Have you tried restoring from shadow copy? Unless a decryption tool exists for that particular strain of ransomware, then you are SOL. On 01/04/2016 11:22, skunkworks-request@lists.my.co.ke wrote:
On Fri, Apr 1, 2016 at 11:01 AM, Kennedy Kairaria via skunkworks < skunkworks@lists.my.co.ke> wrote:
By the time we noticed they were also affected. Incremental backups.
Regards,
*Kennedy Kairaria*
Mobile: (254) 724 615232 kenkairaria@gmail.com | [image: LinkedIn] <http://www.linkedin.com/in/kairaria> http://kennedy-kairaria.g <http://kennedy-kairaria.branded.me/>q Contact me: [image: Skype] kennedy.kairaria
On 1 April 2016 at 10:58, Brian Ngure <brian@pixie.co.ke> wrote:
Backups? On 1 Apr 2016 10:52 am, "Kennedy Kairaria via skunkworks" < skunkworks@lists.my.co.ke> wrote:
Skunk(ette)s,
We just got hit with the paycript ransom-ware on some of our file servers we've managed t identify the domain accounts running the script and disabled them. Seems to have stopped spreading across the network to our other file servers(for now...48 hours and counting)
Suspected source has also been identified and measures taken. What remains now is finding a way to decrypt the files. The damn fools are asking for 2BTC for them to decrypt and double the amount to charge by the day if not paid.
Anyone else who has had to go through the same? What measures did you take to recover?