardening methods are in the document below), install a set of anti-virus software and set an exit password (otherwise, the anti-virus software is not installed). The anti-virus software is free or paid. There is no essential difference.
(3) Backup level: If it is a cloud server, you can set up a daily scheduled snapshot of Alibaba Cloud. If it is a local server, you can set up a local backup plan. Do not back up to the same computer. You can back up through backup software or cloud disk.