
Originally Posted by
Melena
Yesterday was my initiation into the joys of salary life. 3:15 I get a call about someone not being able to open a document, saying it's corrupted and they had access to it earlier. Walk over there, 3 other documents with the same thing, then in about 5 minutes I get 4 more emails. Do a quick scan and see about 10000 files all modified between 12:20 and 3:25. Reboot the server, lock down the shares and bam, find out we got hit by Cryptowall. Finally got out around 8pm last night after running scans on everyone's computers and through some digging finding patient zero. Thankfully Friday we had a full backup performed, so only lost about 24hrs of work on that data server.