asked on 4/14/2016

.locky files appeared in our server

we have a single sbs2011 server running exchange with around 25 users.

all seems to be well, but I have noticed some files which have appeared in various folders.

these are usually a long hex string with the .locky extension

I have avg and malwarebytes installed on our clients and had avg installed on our server too.

I have just installed malwarebytes on the server and carried out a full scan, which found nothing.

obviously I am concerned about the possibility of our server being encrypted and held to ransom, so what can I do.

do I just identify and remove the .locky files?

none of our protection software seems to identify a threat, but with dozens of the .locky files appearing I need to do something.

can anyone advise what I should do?

thanks

SBS Encryption

Last Comment

nigelbeatson

4/16/2016

nigelbeatson

4/14/2016

ASKER

I forgot to mention that the .locky files are all dated 9th March 2016, so I'm not sure why there is nothing Un towards happening with our server.

I'm really worried and confused.

William Fulks

4/14/2016

How many PC's have access to the folders on the server where the .locky files were found? Most likely you had an infected PC that caused that, and since then the malware may have been removed. If you have backups of your data, you may want to check and see what got encrypted and then restore it.

nigelbeatson

4/14/2016

ASKER

do I delete the .locky files?

how can I verify that it's still not active?

thanks

nigelbeatson

4/14/2016

ASKER

fortunately, I can see that we have 1176 .locky files on our server, and they are all in the downloads folder which is not important.

all of this data can be deleted.

what concerns me is, how can I confirm that it has been removed, and why our defences did not identify it?

it seems so easy, for this horrific extortion to take place, so is there anything else we can do to protect from this in the future.

any help much appreciate

thanks

William Fulks

4/14/2016

The best way to protect against this is user education. You can have all the latest software, but guess what? So do the people sending this stuff out. They write code to work around the current scanners until an update goes out.

Locky is spread mainly by email attachments that entice users into opening them. Teach your people not to open anything that looks suspicious and how to identify junk senders and it'll keep you much safer than relying on some app to do it for you.

nigelbeatson

4/14/2016

ASKER

ok William thanks and noted.

because the number of .locky files seems to be static, can we assume the agent that was running this is removed.

I'm worried that this seems to have happened totally undetected, other than my noticing the .locky files.

what is also strange is that it seems to have stopped, before it hit the payload. have we just been lucky?

if this is the case, something must have stopped it? any ideas?

thanks

SOLUTION

William Fulks

4/14/2016