分类目录归档：Oracle

vmdk文件被加密恢复(虚拟机文件加密)

发表于 2025 年 3 月 20 日由惜分飞

有客户的vm虚拟化平台被勒索病毒加密,扩展名为:.{110DCD0A-295C-27A4-914B-5F2CBAAA094E}.tianrui

README.TXT文件内容如下,预留邮箱为:tianrui@mailum.com

I'll try to be brief: 1. It is beneficial for us that your files are decrypted no less than you, 
we don't want to harm you, we just want to get a ransom for our work.
2. Its only takes for us at list 20 minutes after payment to completely decrypt you,
to its original state, it's very simple for us!
3.If you contact decryption companies, you are automatically exposed to publicity,also, 
these companies do not care about your files at all, they only think about their own benefit!
4.They also contact the police. Again, only you suffer from this treatment!
5. We have developed a scheme for your secure decryption without any problems, unlike the above companies,
who just as definitely come to us to decipher you and simply make a profit from you as intermediaries, 
preventing a quick resolution of this issue!

6. In case of refusal to pay, we transfer all your personal data such as (emails, link to panel, 
   payment documents , certificates , personal information of you staff, SQL,ERP,
financial information for other hacker groups) and they will come to you again for sure!

We will also publicize this attack using social networks and other media,
   which will significantly affect your reputation

7. If you contact us no more than 12 hours after the attack, the price is only 50% of the price afterwards!

8. Do not under any circumstances try to decrypt the files yourself; you will simply break them!
         YOU MUST UNDERSTAND THAT THIS IS BIG MARKET AND DATA RECOVERY NEED MONEY ONLY !!!
9.IF YOU CHOOSE TO USE DATA RECOVERY COMPANY ASK THEM 
   FOR DECRYPT TEST FILE FOR YOU IF THEY CANT DO IT DO NOT BELIEVE THEM

10.Do not give data recovery companies acces to your network they make your data cant be decrypted by us - 
for make more money from you !!!!! DO NOT TELL THEM YOUR COMPANY NAME BEFORE THEY GIVE YOU TEST FILE !!!!!! 



Contacts :

Download the (Session) messenger (https://getsession.org)  
You fined me "0585ae8a3c3a688c78cf2e2b2b7df760630377f29c0b36d999862861bdbf93380d"

MAIL:tianrui@mailum.com

通过底层分析,确认vmdk文件可以通过找出来分区信息,确认当时运行的是一个win操作系统

查看对应分区中数据情况

对于类似这种被加密的勒索的虚拟机,我们可以实现比较好的恢复效果,如果此类的数据库(oracle,mysql,sql server)等被加密,需要专业恢复技术支持，请联系我们:
电话/微信:17813235971 Q Q:107644445 E-Mail:dba@xifenfei.com
系统安全防护措施建议：
1.多台机器，不要使用相同的账号和口令
2.登录口令要有足够的长度和复杂性，并定期更换登录口令
3.重要资料的共享文件夹应设置访问权限控制，并进行定期备份
4.定期检测系统和软件中的安全漏洞，及时打上补丁。
5.定期到服务器检查是否存在异常。
6.安装安全防护软件，并确保其正常运行。
7.从正规渠道下载安装软件。
8.对不熟悉的软件，如果已经被杀毒软件拦截查杀，不要添加信任继续运行。
9.保存良好的备份习惯，尽量做到每日备份，异地备份。

发表在勒索恢复 | 标签为 .tianrui恢复, tianrui@mailum.com, vmdk加密恢复, vmdk恢复 | 评论关闭

差点被误操作的ORA-600 kcratr_nab_less_than_odr故障

发表于 2025 年 3 月 19 日由惜分飞

晚上接到一个客户电话,数据库无法启动,咨询我的Oracle Recovery Tools工具的授权问题,我远程登录客户的环境进行查看故障,发现客户进行了一下操作导致最后open报ORA-01152错误

C:\Users\Administrator>sqlplus sys/sys as sysdba

SQL*Plus: Release 11.2.0.1.0 Production on Tue Mar 18 22:43:24 2025

Copyright (c) 1982, 2010, Oracle.  All rights reserved.


Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options

SQL> startup mount
ORACLE instance started.

Total System Global Area 1603411968 bytes
Fixed Size                  2176168 bytes
Variable Size             973081432 bytes
Database Buffers          620756992 bytes
Redo Buffers                7397376 bytes
Database mounted.
SQL> recover database;
Media recovery complete.
SQL> alter database open;
alter database open
*
ERROR at line 1:
ORA-00600: internal error code, arguments: [kcratr_nab_less_than_odr], [1],
[27890], [1589], [1649], [], [], [], [], [], [], []

SQL> recover database;
ORA-00283: 恢复会话因错误而取消
ORA-00264: 不要求恢复


SQL> alter database open;
alter database open
*
ERROR at line 1:
ORA-00600: internal error code, arguments: [kcratr_nab_less_than_odr], [1],
[27890], [1589], [1649], [], [], [], [], [], [], []


SQL> recover database until cancel;
ORA-10879: error signaled in parallel recovery slave
ORA-01547: 警告: RECOVER 成功但 OPEN RESETLOGS 将出现如下错误
ORA-01152: 文件 1 没有从过旧的备份中还原
ORA-01110: 数据文件 1: 'D:\APP\ADMINISTRATOR\ORADATA\orcl\SYSTEM01.DBF'

SQL> alter database open resetlogs;
alter database open resetlogs
*
ERROR at line 1:
ORA-01152: file 1 was not restored from a sufficiently old backup
ORA-01110: data file 1: 'D:\APP\ADMINISTRATOR\ORADATA\orcl\SYSTEM01.DBF'


SQL> RECOVER DATABASE USING BACKUP CONTROLFILE;
ORA-00279: change 17384974762395 generated at 03/18/2025 18:30:34 needed for
thread 1
ORA-00289: suggestion :
D:\APP\ADMINISTRATOR\FLASH_RECOVERY_AREA\orcl\ARCHIVELOG\2025_03_19\O1_MF_1_27
890_%U_.ARC
ORA-00280: change 17384974762395 for thread 1 is in sequence #27890


Specify log: {<RET>=suggested | filename | AUTO | CANCEL}
D\APP\ADMINISTRATOR\ORADATA\orcl\RED001.LOG
ORA-00308: 无法打开归档日志 'D\APP\ADMINISTRATOR\ORADATA\orcl\RED001.LOG'
ORA-27041: 无法打开文件
OSD-04002: 无法打开文件
O/S-Error: (OS 3) 系统找不到指定的路径。


Specify log: {<RET>=suggested | filename | AUTO | CANCEL}
D:\app\Administrator\oradata\orcl\RED001.LOG
ORA-00308: 无法打开归档日志 'D:\app\Administrator\oradata\orcl\RED001.LOG'
ORA-27041: 无法打开文件
OSD-04002: 无法打开文件
O/S-Error: (OS 2) 系统找不到指定的文件。

最初数据库启动报ORA-600 kcratr_nab_less_than_odr错误(这个是一个非常典型的错误,早期写过处理方法:ORA-600 kcratr_nab_less_than_odr故障解决)，客户处理故障思路不太清晰,使用了recover database until cancel和alter database open resetlogs等不当操作,导致数据库没有open成功.然后希望使用我的Oracle Recovery Tools小工具进行修复,但是根据我的判断,这个故障还用不上该工具,直接可以open库.对其进行ctl重建并open库

SQL> alter database backup controlfile to trace as 'd:/ctl.txt';

Database altered.

SQL> create pfile='d:/pfile.txt' from spfile;

File created.

SQL> shutdown immediate;
ORA-01109: database not open


Database dismounted.
ORACLE instance shut down.
SQL> startup nomount;
ORACLE instance started.

Total System Global Area 1603411968 bytes
Fixed Size                  2176168 bytes
Variable Size             973081432 bytes
Database Buffers          620756992 bytes
Redo Buffers                7397376 bytes
SQL> @d:/xifenfei/rectl.sql

Control file created.

SQL>
SQL>
SQL> recover database;
Media recovery complete.

SQL> alter database open;

Database altered.

在open之后,数据库报ORA-600 4194错误

Wed Mar 19 01:51:12 2025
alter database open
Beginning crash recovery of 1 threads
 parallel recovery started with 23 processes
Started redo scan
Completed redo scan
 read 793 KB redo, 0 data blocks need recovery
Started redo application at
 Thread 1: logseq 27890, block 2, scn 17384974741793
Recovery of Online Redo Log: Thread 1 Group 4 Seq 27890 Reading mem 0
  Mem# 0: D:\APP\ADMINISTRATOR\ORADATA\orcl\REDO04.LOG
Completed redo application of 0.00MB
Completed crash recovery at
 Thread 1: logseq 27890, block 1589, scn 17384974762395
 0 data blocks read, 0 data blocks written, 793 redo k-bytes read
Wed Mar 19 01:51:14 2025
Thread 1 advanced to log sequence 27891 (thread open)
Thread 1 opened at log sequence 27891
  Current log# 2 seq# 27891 mem# 0: D:\APP\ADMINISTRATOR\ORADATA\orcl\REDO02.LOG
Successful open of redo thread 1
MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
Wed Mar 19 01:51:14 2025
SMON: enabling cache recovery
Successfully onlined Undo Tablespace 2.
Dictionary check beginning
Tablespace 'TEMP' #3 found in data dictionary,
but not in the controlfile. Adding to controlfile.
Tablespace 'TEMP1' #11 found in data dictionary,
but not in the controlfile. Adding to controlfile.
Dictionary check complete
Verifying file header compatibility for 11g tablespace encryption..
Verifying 11g file header compatibility for tablespace encryption completed
SMON: enabling tx recovery
*********************************************************************
WARNING: The following temporary tablespaces contain no files.
         This condition can occur when a backup controlfile has
         been restored.  It may be necessary to add files to these
         tablespaces.  That can be done using the SQL statement:
 
         ALTER TABLESPACE <tablespace_name> ADD TEMPFILE
 
         Alternatively, if these temporary tablespaces are no longer
         needed, then they can be dropped.
           Empty temporary tablespace: TEMP
           Empty temporary tablespace: TEMP1
*********************************************************************
Database Characterset is ZHS16GBK
No Resource Manager plan active
Errors in file d:\app\administrator\diag\rdbms\orcl\orcl\trace\orcl_smon_4084.trc  (incident=158542):
ORA-00600: 内部错误代码, 参数: [4194], [], [], [], [], [], [], [], [], [], [], []
Incident details in: d:\app\administrator\diag\rdbms\orcl\orcl\incident\incdir_158542\orcl_smon_4084_i158542.trc
Wed Mar 19 01:51:26 2025
Trace dumping is performing id=[cdmp_20250319015126]
Wed Mar 19 01:51:31 2025
Sweep [inc][158542]: completed
Sweep [inc2][158542]: completed
Wed Mar 19 01:51:35 2025
Doing block recovery for file 3 block 1415
Resuming block recovery (PMON) for file 3 block 1415
Block recovery from logseq 27891, block 86 to scn 17384974782720
Recovery of Online Redo Log: Thread 1 Group 2 Seq 27891 Reading mem 0
  Mem# 0: D:\APP\ADMINISTRATOR\ORADATA\orcl\REDO02.LOG
Block recovery stopped at EOT rba 27891.87.16
Block recovery completed at rba 27891.87.16, scn 4047.3242135803
Doing block recovery for file 3 block 264
Resuming block recovery (PMON) for file 3 block 264
Block recovery from logseq 27891, block 86 to scn 17384974782714
Recovery of Online Redo Log: Thread 1 Group 2 Seq 27891 Reading mem 0
  Mem# 0: D:\APP\ADMINISTRATOR\ORADATA\orcl\REDO02.LOG
Block recovery completed at rba 27891.87.16, scn 4047.3242135803
Errors in file d:\app\administrator\diag\rdbms\orcl\orcl\trace\orcl_smon_4084.trc:
ORA-01595: 释放区 (2) 回退段 (12) 时出错
ORA-00600: 内部错误代码, 参数: [4194], [], [], [], [], [], [], [], [], [], [], []
Wed Mar 19 01:51:36 2025
Errors in file d:\app\administrator\diag\rdbms\orcl\orcl\trace\orcl_ora_5680.trc  (incident=158590):
ORA-00600: internal error code, arguments: [4194], [], [], [], [], [], [], [], [], [], [], []
Incident details in: d:\app\administrator\diag\rdbms\orcl\orcl\incident\incdir_158590\orcl_ora_5680_i158590.trc

数据库open成功,但是后台报ORA-01595/ORA-600 4194错误,这个问题比较常见,直接处理异常undo即可恢复.

发表在 Oracle备份恢复 | 标签为 kcratr_nab_less_than_odr, ORA-01152, ORA-01595, ORA-600 4194, ORA-600 kcratr_nab_less_than_odr | 评论关闭

win平台19c 打patch遭遇2个小问题汇总

发表于 2025 年 3 月 17 日由惜分飞

在给19c的库打ru patch的过程中遇到两个错误,进行记录,以供以后遇到类似错误参考:
UtilSession 失败: oracle/cluster/install/InstallException

C:\Users\Administrator>F:\updatecode\WINDOWS.X64_193000_db_home\opatch\opatch apply F:\oracle_patch\37486199
Oracle 临时补丁程序安装程序版本 12.2.0.1.45
版权所有 (c) 2025, Oracle Corporation。保留所有权利。


Oracle 主目录       ：F:\updatecode\WINDOWS.X64_193000_db_home
主产品清单：C:\Program Files\Oracle\Inventory
   来自           ：
OPatch 版本    ：12.2.0.1.45
OUI 版本       ：12.2.0.7.0
日志文件位置：F:\updatecode\WINDOWS.X64_193000_db_home\cfgtoollogs\opatch\opatch2025-03-17_18-19-56下午_1.log

Verifying environment and performing prerequisite checks...
UtilSession 失败: oracle/cluster/install/InstallException
Log file location: F:\updatecode\WINDOWS.X64_193000_db_home\cfgtoollogs\opatch\opatch2025-03-17_18-19-56下午_1.log

OPatch failed with error code = 73

对应的日志错误部分

[2025-3-17 18:19:57] [INFO]   CAS Dynamic Loading :
[2025-3-17 18:19:57] [INFO]   CUP_LOG: Trying to load HomeOperations object
[2025-3-17 18:19:57] [INFO]   CUP_LOG: HomeOperations object created. CUP1.0 is enabled
[2025-3-17 18:19:57] [INFO]   OPatch invoked as follows: 'apply F:\oracle_patch\37486199 '
[2025-3-17 18:19:57] [INFO]   Runtime args: [-DOPatch.ORACLE_HOME=F:\updatecode\WINDOWS.X64_193000_db_home, -DOPatch.DEBUG=false,
                              -DOPatch.RUNNING_DIR=F:\updatecode\WINDOWS.X64_193000_db_home\OPatch, -DOPatch.MW_HOME=, 
                              -DOPatch.WL_HOME=, -DOPatch.COMMON_COMPONENTS_HOME=, -DOPatch.OUI_LOCATION=, -DOPatch.FMW_COMPONENT_HOME=,
                               -DOPatch.WEBLOGIC_CLASSPATH=, -DOPatch.OPATCH_CLASSPATH=]
[2025-3-17 18:19:57] [INFO]   Heap in use : 120 MB
                              Total memory: 1917 MB
                              Free memory : 1796 MB
                              Max memory  : 27305 MB
[2025-3-17 18:19:57] [INFO]   Oracle 主目录       : F:\updatecode\WINDOWS.X64_193000_db_home
                              主产品清单: C:\Program Files\Oracle\Inventory
                                 从           : 
                              OPatch 版本    : 12.2.0.1.45
                              OUI 版本       : 12.2.0.7.0
                              OUI 位置      : F:\updatecode\WINDOWS.X64_193000_db_home\oui
                              日志文件位置 : F:\updatecode\WINDOWS.X64_193000_db_home\cfgtoollogs\opatch\opatch2025-03-17_18-19-56下午_1.log
[2025-3-17 18:19:57] [INFO]   Patch history file: F:\updatecode\WINDOWS.X64_193000_db_home\cfgtoollogs\opatch\opatch_history.txt
[2025-3-17 18:19:59] [INFO]   [OPSR-TIME] Loading raw inventory
[2025-3-17 18:20:00] [INFO]   [OPSR-MEMORY] Loaded all components from inventory. Heap memory in use: 150 (MB)
[2025-3-17 18:20:00] [INFO]   [OPSR-MEMORY] Loaded all one offs from inventory. Heap memory in use: 160 (MB)
[2025-3-17 18:20:00] [INFO]   [OPSR-TIME] Raw inventory loaded successfully
[2025-3-17 18:20:00] [INFO]   NApply::no CAS enabled, OPatch runs with legacy process.
[2025-3-17 18:20:00] [INFO]   Verifying environment and performing prerequisite checks...
[2025-3-17 18:20:00] [INFO]   [OPSR-TIME] Running prerequisite checks
[2025-3-17 18:20:00] [INFO]   opatch-external.jar is in F:\updatecode\WINDOWS.X64_193000_db_home\OPatch\jlib\opatch-external.jar
[2025-3-17 18:20:00] [SEVERE] OUI-67073:UtilSession 失败: oracle/cluster/install/InstallException
[2025-3-17 18:20:00] [INFO]   Finishing UtilSession at Mon Mar 17 18:20:00 CST 2025
[2025-3-17 18:20:00] [INFO]   堆栈说明: java.lang.RuntimeException: oracle/cluster/install/InstallException
                              	at java.lang.Class.getDeclaredConstructors0(Native Method)
                              	at java.lang.Class.privateGetDeclaredConstructors(Class.java:2671)
                              	at java.lang.Class.getConstructor0(Class.java:3075)
                              	at java.lang.Class.getConstructor(Class.java:1825)
                              	at oracle.opatch.OPatchExternalFactory.getRac(OPatchExternalFactory.java:158)
                              	at oracle.opatch.napplyhelper.EnvValidation.validateConnectStringNodes(EnvValidation.java:104)
                              	at oracle.opatch.napplyhelper.EnvValidation.checkConnectString(EnvValidation.java:92)
                              	at oracle.opatch.napplyhelper.EnvValidation.validate(EnvValidation.java:64)
                              	at oracle.opatch.opatchutil.NApply.legacy_process(NApply.java:530)
                              	at oracle.opatch.opatchutil.NApply.legacy_process(NApply.java:374)
                              	at oracle.opatch.opatchutil.NApply.process(NApply.java:354)
                              	at oracle.opatch.opatchutil.OUSession.napply(OUSession.java:1143)
                              	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
                              	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
                              	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
                              	at java.lang.reflect.Method.invoke(Method.java:498)
                              	at oracle.opatch.UtilSession.process(UtilSession.java:355)
                              	at oracle.opatch.OPatchSession.process(OPatchSession.java:2640)
                              	at oracle.opatch.OPatch.process(OPatch.java:888)
                              	at oracle.opatch.OPatch.main(OPatch.java:945)
                              Caused by: java.lang.NoClassDefFoundError: oracle/cluster/install/InstallException
                              	... 20 more
                              Caused by: java.lang.ClassNotFoundException: oracle.cluster.install.InstallException
                              	at java.net.URLClassLoader.findClass(URLClassLoader.java:387)
                              	at java.lang.ClassLoader.loadClass(ClassLoader.java:418)
                              	at java.lang.ClassLoader.loadClass(ClassLoader.java:351)
                              	... 20 more

通过mos给出来的文档:Windows:opatch file with error: [SEVERE] OUI-67073:UtilSession failed: oracle/cluster/install/InstallException (Doc ID 3020534.1),可能是由于%ORACLE_HOME%\oui\jlib\srvm.jar 文件异常导致该问题,查看打patch机器,发现该文件丢失[丢失原因未知],从37486199的patch文件中拷贝该文件到数据库对应目录,后续没有再报该错误

然后提示Prerequisite check “CheckActiveFilesAndExecutables” failed.错误
注意参考:win平台 UtilSession 失败: Prerequisite check “CheckActiveFilesAndExecutables” failed. 处理没有解决问题(因为文件本身没有被占用)

F:\oracle_patch\37486199>F:\updatecode\WINDOWS.X64_193000_db_home\opatch\opatch apply
Oracle 临时补丁程序安装程序版本 12.2.0.1.45
版权所有 (c) 2025, Oracle Corporation。保留所有权利。


Oracle 主目录       ：F:\updatecode\WINDOWS.X64_193000_db_home
主产品清单：C:\Program Files\Oracle\Inventory
   来自           ：
OPatch 版本    ：12.2.0.1.45
OUI 版本       ：12.2.0.7.0
日志文件位置：F:\updatecode\WINDOWS.X64_193000_db_home\cfgtoollogs\opatch\opatch2025-03-17_18-34-40下午_1.log

Verifying environment and performing prerequisite checks...
Prerequisite check "CheckActiveFilesAndExecutables" failed.
The details are:

Following active files/executables/libs are used by ORACLE_HOME :F:\updatecode\WINDOWS.X64_193000_db_home
F:\updatecode\WINDOWS.X64_193000_db_home\bin\oravssmsgus.dll
F:\updatecode\WINDOWS.X64_193000_db_home\bin\ORAEVRUS19.dll


UtilSession 失败: Prerequisite check "CheckActiveFilesAndExecutables" failed.
Log file location: F:\updatecode\WINDOWS.X64_193000_db_home\cfgtoollogs\opatch\opatch2025-03-17_18-34-40下午_1.log

OPatch failed with error code = 73

通过命令分析确认oravssmsgus.ddl和ORAEVRUS19.dll动态库没有被其他程序占用

F:\oracle_patch\37486199>tasklist /M ora*
信息: 没有运行的任务匹配指定标准。

F:\oracle_patch\37486199>tasklist /M ORA*
信息: 没有运行的任务匹配指定标准。

对于这种情况,根据mos文档:Database Release Update Bundle Windows Patch (XXX) Error”UtilSession failed: Prerequisite check “CheckActiveFilesAndExecutables” failed.” (Doc ID 3046640.1)建议,把对一个文件重命名

F:\updatecode\WINDOWS.X64_193000_db_home\bin>dir *bak.dll
 驱动器 F 中的卷是 安全区
 卷的序列号是 4407-E854

 F:\updatecode\WINDOWS.X64_193000_db_home\bin 的目录

2022-07-28  17:35             4,096 ORAEVRUS19-bak.dll
2022-07-28  17:35           100,352 oravssmsgus-bak.dll
               2 个文件        104,448 字节
               0 个目录 680,382,025,728 可用字节

后续打patch操作一切正常,没有再出现其他问题.

发表在 Oracle安装升级 | 标签为 CheckActiveFilesAndExecutables, ORAEVRUS19.dll, oravssmsgus.dll, OUI-67073 | 评论关闭

17813235971

QQ 咨询

分类目录归档：Oracle

vmdk文件被加密恢复(虚拟机文件加密)

差点被误操作的ORA-600 kcratr_nab_less_than_odr故障

win平台19c 打patch遭遇2个小问题汇总

文章分类

最近发表

分类目录归档：Oracle

vmdk文件被加密恢复(虚拟机文件加密)

差点被误操作的ORA-600 kcratr_nab_less_than_odr故障

win平台19c 打patch遭遇2个小问题汇总

标签云

文章分类

最近发表