Tanos - Ransomware Removal
Discussion
Be aware most of the sites appearing in a google search for removal will just state the obvious about restoring from backup and reinstalling the OS. In amongst that will be a string of moneymaking adverts (the main reason for sending you to the link.
These sites actually just dynamically insert the name of the virus you search for and are useless. Look at the domains, none of them will be official reputable sources.
They even suggest just paying.
If it is serious your only real option may be to hand the disc to a professional and expensive recovery/decryption service.
These sites actually just dynamically insert the name of the virus you search for and are useless. Look at the domains, none of them will be official reputable sources.
They even suggest just paying.
If it is serious your only real option may be to hand the disc to a professional and expensive recovery/decryption service.
shopper150 said:
Thanks
I don’t understand how it’s got onto a machine that is effectively just a file server
It’s not used to browse the internet or receive emails.
Perhaps because windows updates haven’t been run on it and it’s running Win 7.
Not being funny mate but that is probably exactly why you have got caught. These things go for the lowest hanging fruit, and a Windows 7 machine without updates is just that.I don’t understand how it’s got onto a machine that is effectively just a file server
It’s not used to browse the internet or receive emails.
Perhaps because windows updates haven’t been run on it and it’s running Win 7.
Be wary though as the virus will have been on your network and just found a machine not protected. You dont need to be browsing the web on it to be connected as these things spread through your network.
If you ever hear anyone saying that Win7 is perfectly fine and they dont do updates because they dont believe in them, tell them of your experience. No one believes IT professionals when they tell people this on the internet, they might believe you.
The_Jackal said:
I'm not sure if it is something that they can find.
If it is a genuine ransomware and you have been hit, its not a good situation.
Someone with first hand notice may be along to tell you otherwise.
I'm not sure how the NHS dealt with their attack, maybe someone here can tell us.
There was plenty of stuff found of the affected machine by Malwarebytes.If it is a genuine ransomware and you have been hit, its not a good situation.
Someone with first hand notice may be along to tell you otherwise.
I'm not sure how the NHS dealt with their attack, maybe someone here can tell us.
Just nothing on the other machines on the network .
shopper150 said:
Thanks
Perhaps because windows updates haven’t been run on it and it’s running Win 7.
This will be it. First thing you need to do is reset any accounts with admin access to any machine (this includes local admin accounts if they are all using the same username/pw combo) as its likely credentials will have been compromised which will potentially allow the ransomware to traverse to other machines on the same network. As someone else has mentioned the Win 7 server is the low hanging fruit. To get onto a file server the virus must have been sat on a web facing desktop beforehand so its fairly safe to assume that its still there. I'm surprised that this desktop hasn't also been cryptolocked as well. Any open file shares will also be vulnerablePerhaps because windows updates haven’t been run on it and it’s running Win 7.
I would be looking at removing any mission critical servers from the network immediately until you have found out the source of the infection and then ensure everything is brought upto date with windows updates.
Good luck!
Tanos (part of the Globelimposter family) requires a private key to decrypt, which only the perpetrator has. So no, I am not aware of any way you will be able to de-crypt your files. You will need to go to your backup to recover encrypted files.
As other have mentioned, your fileserver was very much at risk! Assuming you are being serious - the old OS and no patching means that your server was a sitting target with many many holes for malware to penetrate. You cannot leave any server (device) on an old OS and unpatched and not expect it to be infected.
As soon as a user launches the ransomeware from their device (not the file server), the malware will look for files to encrypt. Many pieces of ransomware know that your most important information will be on a server / share, and will target those first. It is then quite possible that the ransomware would be transferred to your server to continue its work locally. Regardless of whether the shares were hit first or last, you still only have a limited amount of time to spot the infection as it runs and stop it from continuing.
As important as file recovery - you also need to consider the risk of, and how you prevent re-infection. For many it is easier to just wipe devices and start again. Though people have experience of Anti-Virus doing a good cleanup job, trust me, many do not! In a business environment, it is often faster and more effective to rebuild than to try to cleanup (I am happy to explain why)Regardless of the AV you use proceed with caution.
Trying to understand the source and all locations the ransomware may now be installed is a start. Without reading up on the specific strain, the likely points of entry will be a dodgy link contained within an inbound email, a dodgy link on a browsed website, or a breach of a specific protocol. Depending on you current set up, because of your server OS /Patching if your server was visible to the outside world, the latter would likely be very very easy.
shopper150 said:
There was plenty of stuff found of the affected machine by Malwarebytes.
Just nothing on the other machines on the network .
This is the point though, it probably won't show. But you know its there because one of your machines sent it to your file server.Just nothing on the other machines on the network .
If I was you I'd be backing up everything you dont want to lose fast.
And as said above, reinstall the other machines from scratch.
Like I said before this is not a good situation, it's not a bog standard virus that you just get rid of with antivirus.
Potentially any other machine that connects to your network (wifi included) could get locked. Be Careful.
I'm curious as to how it got there in the first place.
As far as I know, somebody has to execute the virus on the infected computer, it cannot propagate across a network.
The stuff that your scans have found could just be misleading.
The last time I saw an infection of this type, the perpetrator was somebody who opened a .zip attachment containing the payload from an email.
It quickly encrypted any files he had access to on the server (as well as his own desktop).
So, OP - have you had any visitors in your office recently? Anybody who might have connected a laptop to the network for example?
I don't know what file permissions you have set on your server, but it could well have been triggered by a visitor.
Download and run Hitman Pro - you can get a 30 day eval but you will need to submit an email address to register.
This product is superb. I'm not saying it'll solve your problem, however it'll likely give you a better indication.
It's far, far better than Malwarebytes etc.
As far as I know, somebody has to execute the virus on the infected computer, it cannot propagate across a network.
The stuff that your scans have found could just be misleading.
The last time I saw an infection of this type, the perpetrator was somebody who opened a .zip attachment containing the payload from an email.
It quickly encrypted any files he had access to on the server (as well as his own desktop).
So, OP - have you had any visitors in your office recently? Anybody who might have connected a laptop to the network for example?
I don't know what file permissions you have set on your server, but it could well have been triggered by a visitor.
Download and run Hitman Pro - you can get a 30 day eval but you will need to submit an email address to register.
This product is superb. I'm not saying it'll solve your problem, however it'll likely give you a better indication.
It's far, far better than Malwarebytes etc.
TonyRPH said:
I'm curious as to how it got there in the first place.
As far as I know, somebody has to execute the virus on the infected computer, it cannot propagate across a network.
This is wrong on so many levels. Lots of crypto from the past few years will actively attempt to traverse a network and will not activate its payload until it has successfully done so. Take a few minutes to read this: https://www.microsoft.com/security/blog/2017/06/27...As far as I know, somebody has to execute the virus on the infected computer, it cannot propagate across a network.
moonigan said:
This is wrong on so many levels. Lots of crypto from the past few years will actively attempt to traverse a network and will not activate its payload until it has successfully done so. Take a few minutes to read this: https://www.microsoft.com/security/blog/2017/06/27...
Which reinforces my point that somebody else must have triggered it in the first place?OP said all his client workstations were clean, so even if it did have worm capabilities - it had to originate on another machine not so?
I will admit that I didn't know about the worm capabilities though.
TonyRPH said:
I'm curious as to how it got there in the first place.
As far as I know, somebody has to execute the virus on the infected computer, it cannot propagate across a network.
The stuff that your scans have found could just be misleading.
The last time I saw an infection of this type, the perpetrator was somebody who opened a .zip attachment containing the payload from an email.
It quickly encrypted any files he had access to on the server (as well as his own desktop).
So, OP - have you had any visitors in your office recently? Anybody who might have connected a laptop to the network for example?
I don't know what file permissions you have set on your server, but it could well have been triggered by a visitor.
Download and run Hitman Pro - you can get a 30 day eval but you will need to submit an email address to register.
This product is superb. I'm not saying it'll solve your problem, however it'll likely give you a better indication.
It's far, far better than Malwarebytes etc.
So am IAs far as I know, somebody has to execute the virus on the infected computer, it cannot propagate across a network.
The stuff that your scans have found could just be misleading.
The last time I saw an infection of this type, the perpetrator was somebody who opened a .zip attachment containing the payload from an email.
It quickly encrypted any files he had access to on the server (as well as his own desktop).
So, OP - have you had any visitors in your office recently? Anybody who might have connected a laptop to the network for example?
I don't know what file permissions you have set on your server, but it could well have been triggered by a visitor.
Download and run Hitman Pro - you can get a 30 day eval but you will need to submit an email address to register.
This product is superb. I'm not saying it'll solve your problem, however it'll likely give you a better indication.
It's far, far better than Malwarebytes etc.
I will try Hitman
I’ve wiped the affected machine, everything was backed up
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff