my services were deleted by haker

carlos barros
carlos barros used Ask the Experts™
on
hello i have exchange 2013 and i surfer an attack by ramsom i pay de pirate resgate but my exchange were delete the services can any body help me to fix this problem
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Senior Engineer
Commented:
At this point, your Exchange environment has been severely compromised.

You need to restore your Exchange from a backup that isn't affected, or you will need to rebuild your Exchange environment.

How many Exchange servers are we looking at?
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018
Commented:
Since ransomware can affect more than Exchange, if you decide to rebuild Exchange, you might be as well or better off to backup and rebuild the servers entirely,

Author

Commented:
I already clean the ramson virus the pirate after pay give me the decryption key, but wen the pirate use the ProcessHacker to stop the services, delete some of the services I see that In Microsoft some time ago there was a tool to fix the services but now it is unviable at this time may some body have that tool, all the data base is ok only the services are deleted.
Shaun VermaakTechnical Specialist
Awarded 2017
Distinguished Expert 2018
Commented:
Export services from working Exchange Server. You can build a quick VM with Exchange installed and export the services from Registry but as mentioned in other posts, I will not trust the server
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018

Commented:
Good answers provided.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial