全球主机交流论坛

 找回密码
 注册

QQ登录

只需一步,快速开始

CeraNetworks网络延迟测速工具IP归属甄别会员请立即修改密码
楼主: TvT

[lighttpd] 中勒索病毒了,安全冲浪这么多年,今日翻了车

[复制链接]
发表于 2021-3-14 11:36:07 | 显示全部楼层
TvT 发表于 2021-3-13 21:27
本地端口确实是3389,远程用frp转发的,一般在公网的小鸡时我都改端口的,就是内网这个疏忽了 ...

之前用frp弱密码中过一次,非3389
发表于 2021-3-14 11:36:24 | 显示全部楼层
The Devos ransomware is distributed via spam email containing infected attachments or by exploiting vulnerabilities in the operating system and installed programs.

Here’s how the Devos ransomware might get on your computer:

Cyber-criminals spam out an email, with forged header information, tricking you into believing that it is from a shipping company like DHL or FedEx. The email tells you that they tried to deliver a package to you, but failed for some reason. Sometimes the emails claim to be notifications of a shipment you have made. Either way, you can’t resist being curious as to what the email is referring to – and open the attached file (or click on a link inside the email). And with that, your computer is infected with the Devos ransomware.
The Devos ransomware was also observed attacking victims by exploiting vulnerabilities in the program installed on the computer or the operating system itself. Commonly exploited software includes the operating system itself, browsers, Microsoft Office, and third-party applications.

从你的描述来看,应该是操作系统、软件漏洞导致的
 楼主| 发表于 2021-3-14 12:22:51 | 显示全部楼层
qxwo 发表于 2021-3-14 11:36
之前用frp弱密码中过一次,非3389



看来用空要把所有的密码改成随机密码了
 楼主| 发表于 2021-3-14 12:24:38 | 显示全部楼层
gyjys43043 发表于 2021-3-14 11:36
The Devos ransomware is distributed via spam email containing infected attachments or by exploiting  ...

病毒入侵方式各种各样,需要做好防范了
发表于 2021-3-14 13:30:26 来自手机 | 显示全部楼层
Symantec Endpoint Protection 怎樣白票?
发表于 2021-3-14 13:42:52 | 显示全部楼层
去年一月,3389暴露中了.devil后缀的勒索病毒,同devos为phobos家族的变种。
至今未解
Fei 该用户已被删除
发表于 2021-3-14 16:18:31 | 显示全部楼层
提示: 作者被禁止或删除 内容自动屏蔽
发表于 2021-3-14 16:28:23 | 显示全部楼层
这就是我不用NAS的原因
 楼主| 发表于 2021-3-22 10:49:43 | 显示全部楼层
本帖最后由 TvT 于 2021-3-22 14:57 编辑
pslt 发表于 2021-3-14 13:30
Symantec Endpoint Protection 怎樣白票?


客户端版本不需要付费,杀毒防护还阔以,防勒索得搭配智量比较好,智量在卡饭样本区防勒索成绩还不错;

赛门铁克:https://bbs.kafan.cn/thread-2183764-1-1.html

智量:https://www.wisevector.com/




补充,方便赛门铁克更新,改魔法PAC或改hosts,比如我加到路由器PAC里去了
引用:https://bbs.kafan.cn/forum.php?mod=redirect&goto=findpost&ptid=2205033&pid=48421026


  1. 1)在 hosts 中添加
  2. # Symantec LiveUpdate
  3. 152.195.12.127 definitions.symantec.com
  4. 152.195.12.171 liveupdate.symantecliveupdate.com
  5. 152.195.12.135 liveupdate.symantec.com
  6. 2)SEP 扫描,排除上述刚加入 hosts 的 SecurityRisk.URLRedir
  7. 3)创建任务计划程序 "Symantec Endpoint Protection Live Update",运行
  8. %ProgramFiles(x86)%\Symantec\Symantec Endpoint Protection\SepLiveUpdate.exe
  9. 触发器:a) 每日,隔4小时 b) 当任何用户登录时
  10. 或直接导入附件。
复制代码

 楼主| 发表于 2021-3-22 10:52:14 | 显示全部楼层
生如风絮 发表于 2021-3-14 13:42
去年一月,3389暴露中了.devil后缀的勒索病毒,同devos为phobos家族的变种。
至今未解 ...

因为没解开,我直接格式重装了,

用卡巴急救盘扫到几个东西,都不知道哪里中的招
您需要登录后才可以回帖 登录 | 注册

本版积分规则

Archiver|手机版|小黑屋|全球主机交流论坛

GMT+8, 2024-4-19 02:22 , Processed in 0.070154 second(s), 9 queries , Gzip On, MemCache On.

Powered by Discuz! X3.4

© 2001-2023 Discuz! Team.

快速回复 返回顶部 返回列表