nexxai / CryptoBlocker

A script to deploy File Server Resource Manager and associated scripts to block infected users
GNU General Public License v2.0
200 stars 73 forks source link

Multiple FileGroups created (500+) and blocked files #39

Closed tylerbro closed 6 years ago

tylerbro commented 6 years ago

Sometime last week, I was alerted that files were being blocked from writing to disk even though they were acceptable files (even 'New Text Document.txt' was failing).

Checking the FSRM gui, I noticed that the CryptoBlockerGroupX count had skyrocketed to over 500 (from 6). Looking into the newly created groups, I found that they were only populated with 2 items, BTC_DECRYPT_FILES.txt and zzzzzzzzzzzzzzzzzyyy.

866 2017-12-05 10_21_03

This may be related to the huge jump in groups but I also found an excluded item named .??? and .???? in the CryptoBlockerGroup1 which was preventing files to be written to disk. I was able to confirm that once the .??? and .???? was removed, the server returned to normal functions.

Has anyone seen something similar to this? At first, I thought it might have been a new language/character in the extensions list but I was not able to reproduce it. Running the update now works just as great as it has the past year.