Our company's server was encypted with Eking ransomware just this past Friday. Asks us to contact samerver1@tutanota.com to decrypt it and pay in bitcoin...All of the database files were renamed to the following:
file name.pdf.id[AB76B4A0-3053].[samerver1@tutanota.com].eking
It was running Windows Server 2012r2 which acted interesting in the morning prior to the attack. Logged in via remote desktop to find Eset protection logged out and a Windows update requirement. Logged in to Eset business account, ran the update on antivirus and Windows, then restarted the server. It was alright until couple of hours later all files got encrypted.
Is there anyway to get the files back apart from contacting the idiots who did it and risking to pay the ransom. Any tool or advice that can help us would be appreciated.
