I-Ransomware noma Ukususwa Kwenqwaba Yengozi ku-Google Drayivu, i-OneDrive, noma i-Dropbox Ukuvumelanisa Amafayela Onakele Kuwo Wonke Amadivayisi (Umlando Wenguqulo Yezinsuku Ezingu-30 Nokuhlehliswa Kwevault)¶

Ukubuka isithonjana sokuvumelanisa kubha yakho yomsebenzi ye-Windows noma ibha yemenyu ye-macOS ijikeleza ngokushesha njengezinkulungwane zemibhalo yebhizinisi, amarekhodi entela, izithombe zomndeni, namafayela ekhodi yomthombo ngaphakathi. Google Drive for Desktop, Microsoft OneDrive, Dropbox, noma iCloud Drive kungenzeka ukuthi zibethelwe nge-ransomware (.locked, .bianlian, .akira, .play, .lockbit) noma kusulwe ngokungalungiselelwe kahle rsync --delete, ukuhudula bese uwisa ifolda ngephutha, noma umbhalo ongekho emthethweni kuyinhlekelele yedatha yesivinini esikhulu. Ngoba amaklayenti okuvumelanisa edeskithophu yamafu akhelwe ukuphindaphinda okuphindwe kabili kwesikhathi sangempela (inotify ku-Linux, FSEvents ku-macOS, futhi ReadDirectoryChangesW / Cloud Filter API ku-Windows), i-ransomware kanambambili noma ngephutha Shift + Delete kokuthi ikhompyutha ephathekayo eyodwa ethelelekile isakazwa ngokushesha phezulu kuseva yefu futhi iphushelwe phansi kokuthi kuyo yonke enye ideskithophu, ikhompuyutha ephathekayo, kanye nefolda yeqembu okwabelwana ngayo exhunywe kuleyo akhawunti ngemizuzwana.

Kodwa-ke, izinjini zokuvumelanisa amafu*** azibhalwa phezu kwediski eluhlaza: ngemuva kwezigcawu, Microsoft OneDrive, Dropbox, Google Drive, futhi Box gcina isitoreji sento esingaguquleki eseceleni kweseva nge-30-day to 180-point-in-time Inguqulo Yemilando*, Imigqomo Yokugaywa Kabusha Yesigaba Sesibili, kanye namathuluzi okubuyisela i-akhawunti yonke (OneDrive Restore Your OneDrive futhi Dropbox Rewind). Uma nje unqamula ikhompuyutha ethelelekile kunethiwekhi, umise kancane ukuvumelanisa emishinini yesibili ukuze uvune izinqolobane zasendaweni ungaxhunyiwe ku-inthanethi, futhi ugweme ugibe olubulalayo lokulayisha kabusha amafayela abethelwe phezu kwesabelo somlando wenguqulo yakho, ungakwazi ukuhlehlisa yonke idrayivu yakho yefu ubuyele emzuzwini oqondile ngaphambi kokuthi ukubethela noma ukususwa kuqale ngaphandle kokukhokha isenti lesihlengo. Ngokuqukatha uhlelo olungayilungele ikhompuyutha endaweni kanye nokuqoshwa kwesistimu yefayela, thintana neziqondiso zethu kokuthi i-ransomware kanye nempendulo ye-malware, ukususwa kwefayela ngephutha nokutholwa kwedrayivu efomethiweyo, futhi ikhophi yasenqolobaneni yekhompuyutha: isu le-3-2-1 kanye nokutholwa kwenhlekelele. Uma ukuhlasela kwe-ransomware kuhlasela isibhedlela, umtholampilo, noma inethiwekhi yokuthunyelwa kwezimo eziphuthumayo, vula ngokushesha izinqubo zesikhathi sokuphumula zomtholampilo ungaxhunyiwe ku-inthanethi futhi ushayele inombolo yakho yasendaweni yezimo eziphuthumayo (911 e-United States naseCanada, 112 kwi-European Union, 999 e-United Kingdom) noma hlola umkhombandlela wethu we izinombolo eziphuthumayo.

Yenza lokhu manje¶

1. Khipha ikhebula le-Ethernet bese uvala i-Wi-Fi kukhompyutha engumthombo NGOKUSHESHA (ngaphambi kokuvala izinhlelo zokusebenza noma ukuchofoza noma yini):
2. Kungani ukusika inethiwekhi kusindisa i-cloud yakho: Njalo ngomzuzwana ikhompuyutha ethelelekile noma esulayo ihlala iku-inthanethi, iklayenti lokuvumelanisa ideskithophu (OneDrive.exe, GoogleDriveFS.exe, Dropbox.exe) ilayisha okunye ukusebenza kwefayela okubethelwe noma okususiwe okungu-50 kuye kwangama-200 ngomzuzwana ku-API yamafu. Ukusika i-Wi-Fi ne-Ethernet kumisa umugqa wokulayisha wamafu kumathrekhi awo.
3. Hamba uye KUYO YONKE ikhompyutha ephathwayo, ideskithophu, ithebulethi, nefoni exhunywe ku-akhawunti efanayo yefu bese UVALA i-Wi-Fi / Ethernet yabo NGAPHAMBI kokuvusa izikrini zabo:
4. I-laptop yakho yesibili engaxhunyiwe ku-inthanethi iyi-capsule yesikhathi sangasese: Uma ideskithophu yakho yasekhaya noma i-MacBook yesibili ilele esikhwameni sakho kusukela izolo, indawo yakhona OneDrive, Dropbox, noma Google Drive (Mirror files / Always keep on this device) ifolda isaphethe amakhophi angu-100% angabetheliwe, angakathintwa amafayela akho.
5. Uma uvusa leyo laptop yesibili ngenkathi i-Wi-Fi ivuliwe, i-daemon yokuvumelanisa ifu ixhumeka ngokushesha, ilande ukususwa kwenqwaba noma ama-ciphertexts e-ransomware kusuka kuseva, futhi ibhubhise leyo khophi yasendaweni emsulwa ngaphansi kwamasekhondi angu-60. Vala irutha yakho yasekhaya ye-Wi-Fi (khipha intambo yayo yamandla) ngaphambi kokuvusa noma iyiphi ikhompyutha yesibili, bese ukopisha amafolda endawo uwafake kudrayivu ye-USB yangaphandle ngenkathi ungaxhunyiwe ku-inthanethi.
6. Uma imbangela kuyiRansomware, donsa intambo yamandla (noma ubambe ngamandla inkinobho yamandla imizuzwana eyi-10) ku-PC ethelelekile; uma imbangela ingukususwa ngengozi ku-SSD, yishiye yodwa bese wehlisa/misa i-daemon yokuvumelanisa:
7. I-Ransomware: Amandla okudonsa amisa imicu yokubethela (AES / ChaCha20 abasebenzi) ekubetheleni amafolda asele angabetheliwe kudrayivu yakho yasendaweni futhi igcina okhiye be-RAM abashintshashintshayo uma kudingeka ukuhlaziya inkumbulo yomthetho.
8. Ukususwa Ngengozi: Bulala OneDrive.exe / Dropbox.exe / GoogleDriveFS.exe ku-Task Manager (Ctrl + Shift + Esc) noma I-Activity Monitor ngokushesha ukuze iklayenti lasendaweni lime ulayini DELETE Amakholi we-API.
9. UNGAWAsusi ngesandla amafayela abethelwe nge-ransomware (.locked) kusixhumi esibonakalayo sewebhu yefu uma uhlelo olungayilungele ikhompuyutha luqambe kabusha izandiso zefayela:
10. Qonda ukuthi i-ransomware isebenzisana kanjani nesitoreji samafu:
    • Ikesi A: Ukubhala phezu Kwendawo (Igama Lefayela elifanayo): I-ransomware ibethelwe Tax_2025.xlsx futhi ilondoloze imali ekhokhelwayo ebethelwe ngaphansi kwegama elifanayo ncamashi Tax_2025.xlsx. Lapha, isevisi yefu iphatha ifayela elibethelwe njengokuthi Inguqulo 2, kuyilapho ifayela lakho langempela elihlanzekile lihlezi ngaphansi ngokuphephile njengokuthi Inguqulo 1 ngaphakathi Version History.
    • Icala B: Qamba Kabusha + Susa Okwangempela (Tax_2025.xlsx.lockbit): Ukufundwa kwe-ransomware yesimanjemanje Tax_2025.xlsx, ibhala ifayela elisha eliqanjwe igama Tax_2025.xlsx.lockbit, futhi isusa okwangempela Tax_2025.xlsx. Lapha, okwangempela kwakho okuhlanzekile Tax_2025.xlsx ihlezi ngaphakathi kwe- Cloud Trash / Recycle Bin (kanye nokubuyisela emuva kwe-akhawunti yephoyinti ngesikhathi).
11. Ngena ku-portal yewebhu yefu (onedrive.live.com, dropbox.com, drive.google.com, icloud.com) kusuka kudivayisi EHLANZEKILE, ENGATHIWA (njenge-smartphone kudatha yeselula noma kukhompuyutha engayodwa):
12. Ungalokothi ungene futhi ku-akhawunti yakho yefu kusukela kukhompuyutha etheleleke nge-ransomware, futhi ngokushesha uhoxise iseshini yedivayisi ye-OAuth yekhompyutha ethelelekile ngaphansi kwekhasi lakho le-Google, i-Microsoft, noma i-akhawunti ye-Dropbox Account Security ukuze i-PC ethelelekile ingakwazi ukuqalisa ukuvumelanisa uma othile eyivula futhi.
13. Sebenzisa i-akhawunti ye-Point-in-Time Rollback (Restore your OneDrive noma Dropbox Rewind) esikhundleni sokubuyisela amafayela angu-50,000 ngalinye ngalinye:
14. Kokubili iMicrosoft OneDrive neDropbox zifaka phakathi umshini wesikhathi we-akhawunti yonke ozenzakalelayo ogingqa yonke ifolda, inguqulo yefayela, nento esusiwe kuyo yonke idrayivu yakho ibuyisele isitembu sesikhathi esithile (1 hour ago, Yesterday at 11:00 PM, noma kuze 30 to 180 days ago) ekusebenzeni kohlangothi olulodwa lweseva.

Isihlahla sesinqumo: ukuvinjelwa kwenhlekelele kokuvumelanisa amafu kanye nokuthola iphuzu ngesikhathi¶

Sebenzisa lokhu kugeleza komsebenzi okuphuthumayo ukuze umise ukusakazwa kokuvumelanisa kwedivayisi futhi ubuyisele isimo sakho sefu esihlanzekile:

flowchart TD
    Start["Ukubethela Kwe-Ransomware NOMA Ukususwa Kwenqwaba Ngengozi Kuvunyelaniswa Ku-Cloud Drive"] --> CutNet["ISINYATHELO 1: Khipha i-Ethernet futhi Uvale i-Wi-Fi Kukhompyutha Yomthombo Ngokushesha (Noma Khipha Intambo Yamandla Erutha ye-Wi-Fi)"]

    CutNet --> SaveSecondaries["ISINYATHELO 2: Gcina Wonke Amakhompyutha Aphathekayo/Amakhomphyutha Esibili Engaxhunyiwe Ku-inthanethi (Imodi Yendiza) -> Kopisha Amafolda Enqolobane Yawo Yasendaweni ethi 'OneDrive / Dropbox / Google Drive' Kudrayivu Ye-USB Yangaphandle"]

    SaveSecondaries --> RevokeSession["ISINYATHELO 3: Kusuka Ocingweni/Isiphequluli Esihlanzekile, Ukuphepha Kwe-akhawunti Evuliwe (Google / Microsoft / Dropbox) -> Hoxisa / Khipha Ukuxhumanisa Iseshini Yokuvumelanisa Yedeskithophu Ye-PC Ethelelekile"]

    RevokeSession --> WhichCloud{"Iyiphi Inkundla Yesitoreji Samafu Eyashaywa?"}

    WhichCloud -->|"I-Microsoft OneDrive / SharePoint (Personal noma i-Microsoft 365)"| OneDriveRestore["Sebenzisa 'Izilungiselelo -> Izinketho -> Buyisela I-OneDrive yakho' (Ibuyisela Konke Ukuhlela, Ukuqamba Kabusha, Nokususwa Kuyo Yonke I-akhawunti Kufika Ezinsukwini Ezingu-30) + Hlola Ibhin Yokuphinda Isetshenziswe kabusha Yesiteji sokuqala & Sesiteji Sesibili"]

    WhichCloud -->|"I-Dropbox (Plus, Family, Professional, Business, noma Basic)"| DropboxRestore["Sebenzisa i-'Dropbox Rewind' Kufolda Yezimpande (Ibuyisela I-akhawunti Yonke Ukuze Ibe Iminithi Elinembile Ngaphambi Kokuhlaselwa) NOMA Sebenzisa 'Amafayela Asusiwe' + 'Ilogi' 'Yemicimbi' (Izinsuku Ezingu-30 kuya kwezingu-180)"]

    WhichCloud -->|"I-Google Drayivu (I-Gmail yomuntu siqu noma i-Google Workspace)"| GDriveRestore["1. Hlunga 'Udoti' 'ngedethi Elahliwe' ukuze Ubuyisele Okwangempela Okususiwe Ngobuningi. 2. Ngamafayela Abhalwe Phezu Kwamafayela: Chofoza Kwesokudla -> 'Ulwazi lwefayela -> Phatha izinguqulo' NOMA Qalisa i-Google Drive API v3 Bulk Revision Rollback script"]

    WhichCloud -->|"I-Apple iCloud Drive"| iCloudRestore["Ngena ku-'iCloud.com/recovery' -> Chofoza okuthi 'Buyisela Amafayela' (Ibuyisela Amafayela Asusiwe Ezinsukwini Ezidlule Ezingu-30, Noma Akhishwe Kokusanda Kususwa)"]

Isigaba 1: Izinjini zokuvumelanisa amafu ziyicubungula kanjani i-ransomware vs. Ukususwa (Lapho amafayela akho ahlanzekile ahlala khona ngempela)¶

Ngaphambi kokuchofoza izinkinobho zokubuyisela ngokwethuka, hlola indlela amafayela akho ashintshwe ngayo kuphothali yewebhu yefu (drive.google.com, onedrive.live.com, noma dropbox.com). Sonke isigameko sokuvumelanisa ifu siwela kwelinye lamaphethini amathathu obuchwepheshe:

Isigaba sesi-2: Ukuhlehliswa kwefu kwe-Platform-by-platform kanye nokutholwa kwenguqulo yenqwaba¶

Landela inqubo yokuphinda uthole umhlinzeki wakho wamafu kusuka kusiphequluli esihlanzekile, esingatheleleki.

1. I-Microsoft OneDrive & SharePoint Online (Restore Your OneDrive & 2-Stage Recycle Bin)¶

I-Microsoft yenze i-OneDrive ngokukhethekile ukuze isinde ekubethelweni kwe-ransomware nokususwa kokuvumelanisa okukhulu:

1. Indlela A: Iphuzu Lonke Le-Akhawunti-Ngesikhathi Ukubuyisela emuva (Restore your OneDrive):
2. Itholakala ku-Microsoft 365 Personal, Family, Business, kanye ne-Enterprise (SharePoint Online imitapo yolwazi):
3. Ngena ngemvume onedrive.live.com (noma ingosi yakho yewebhu ye-Microsoft 365 OneDrive) kukhompuyutha ehlanzekile.
4. Chofoza isithonjana se- Izilungiselelo Zegiya (ekhoneni eliphezulu kwesokudla) -> khetha Options -> chofoza Restore your OneDrive kufasitelana lesobunxele lokuzulazula (kumasayithi weqembu le-SharePoint, chofoza Settings Gear -> Restore this library).
5. Ngaphansi Select a date, khetha Yesterday (noma Custom date and time).
6. Bheka Ishadi Lebha Ye-Histogram: uzobona i-spike enkulu emugqeni wesikhathi omaka umzuzu oqondile okuqale ngawo ukubethela kwe-ransomware noma ukususwa kwenqwaba.
7. Hudulela isilayidi somugqa wesikhathi kokuthi kwesokunxele saleyo spike (ukuze wonke amafayela anonya aqambe kabusha, bhala phezu, futhi ukususwa okudalwe ngemva kwalowo mzuzu kuhlolelwa ukuhlehliswa).
8. Chofoza Restore. Amaseva e-Microsoft azohlehlisa ngokuzenzakalelayo konke ukuguqulwa kwefayela, asuse i-ransomware esanda kwakhiwa .locked amafayela, futhi ubuyisele wonke amafayela asusiwe asekuqaleni emuva esakhiweni sawo sefolda kusukela ngaphambi kwesigameko.
9. Indlela B: "Umgqomo Wokuphinda Usetshenziswe Wesigaba Sesibili" Ofihliwe (Lapho I-Recycle Bin evamile ithululwa):
10. Kuthiwani uma umhlaseli (noma umbhalo ozenzakalelayo) engenile ku-OneDrive/SharePoint web interface yakho bese echofoza Empty recycle bin?
11. Ku-OneDrive for Business / SharePoint Online (kanye nama-akhawunti e-Microsoft 365), ukukhipha i-Recycle Bin eyinhloko AKUSUSI amafayela akho. Esikhundleni salokho, iwahambisa ku- Second-Stage Recycle Bin efihliwe (Site Collection Recycle Bin) lapho ehlala evikelekile kuze kube ingqikithi yezinsuku ezingama-93:
    1. Vula Recycle bin kubha eseceleni yesokunxele ye-OneDrive.
    2. Skrola uze ufike ekugcineni kwekhasi bese uchofoza isixhumanisi esincane esifundwayo: Can't find what you're looking for? Check the Second-stage recycle bin.
    3. Khetha wonke amafayela bese uchofoza Restore.

2. I-Dropbox (Dropbox Rewind, Events Rollback, futhi Deleted Files)¶

1. Indlela A: Ukusebenzisa Dropbox Rewind Ukuhlehlisa Wonke Amafolda Noma I-akhawunti Yakho Yonke:
2. Itholakala ku-Dropbox Plus, Family, Professional, kanye nezinhlelo zebhizinisi (30 days ku 180 days bheka emuva):
3. Ngena ngemvume dropbox.com esipheqululini esihlanzekile.
4. Ukuze ubuyisele emuva yonke i-akhawunti yakho ye-Dropbox ngesikhathi esisodwa, hambisa phezulu All files unhlokweni (noma chofoza ... (Izenzo ezengeziwe) imenyu kuphaneli yesenzo engakwesokudla uma ifolda ethile ekhethiwe) bese uchofoza Rewind this folder (noma Rewind Dropbox).
5. Chofoza Get started -> buka igrafu yomsebenzi wosuku nosuku ukuze uthole i-spike lapho i-ransomware noma ukususwa kwenzeka -> chofoza lolo suku ukuze usondeze kumugqa wesikhathi othi ihora nehora / umzuzu nomzuzu.
6. Misa umugqa oluhlaza okwesibhakabhaka oqondile nje ngaphambi kokuthi kuqale umcimbi omubi, chofoza Continue, bese uchofoza Rewind.
7. I-Dropbox izobuyisela wonke amafayela abhalwe ngaphezulu, ihlanze amanothi e-ransomware asanda kungezwa, futhi ivuse wonke amafolda asusiwe asendaweni.
8. Indlela B: Kuthiwani uma ukumahhala Dropbox Basic i-akhawunti (lapho Dropbox Rewind ikhiyiwe)?
9. Okubalulekile: Ngisho noma mahhala Dropbox Basic (2 GB), i-akhawunti, I-Dropbox isagcine izinsuku ezingama-30 ezigcwele Version History kanye nezinsuku ezingama-30 Deleted Files ukutholwa kwefayela ngalinye kumaseva abo.
10. Inketho 1 (Ukutholwa Kwesandla Kwamahhala): Chofoza Deleted files kubha eseceleni yesokunxele ye dropbox.com ukuhlunga ngedethi nokubuyisela ngobuningi okwangempela okususiwe; noma chofoza ... -> Activity -> Version history kunoma yiliphi ifayela elibhalwe ngaphezulu ukuze ubuyisele isibuyekezo esihlanzekile sangaphambilini.
11. Inketho 2 (Instant Dropbox Plus Thuthukisa Ukuvula): Ngoba i-Dropbox irekhoda ilogu yomcimbi ewumsuka kuwo wonke ama-akhawunti ngaphandle kwesigaba, ithuthukisa Dropbox Basic akhawunti ku Dropbox Plus ($11.99 inyanga engu-1) ngemuva kwesigameko sivula Dropbox Rewind I-UI ezinsukwini ezingu-30 ezedlule zemicimbi yefayela eselirekhodiwe kakade.

3. I-Google Drayivu ne-Google Workspace (Trash, Manage Versions, Admin Console 25-Day Post-Trash Recovery, kanye ne-Bulk API Rollback)¶

Ngokungafani ne-OneDrive ne-Dropbox, i-Google Drayivu ayinayo inkinobho yokuchofoza kanye "Buyisela Idrayivu Ephelele" ku-UI yabathengi, ngakho-ke kufanele usebenzise indlela yokutakula efanele kuye ngokuthi amafayela asusiwe noma abhalwe phezu kwendawo:

1. Ithola Okwangempela Okususiwe ku-Google Drayivu Trash (Ukuze Uqambe Kabusha+Susa I-Ransomware noma Ukususwa Kwenqwaba):
2. Vula drive.google.com/drive/trash kusiphequluli sedeskithophu.
3. Chofoza inkinobho Trashed date unhlokweni wekholomu ukuze uhlunge amafayela asanda kususwa uwayise phezulu.
4. Chofoza ifayela lokuqala elihlanzekile elisuswe yi-ransomware/ingozi, skrolela phansi, ubambe **Shift + chofoza ** ifayela lokugcina eqeqebeni, chofoza kwesokudla, bese ukhetha Restore (Ctrl + Z noma isithonjana sewashi elithi Buyisela). Lonke ifayela libuyela ngokuqondile kufolda yalo engumzali efakwe esidlekeni.
5. Kuthiwani uma i-Google Drayivu Trash Yayivele Ithululiwe? (Google One Support & Google Workspace Admin 25-Day Rescue):
6. I-Google Workspace (Ibhizinisi, Ibhizinisi, Imfundo, IZingenzi-nzuzo): Ngisho nangemva kokuchofoza komsebenzisi Empty trash -> Delete forever, iziphakeli ze-Google zigcina amafayela ahlanziwe ezinye izinsuku ezingu-25. Ngena ku-admin.google.com Njengomphathi Omkhulu -> yiya ku-Directory -> Users* -> chofoza umsebenzisi othintekile -> skrolela phansi kokuthi More options (noma chofoza iphaneli engakwesokunxele ngaphansi kwesifinyezo somsebenzisi) -> chofoza Restore data -> khetha Ibanga Losuku (kufika ezinsukwini ezingama-25 emuva), khetha Drive njengohlelo lokusebenza, bese uchofoza Restore.
7. I-Gmail Yomuntu Siqu / Ama-Akhawunti E-Google One: Uma Udoti wakho we-Google Drayivu uthululwa phakathi nezinsuku ezingu-25 ezidlule, ungabhali idatha entsha kudrayivu; vula ngokushesha support.google.com/drive/gethelp (noma ingxoxo yokusekela ethi Google One) futhi ucele Ukutholwa Kwefayela LeDrayivu Yokuphatha. Ithuluzi lokusekela le-Google lingase liqalise ukubuyiselwa okungemuva kwezinsuku ezingama-25 kwangemuva kokulahla kudoti kuma-akhawunti omthengi.
8. Ukubuyisela Inqwaba Amafayela Abhalwe Ngaphansi Kusetshenziswa Manage Versions noma i-Google Drive API (rclone /Python):
9. Nge-Google Amadokhumenti, AmaSpredishithi, namaSlayidi: Vula ifayela -> chofoza File -> Version history -> See version history (Ctrl + Alt + Shift + H) bese ubuyisela isitembu sesikhathi sayizolo.
10. Okwamafayela kanambambili (PDF, DOCX, XLSX, JPG, ZIP) kubhalwe phezu kwendawo: Chofoza kwesokudla ifayela ku-Google Drayivu -> File information -> Manage versions, lapho i-Google igcina khona izinguqulo ezindala izinsuku ezingu-30 (noma izinguqulo eziyi-100).
11. Uma izinkulungwane zamafayela kanambambili zibhalwe phezu kwendawo: Ungachofozi Manage versions Izikhathi eziyi-10,000 ngesandla. Sebenzisa rclone noma I-Google Apps Script / Drive API v3 revisions.list + revisions.delete umbhalo:
    • Ku-Google Drive API v3, lapho ifayela elikhona libhalwa ngaphezulu ngenguqulo embi (Revision N), ebiza Drive.Revisions.remove(fileId, latestRevisionId) isusa kuphela isibuyekezo esiphezulu esinonya esidalwe namuhla, ukuphromotha ngokuzenzakalela Ukubuyekeza okuhlanzekile kwayizolo N - 1 emuva ukuze kube ifayela lamanje elisebenzayo kuwo wonke amafolda:

      // Run inside script.google.com (with Advanced Drive Service v3 enabled) to roll back files modified after cutoffTime
      function rollbackOverwrittenFiles() {
        const cutoff = new Date("2026-11-01T00:00:00Z"); // Set to 5 minutes BEFORE the ransomware started
        const files = DriveApp.searchFiles('modifiedDate > "2026-11-01T00:00:00" and trashed = false');
        while (files.hasNext()) {
          const file = files.next();
          const revs = Drive.Revisions.list(file.getId()).revisions;
          if (revs && revs.length > 1) {
            const latest = revs[revs.length - 1];
            if (new Date(latest.modifiedTime) > cutoff) {
              Drive.Revisions.remove(file.getId(), latest.id);
            }
          }
        }
      }
      

12. Apula iCloud Drive (iCloud.com/recovery Ukutholwa Kwedatha Yezinsuku Ezingu-30):
13. Ngisho noma amafayela asusiwe ku-iCloud Drive futhi ahlanzwa ku- Recently Deleted ku-Mac yakho noma ku-iPhone, ngena ku-icloud.com/recovery* esipheqululini sewebhu:
14. Chofoza Restore Files -> hlola Select All (noma hlunga ngosuku olususiwe) bese uchofoza Restore. Iseva ye-Apple backend igcina indawo ehlukile yokutakula yezinsuku ezingama-30 ebuyisela amadokhumenti e-iCloud Drive asusiwe, amafolda edeskithophu/Amadokhumenti, Amabhukumaka, Oxhumana Nabo, namakhalenda.

Isigaba sesi-3: Ukuvuna izinqolobane zasendaweni ezingaxhunyiwe ku-inthanethi kusuka kumadivayisi wesibili kanye Google DriveFS / Windows Shadow Copies¶

Ngaphambi kokuxhuma kabusha noma iyiphi ikhompuyutha ku-inthanethi, hlola ukuthi ingabe ama-hard drive asendaweni asekhona yini amakhophi angonakalisiwe amafayela akho:

Isigaba sesi-4: Iphrothokholi yokuxhuma kabusha ephephile (Ungawabuyisela kanjani amakhompyutha ahlanziwe ku-inthanethi ngaphandle kokonakalisa kabusha ifu)¶

Elinye lamaphutha avame kakhulu ekutholeni amafu kwenzeka ngemuva kokubuyisela amafayela akho ngempumelelo kusixhumi esibonakalayo sewebhu: umsebenzisi uvula ikhompyutha yakhe ephathekayo, iklayenti lokuvumelanisa lendawo liyavuka, libone angu-20,000. .locked amafayela e-ransomware (noma amafolda angenalutho) ahlezi kusigcinalwazi sendawo, futhi ivumelanisa ukonakala kubuyele kudrayivu yefu esanda kubuyiselwa.

Landela lolu hlu lokuhlola lokuxhuma kabusha oluqinile: 1. Kukhompuyutha edale isigameko (I-Ransomware noma i-Accidental Script): - Uma ishaywe ngu-Ransomware: Ungalokothi uxhume kabusha lokho kufakwa kwe-OS ku-akhawunti yakho yefu. Ngemva kokuthwebula idrayivu ye-forensics noma ukuhlenga noma imaphi amafayela endawo kuphela angasekelwanga, sula ngokuphelele i-SSD (Secure Erase / susa zonke izingxenye) bese uhlanza iWindows noma i-macOS kusifaki esaziwayo se-USB esakhelwe kukhompuyutha ehlukile. - Shintsha iphasiwedi yakho ye-akhawunti ye-Google, Microsoft, Dropbox, ne-Apple futhi ubuyekeze Account Security -> Devices futhi Third-Party App Permissions ukuze uqinisekise ukuthi awekho amakhukhi esikhathi se-infostealer ahlala esebenza. 2. Kumakhompyutha esibili ngaphambi kokuvula futhi i-Wi-Fi: - Uma usuvele ubuyisele idrayivu yefu esimweni esihlanzekile nge Restore your OneDrive noma Dropbox Rewind: 1. Qalisa ikhompuyutha yesibili nge-Wi-Fi isavaliwe. 2. Khubaza OneDrive / Dropbox / Google Drive kokuthi Izinhlelo Zokuqalisa (Task Manager -> Startup apps) ukuze i-daemon yokuvumelanisa ingakwazi ukuqalisa ngokuzenzakalelayo. 3. Qamba kabusha indawo C:\Users\<Name>\OneDrive (noma Dropbox) ifolda eya OneDrive_OLD_LOCAL_BACKUP. 4. Vula i-Wi-Fi futhi, vula uhlelo lokusebenza lokuvumelanisa ifu, luvumele lunqamule futhi luxhumanise kabusha ngokuhlanzekile, futhi ulivumele ukuthi lilande isimo sefu elihlanzekile elisanda kubuyiselwa libe yifolda entsha sha.

3. Ukubuyisela iWindows Volume Shadow Copies (Previous Versions) kanye ne-macOS APFS Izifinyezo Zasendaweni ku-PC yomthombo¶

Kuthiwani uma ifolda ebibethelwe noma isusiwe ibikade ikhishiwe ekuvunyelanisweni kwamafu (njengendawo Desktop ifolda noma ifayela elikhulu kunomkhawulo wokuvumelanisa), noma iklayenti lokuvumelanisa ifu belingakaqedi ukulayisha ukuhlelwa kweviki eledlule ngaphambi kokuphahlazeka? 1. Kuvuliwe Windows 10/11 (ShadowExplorer & vssadmin): - Ngenkathi imindeni eminingi ye-ransomware izama ukusebenza vssadmin.exe delete shadows /all /quiet, Ukulawulwa kwe-Akhawunti Yomsebenzisi (UAC), Ukutholwa Kwephoyinti Lokugcina kanye Nempendulo (EDR), noma ukusebenzisa okungeyena umlawuli kuvame ukuvimba ukusula kwekhophi yesithunzi. - Qalisa i-Command Prompt njengoMlawuli emshinini ongawodwa bese uthayipha:

vssadmin list shadows

Imibuzo evame ukubuzwa¶

Ingabe ukukhokha isihlengo se-decryptor seqembu lezigelekeqe ze-ransomware kunengqondo uma amafayela ami evumelaniswa ku-OneDrive, iDropbox, noma i-Google Drayivu?¶

Cishe ungalokothi. Ngokungafani ne-hard drive yasendaweni engasekelwanga yodwa, izinsiza zokugcina amafu (I-OneDrive, I-Dropbox, I-Google Drayivu, Ibhokisi, futhi iCloud Drive) gcina amafayela kusitoreji sezinto ezingaguquleki ezingemuva lapho konke ukuguqulwa kudala inguqulo entsha yento futhi konke ukususwa kuhambisa into esitsheni sikadoti sezinsuku ezingu-30 (noma ezingu-93-to-180). Ukuthi i-ransomware iwahoxise amafayela akho endaweni noma yakha amasha .kukhiyiwe amafayela futhi wasusa okwangempela, Amaphesenti angu-100 wamafayela akho angempela angabetheliwe asahlezi eziphakelini zabahlinzeki bamafu ngaphakathi Komlando Wenguqulo noma Udoti. Ukusebenzisa Buyisela i-OneDrive yakho, I-Dropbox Rewind, noma Udoti we-Google Drayivu kanye nokutholwa Kwesibuyekezo kubuyisela amafayela akho aqondile angaphambi kokuhlaselwa mahhala ngaphandle kwengozi ephukile ye-ransomware decryptor.

Kungani i-ransomware ku-Windows PC yami ikwazile ukubethela i-Google Drive yami noma i-OneDrive kwasekuqaleni? Ingabe ifu alivikeli kuhlelo olungayilungele ikhompuyutha?¶

Ukwenza amafayela amafu asebenze nezinhlelo zedeskithophu njengeMicrosoft Word, Excel, Photoshop, ne-AutoCAD, amaklayenti okuvumelanisa ideskithophu (I-Google Drayivu Yedeskithophu, I-OneDrive.exe, I-Dropbox.exe) khweza isitoreji sakho samafu njenge- ifolda yendawo noma incwadi yedrayivu ebonakalayo (G:\ noma C:\Abasebenzisi\Igama\OneDrive) ngaphansi kwezimvume zakho zomsebenzisi we-Windows. Lapho i-ransomware isebenza ngaphansi kwe-akhawunti yakho yomsebenzisi ye-Windows, inezimvume ezifanayo ncamashi zokuguqulwa kwefayela ozenzayo: ihamba zonke izinhlamvu zokushayela ezifakiwe (C:\, D:\, G:\) nefolda yomsebenzisi, efunda ifayela ngalinye, alibhale ngekhodi, futhi aligcine. Ngisho namafayela asethwe ukuze "Ku-inthanethi Kuphela / Sakaza Amafayela" (Amafayela Afunwayo) ilandwe ngokuzenzakalelayo ("hydrated") ku-fly by Windows noma nini lapho inqubo ye-ransomware ivula isibambo sefayela ukuze ilifunde. Kungakho ukunqamula inethiwekhi ngokushesha kubalulekile: kwephula ukulandwa kwe-hydration okufunayo kwamafayela amafu aku-inthanethi kuphela ngaphambi kokuthi i-ransomware iwafunde.

Kuthiwani uma ngephutha ngisuse Ifolda Eyabelwe Enkulu ku-Google Drayivu noma i-Dropbox, futhi amanye amalungu eqembu abe namanye amafayela ngaphakathi kuyo?¶

Ku I-Dropbox, noma yiliphi ilungu elinezimvume zokuhlela lingasebenzisa Amafayela asusiwe noma I-Dropbox Rewind kufolda eyabelwe ukubuyisela lonke uhlelo lwefolda yeqembu lonke. Ku I-Google Drayivu, izakhiwo zobunikazi zihlukile: uma ususa ifolda engaphansi ngaphakathi kwefolda eyabelwe omunye umuntu (lapho bona unguMnikazi futhi unguMhleli), ukhipha ifayela kufolda okwabelwana ngayo izintandane ifayela kunokuba ulilahlele umnikazi, noma uhambisa amafayela kuphela wena okwakho ku lakho Udoti (drive.google.com/drive/trash) kuyilapho amafayela osebenza naye engena yabo Udoti (noma ube yintandane kumsuka wabo weDrayivu usesheke nge ngu:umnikazi ongahlelekile:mina kubha yokusesha ye-Google Drayivu).

Ingabe i-ransomware ingakwazi ukususa umlando wami wenguqulo yefu noma ithulule i-OneDrive yami / i-Google Drive Recycle Bin ngokuzenzakalelayo?¶

Amabhanari ajwayelekile e-ransomware yesistimu yefayela (I-LockBit, U-Akira, I-BlackCat, Dlala, Phobos) isebenza kuphela ngama-API wesistimu yefayela lendawo yeWindows (YakhaFileW, BhalaFile, SusaIfayelaW) kanye angeke sebenzisana newebhu kuphela Umlando Wenguqulo, I-Recycle Bin Yesigaba Sesibili, noma I-Google Workspace Admin Vault. Kodwa-ke, uma umhlaseli ephinde wafaka i- infostealer (Lumma, I-RedLine) noma ube nedeskithophu yesilawuli kude esebenzisanayo (I-RDP / AnyDesk) ukufinyelela kusiphequluli sakho sewebhu esivuliwe, bangase bakuvule mathupha isiphequluli sakho bese bechofoza Sula Udoti. Noma ngabe bekwenzile, khumbula izinqamuleli ezimbili zokugcina: (1) Vuliwe I-OneDrive / SharePoint, izinto ezingenalutho ziya ku I-Recycle Bin Yesigaba Sesibili kuze kufike ezinsukwini ezingama-93; futhi (2) Vuliwe I-Google Drayivu / i-Google Workspace, izinto zikadoti ezithululiwe zihlala zitholwa Umlawuli we-Workspace noma Usekelo lwe-Google One Izinsuku ezingu-25 ngemva kokususwa unomphela.

Iziqondiso ezihlobene¶

• I-Ransomware kanye nohlelo olungayilungele ikhompuyutha: ukuhlukaniswa nokutholakala ngokushesha
• Ukususwa kwefayela ngengozi, idrayivu efomethiwe, nokutholwa kwesithombe
• IZwi Elilonakele, i-Excel, i-PDF, noma ifayela lesizindalwazi kanye nokutholwa kwedokhumenti engalondoloziwe
• Izipele zekhompuyutha: isu le-3-2-1 kanye nokutholwa kwenhlekelele
• Ukudunwa kwekhukhi lesikhathi, i-infostealer malware, nokuhoxiswa kokhiye wokudlula
• Izinombolo zesimo esiphuthumayo ngezwe

Imithombo nesiqondiso esisemthethweni¶

• Ukusekelwa Okusemthethweni kweMicrosoft (support.microsoft.com/en-us/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15): Buyisela I-OneDrive Yakho (I-Rollback Histogram ye-Rollback yezinsuku ezingu-30, Izaziso Zokuthola I-Ransomware, kanye Nokubuyiselwa Kwe-SharePoint Recycle Bin First/Sesibili).
• Isikhungo Sosizo Esisemthethweni se-Dropbox (help.dropbox.com/delete-restore/rewind & recover-older-versions): Usebenzisa i-Dropbox Rewind ukuze Uhlehlise I-Ransomware noma Ukususwa Kwenqwaba, Umlando Wenguqulo Yezinsuku ezingama-30-kuya-180, kanye .dropbox.cache Isiteji.
• Usizo Lomphathi We-Google Workspace & Nemibhalo Esemthethweni Ye-Google Drayivu (support.google.com/a/answer/6052340 & developers.google.com/drive/api/reference/rest/v3/revisions): Ukubuyisela Idatha Ye-Google Drayivu Esuswe Unomphela Phakathi Nezinsuku Ezingu-25 Nge-Admin Console ne-Drive API v3 revisions Ukuphatha.
• I-Cybersecurity and Infrastructure Security Agency (CISA / StopRansomware.gov): Ukuhlukaniswa Kokuvumelanisa Kwesitoreji Samafu kanye Nezinqubo Ezinhle Kakhulu Zokubuyisela Inguqulo Ye-Post-Ransomware.