-3

The SQL server was infected by a ransomware virus. Files has been modified as [email protected]. Unfortunately all the DB backup files were also stored on the C: drive. I cannot login to the SQL Server and services cannot be started and all files related to SQL server program are also effected. I'm not sure which executable is infecting the files.

How can I avoid the data loss? I've been trying to find any fix tool using a small infected file in the server or a way to decrypt encrypted data but so far it has not been successful. When I did my research on this it was mentioned that "This ransomware has no known way of decryption data!"

enter image description here

7
  • 7
    Sounds to me like you're totally screwed. Reallllly need external backups for exactly this reason.
    – user41341
    Commented Jul 19, 2016 at 17:07
  • Data was important this a sales database,it contained all of our clients data but the server was handled by the service provider and they informed us that VM back-ups are taken daily,We did not worry about the back-ups as they were responsible for it.
    – Heisenberg
    Commented Jul 19, 2016 at 17:11
  • 7
    I'm afraid the computers have no sympathy for how important your data was. Commented Jul 19, 2016 at 17:13
  • 2
    You need to get your provider to restore your vm backup from the previous night. Make sure you nuke the server and start from scratch with restoring relevant data.
    – DKNUCKLES
    Commented Jul 19, 2016 at 17:17
  • 1
    @PathumAnjana Always maintain your own backups! I have heard countless stories of people/companies getting burned because a third party promised to do it for them and failed to do so.
    – Bacon Brad
    Commented Jul 19, 2016 at 17:30

1 Answer 1

4

You have three options here:

  • Pay the ransom, and hope you get your decryption program / key. From what I am reading, this appears to be a valid method for Troldesh, but I am not seeing any success stories for Rakhni.

    • On that note, which one is it? Your title says Troldesh, but the image and file name point to Rakhni.
  • Attempt to use a decryption tool. You are already attempting recovery using Kaspersky's tool. This can take days, even up to a week, with no guarantee.

  • Restore from a clean backup to a clean system. This really depends on you having a clean backup in the first place.

Unfortunately, ransomware is effective for the very fact that this data is very important. The fact that you are so worried about it is the same reason why this kind of malware has become so popular. People go nuts when their data goes missing, and the attacker is expecting you to pay to get it back.

Unfortunately for everyone involved but the attacker, you found yourself in a tight spot. Without proper backups of the data, you're at most hoping to get it back.

Not something we can really detail here since we aren't attorneys, but worth mentioning: Your hosting provider may be liable for these damages. You might see about reading through your agreements and contacting an attorney if you suffer large damages as a result of this attack.

0

Not the answer you're looking for? Browse other questions tagged .