Jump to content

DMA Locker


Recommended Posts

Help! It seems I have a terminal server with DMA locker on it. or maybe i don't 

When any user logs into the terminal server over rdp, they get the crytpinfo file that says:

"Attention! ! !
All of your copies of your system have been permanently deleted and the data on all partitions and workstations have been encrypted!

Stay calm.

You can recover all your data by making a payment of 2 BTC ( 638 GBP) in Bitcoin currency in order to receive a decryption key. 

In order to purchase Bitcions you can use www.coinbase.com
After buying BTC send the equivalent of 2 BTC ( 638 GBP) to our BTC adress:

xxxxxxx (long line of text here)

After payment contact us to receive your decryption key. In mail title write your unique ID:         11:11:11:11:11:11:11:11 (not actual numbers)
Our e-mail: crypt303@gmx.com"

 

Notes:

1.Mbam will not run on the TS for some reason, so I am currently scanning with spyhunter.

2. I have removed all users from the rdp group so noone can connect the the infected server

3. I removed access to the main share on the network (there is only one) for all users except administrator

4. I have disconnected all active Shared drives

5. I have not yet seen the blaring red notice of infection/encryption, only the text file

6. at this moment i have done a few small checks. I cannot open the clients CRM/database from the TS, but i CAN from a workstation (which leads me to believe the encryption hasn't taken hold)

 

Please help!! 

 

Link to post
Share on other sites

  • 1 month later...
  • Staff


Greetings


I have not heard from you in a couple of days so I am coming by to check on you to see if you are having problems or you just need some more time.

Also to remind you that it is very important that we finish the process completely so as to not get reinfected. I will let you know when we are complete and I will ask to remove our tools

.


Gringo

Link to post
Share on other sites

  • Staff

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.