Disconnect the system from the network and turn off the machine would be the next step. Find the account with the most open files, that's probably your culprit. However, since you might not know WHO is encrypting files I would simply open Computer Management, connect to your file server, expand System Tools>Shared Folders>Open Files. Yeah, you could disable the user's account, how fast that replicates through your domain is set on the domain controllers, you can set this to propagate across all DCs in real time I believe. I believe this is the only way you can ensure your business doesn't get completely toasted by crypto. Ensure your backups are occurring every day, randomly restore servers from them on a schedule to ensure they're doing their job properly. They should not hesitate to do so.įunctional backups and disaster recovery. If you need clarification on this ask your vendor to give you a live demo with an actual ransomware virus. You need behavior based detection in your av solution. This is not something you want to solely rely on these days. Old school av was all signature based, and required those signatures to be updated. Make sure you have a behavior and signature based antivirus.

Our shares are broken out into read, modify, full access groups for each folder. Give users only what they need access to on the network.

Just to enforce some points that can help mitigate this issue up front.

Crypto locker in the news