问：YOUR FILES ARE ENCRYPTED !!!
TO DECRYPT, FOLLOW THE INSTRUCTIONS:
To recover data you need decrypt tool.
To get the decrypt tool you should:
1.In the letter include your personal ID! Send me this ID in your first email to me!
2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files!
3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool!
4.We can decrypt few files in quality the evidence that we have the decoder.
5.Your key is only kept for seven days beyond which it will never be decrypted!
6.Do not rename, do not use third-party software or the data will be permanently damaged!
7.Do not run any programs after the computer is encrypted. It may cause program damage!
8.If you delete any encrypted files from the current computer, you may not be able to decrypt them!
CONTACT US:
consult.raskey@tutanota.com
If no response is received within 12 hours contact: consult.raskey@onionmail.org
ID:T5FxEekN4ab1a2b0
,服务器被攻击，数据都被加密
答：您好，您这是中了勒索病毒了，只有尝试恢复云快照，系统盘和数据盘都需要恢复。另外win2003微软早就不提供维护了，系统安全性很差，建议您恢复了数据之后尽快备份，然后升级成2016系统，可以参考：https://www.west.cn/faq/list.asp?unid=2446 ,非常感谢您长期对我司的支持!
问：服务器被攻击封了，拿下服务器上的数据
答：您好??，1、查看到 09:47:55 服务器，受攻击850.0MB, pps541142, 将封停8小时。??
如果您需要取数据，您可以开一台同机房同集群的试用主机，然后参考https://www.west.cn/faq/list.asp?unid=703 通过内网进行迁移数据。
解决方案:
1.等待封停8小时解封，并且把您所有的域名做别名解析到二级域名，不可直接解析到IP地址,实现隐藏服务器ip地址目的。这样可以使用百度云加速防护节点进行攻击防护.等机房解封也就自动恢复访问.请一定开启百度云加速,并按照要求解析域名，这样会隐藏您服务器真实ip地址,可降低被封停的几率，谢谢
2.转移升级线路到我司支持高防机房(涉及数据镜像方式迁移以及ip变更)参考http://www.west.cn/faq/list.asp?unid=902 创建镜像，然后然后在管理中心-服务器管理-管理-更多-更换集群-更换到my集群机房，然后在选择不保留数据重装为镜像。同时购买相关高防服务。.http://www.west.cn/faq/list.asp?unid=911 是相应防护收费说明,请查阅
