联系：手机/微信(+86 17813235971) QQ(107644445)

标题：.pzpq扩展名勒索恢复

作者：惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]

有一个10g的库,数据库被勒索病毒加密扩展名为:.email=[biobiorans@gmail.com]id=[f5657ac3dc58dc8c].biobio.[backups@airmail.cc].pzpq

Email 1: 
backups@airmail.cc

Email 2: 
hero77@cock.li

Send messages to both emails at the same time 

So send messages to our emails, check your spam folder every few hours 

ID: E3DxxxxxxxxxxxxxxxDBB73

If you do not receive a response from us after 24 hours, create a valid email, for example, gmail,outlook 
Then send us a message with a new email

通过底层对数据库block进行分析,确认损坏的block情况为,头部损坏16个block,中间16个block,尾部16个block

un Jan 12 22:35:09 2025
ALTER DATABASE OPEN
Sun Jan 12 22:35:10 2025
Thread 1 opened at log sequence 4
  Current log# 3 seq# 4 mem# 0: D:\ORCL\REDO03.LOG
Successful open of redo thread 1
Sun Jan 12 22:35:10 2025
MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
Sun Jan 12 22:35:10 2025
SMON: enabling cache recovery
Sun Jan 12 22:35:10 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\udump\norcl_ora_2796.trc:
ORA-00600: internal error code, arguments: [4193], [58], [52], [], [], [], [], []

Sun Jan 12 22:35:11 2025
Doing block recovery for file 1 block 404
Block recovery from logseq 4, block 73424 to scn 137439548723
Sun Jan 12 22:35:11 2025
Recovery of Online Redo Log: Thread 1 Group 3 Seq 4 Reading mem 0
  Mem# 0: D:\ORCL\REDO03.LOG
Block recovery stopped at EOT rba 4.73426.16
Block recovery completed at rba 4.73426.16, scn 32.595250
Doing block recovery for file 1 block 9
Block recovery from logseq 4, block 73424 to scn 137439548721
Sun Jan 12 22:35:11 2025
Recovery of Online Redo Log: Thread 1 Group 3 Seq 4 Reading mem 0
  Mem# 0: D:\ORCL\REDO03.LOG
Block recovery completed at rba 4.73426.16, scn 32.595250
Sun Jan 12 22:35:11 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\udump\norcl_ora_2796.trc:
ORA-00604: error occurred at recursive SQL level 1
ORA-00607: Internal error occurred while making a change to a data block
ORA-00600: internal error code, arguments: [4193], [58], [52], [], [], [], [], []

Error 604 happened during db open, shutting down database
USER: terminating instance due to error 604
Sun Jan 12 22:35:11 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_pmon_2168.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_reco_2688.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_smon_2332.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_ckpt_2600.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_lgwr_2672.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_dbw0_1344.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_mman_2828.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_psp0_2324.trc:
ORA-00604: error occurred at recursive SQL level 

Instance terminated by USER, pid = 2796
ORA-1092 signalled during: ALTER DATABASE OPEN...

通过分析trace,确认是系统回滚段的free block pool异常,使用bbed进行修复

BBED> clean free_block_pool
Clean free block pool completed.you can use dump to verify the data, then can us
e sum apply command to save data.
BBED> sum apply

Warning: apply the modified data will overwrite original data.
Would you like to continue? (y/n)
y

Old checksum value: 0xf2c0
New checksum value: 0xf315
Writing block has completed

BBED>

open数据库成功,然后安排导出数据即可

电话/微信:17813235971    Q Q:107644445    E-Mail:dba@xifenfei.com