We help IT Professionals succeed at work.

VMware workstation 11.0 all virtual machine files locked

Newguy 123
Newguy 123 asked
Hello Experts. I am using VMware workstation 11.0 for home lab. all virtual machines got power off by themselves sometime during the night, when i try to power one on, i received the following error: "could not open virtual machine, .vmx file not found" for all virtual machines. all these virtual machines are not running on any esxi host. when I went the disk where i am storing the files (local disk on server), all files have the lock icon, with .NM4 extension (see attached pic). How can i fix this?, Has anybody encountered this issue before? Please assist.
Watch Question

ITSysTechSenior Systems Administrator

I'm seeing these files as encrypted I would think it could be a virus because you also have a file that says "recovers your files".
DO NOT CLICK ON ANYTHING IN THE FOLDER! You have ransomeware. Run a virus scanner.
Your server has become infected with ransomware. You first need to remove the malware and scan any other devices on your network.

Malwarebytes is a good program that has a free version if you currently are not using another product.

Your options now are to:
Pay the ransom and hope you get your files back.(not suggested)
Recover from backup. (Best option)
Start from scratch
ITSysTechSenior Systems Administrator
With this kind if issue you will want to make sure the ransomware has not spread to your backup. Make sure to scan everything before proceeding to any type of recovery.  In some cases it is better to reinstall your OS from scratch to be safe.
Ajay ChananaMCSE-2003/08|RHCSA| VCP5/6 |vExpert2018
Distinguished Expert 2017

If you have snapshot of vm please revert it.


thank you for the comments everyone. i will be rebuilding my home lab env since i had just finished installing all the VMs and did not have any data on it. How would you guys recommend i set it up now so that i can securely rdp it from the public internet, without losing security...so this does not happen again. i have only one physical server. the way i had it setup before...installed win 7 pro on server, then installed vmware workstation 11.0 where i built my virtual machines. on my home router, under port forwarding, i opened default port for rdp access, and pointed it to my win7 server internal ip, then rdp'd to it using the servers public ip address. Thank you
I would suggest asking a new questions to cover all the details.

Never open up a port without understanding the risk. I would only do that if I could restrict it by ACL. The best option is usually a vpn. I would look at pfsense as a firewall / vpn solution.