search

nexxai / CryptoBlocker

A script to deploy File Server Resource Manager and associated scripts to block infected users
GNU General Public License v2.0
200 stars 73 forks source link

Oct 6th update #60

Closed drewgunn closed 5 years ago

drewgunn commented 5 years ago

I have a current script that updates countless servers from the raw list as follows.

set-FsrmFileGroup -name "Anti-Ransomware File Groups" -IncludePattern @((Invoke-WebRequest -Uri "https://fsrm.experiant.ca/api/v1/combined" -UseBasicParsing).content | convertfrom-json | % {$_.filters})

Today, we experienced issues with every server (Windows Server 2008, 2012, and 2016) not allowing any new or saved documents within the folders being monitored by FSRM. Would anyone have insight into what new extensions were added in the Oct 6th update or what extension is the list might have caused this issue? I have not been able to trace the specific entry as of yet and continue to comb through them. Any advice is greatly appreciated as this has been operating as intended for years until this weekend.

nexxai commented 5 years ago

The issue was the *.??? Extension. It’s been removed from the list so please use the new Powershell script to refresh your lists or remove it manually from FSRM.

drewgunn commented 5 years ago

Great, thank you for the quick update.