What to do if the medical system is infected with ransomware?

1. isolate the infected host: isolate the poisoned computer as soon as possible, close all network connections, disable the network card;

2. cut off the transmission path: close the potential terminal SMB 445 and other network **** enjoyment ports, close the abnormal outreach access;

3. find the source of the attack: manual packet analysis or analysis with the help of situational awareness products, to confirm the number of infections across the network;

4. check and kill the virus: can be used with the following tools to check and kill;

5.

4. kill the virus: you can use the following tools to kill;

5. set complex passwords: if the host account using a simple password, it is recommended to reset to a strong password

Welcome to exchange supplementary!