# cryptolocker **URL:** \ **Category:** Chatting over the Back Fence\ **Created:** [October 24, 2013, 3:56pm UTC](https://forums.suse.com/t/cryptolocker/24665 "2013-10-24T15:56:02Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![System1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@System1](https://forums.suse.com/u/System1)\ **Post date:** [October 24, 2013, 3:56pm UTC](https://forums.suse.com/t/cryptolocker/24665/1 "2013-10-24T15:56:02Z")
I wasn’t sure where to post this, so I’m doing it here. I stumbled across this reading a tech blog this morning: ‘CryptoLocker Ransomware Information Guide and FAQ’ ([http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information](http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information)) Apparently it’s a super nasty, data destroying piece of malware. It mentions targeting mapped drives. Has anyone encountered it? I’m assuming an infected Windows computer will be able to encrypt files on the mapped drives, even if it’s mapped to an NSS drive. Ugh ## – imc imc’s Profile: [https://forums.novell.com/member.php?userid=346](https://forums.novell.com/member.php?userid=346) View this thread: [https://forums.novell.com/showthread.php?t=472010](https://forums.novell.com/showthread.php?t=472010) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [October 25, 2013, 6:27pm UTC](https://forums.suse.com/t/cryptolocker/24665/2 "2013-10-25T18:27:29Z")
On 24/10/2013 13:56, imc wrote:[color=blue] > I wasn’t sure where to post this, so I’m doing it here. I stumbled > across this reading a tech blog this morning: ‘CryptoLocker Ransomware > Information Guide and FAQ’ > ([http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information](http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information)) > > Apparently it’s a super nasty, data destroying piece of malware. It > mentions targeting mapped drives. Has anyone encountered it? I’m > assuming an infected Windows computer will be able to encrypt files on > the mapped drives, even if it’s mapped to an NSS drive. Ugh[/color] Pretty nasty, yes. It is a development of the FBI “ransomware” virus, but stores its decryption key on the criminal’s webserver - failure to pay up means your files _stay_ encrypted, as does removing the virus (and its reference to the correct key) Not sure it would be able to see a Novell Client mapped drive - most things running as system can’t (truecrypt, for example) so non-cifs drives are probably safe. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [January 11, 2014, 2:56pm UTC](https://forums.suse.com/t/cryptolocker/24665/3 "2014-01-11T14:56:04Z")
Just FYI we have seen a CryptoLocker variant in 2014 that will encrypt files on a NetWare NSS volume via a drive mapping from one infected Windows desktop. Just FYI Cryptolocker is known to infect external drives and thumbdrives as well, it will encrypt any data files that it can see on any drive. ## – JOWood JOWood’s Profile: [https://forums.novell.com/member.php?userid=81623](https://forums.novell.com/member.php?userid=81623) View this thread: [https://forums.novell.com/showthread.php?t=472010](https://forums.novell.com/showthread.php?t=472010) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [January 12, 2014, 10:27pm UTC](https://forums.suse.com/t/cryptolocker/24665/4 "2014-01-12T22:27:06Z")
On Sat, 11 Jan 2014 12:56:04 +0000, JOWood wrote: [color=blue] > Just FYI we have seen a CryptoLocker variant in 2014 that will encrypt > files on a NetWare NSS volume via a drive mapping from one infected > Windows desktop.[/color] It would, though - because as far as the OS is concerned, it’s just a file on the drive. Something like CryptoLocker isn’t going to be trying to do something crazy like write to the boot sector of a redirected device. Jim – Jim Henderson, CNA6, CDE, CNI, LPIC-1, CLA10, CLP10 Novell/SUSE/NetIQ Knowledge Partner ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [October 1, 2014, 5:06pm UTC](https://forums.suse.com/t/cryptolocker/24665/5 "2014-10-01T17:06:01Z")
I just had this happen at one of our schools. We have a global directory on the server that everyone has read/write access to and a teacher has managed to infect it resulting in none of the files being available. We dont run any kind of virus software on our novell boxes. ## – ddhottinger ddhottinger’s Profile: [https://forums.novell.com/member.php?userid=7800](https://forums.novell.com/member.php?userid=7800) View this thread: [https://forums.novell.com/showthread.php?t=472010](https://forums.novell.com/showthread.php?t=472010) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [October 1, 2014, 5:33pm UTC](https://forums.suse.com/t/cryptolocker/24665/6 "2014-10-01T17:33:46Z")
> [@](#): > > On Wed 01 Oct 2014 02:06:01 PM CDT, ddhottinger wrote: > > I just had this happen at one of our schools. We have a global > directory on the server that everyone has read/write access to and a > teacher has managed to infect it resulting in none of the files being > available. We dont run any kind of virus software on our novell boxes. Hi Have you seen this? [http://www.geekwire.com/2014/new-site-whitehat-hackers-offers-free-fix-cryptolocker-malware-woes/](http://www.geekwire.com/2014/new-site-whitehat-hackers-offers-free-fix-cryptolocker-malware-woes/) – Cheers Malcolm °¿° LFCS, SUSE Knowledge Partner (Linux Counter #276890) openSUSE 13.1 (Bottle) (x86\_64) GNOME 3.10.1 Kernel 3.11.10-21-desktop If you find this post helpful and are logged into the web interface, please show your appreciation and click on the star below… Thanks!