help with Locky virus

[chroniclard]

Client got infected, 12 pc's and the server, worked out cheaper to pay the bitcoin ransom than sort it out.

 

[Orcvader]

Not true, if there are any mapped drives it'll go through those as well and encrypt anything it has permission to do so.

Wasn't the case for me when it happened with two of my clients, both had a mapped drive to their servers but Locky left it untouched. Although this was about a couple of months ago... so I guess a newer variant could be more aggressive.

 

[ethan]

Wasn't the case for me when it happened with two of my clients, both had a mapped drive to their servers but Locky left it untouched. Although this was about a couple of months ago... so I guess a newer variant could be more aggressive.

I think it is the same here. This particular variant left the network alone, including the other PC'S and only locked the .pdf's on one. It limited itself to the machine on which the virus was opened.

 

[#Chri5#]

Depends on the variant/version of Locky.

The most aggressive will look for any shares on the network the user has permission to and encrypt files on them - the shares do not need to be mapped to drive letters on the infected PC.

Also depends on how quick the PC is and when it's spotted so the infected PC is pulled off the network.