help with Locky virus

chroniclard · 8 Jun 2016 at 22:44

Client got infected, 12 pc's and the server, worked out cheaper to pay the bitcoin ransom than sort it out.

Orcvader · 8 Jun 2016 at 22:54

BuToNz said:
Not true, if there are any mapped drives it'll go through those as well and encrypt anything it has permission to do so.

Wasn't the case for me when it happened with two of my clients, both had a mapped drive to their servers but Locky left it untouched. Although this was about a couple of months ago... so I guess a newer variant could be more aggressive.

ethan · 9 Jun 2016 at 12:26

Orcvader said:
Wasn't the case for me when it happened with two of my clients, both had a mapped drive to their servers but Locky left it untouched. Although this was about a couple of months ago... so I guess a newer variant could be more aggressive.

I think it is the same here. This particular variant left the network alone, including the other PC'S and only locked the .pdf's on one. It limited itself to the machine on which the virus was opened.

#Chri5# · 9 Jun 2016 at 13:04

Depends on the variant/version of Locky.

The most aggressive will look for any shares on the network the user has permission to and encrypt files on them - the shares do not need to be mapped to drive letters on the infected PC.

Also depends on how quick the PC is and when it's spotted so the infected PC is pulled off the network.