Ransomware resistance


RobJ

Recommended Posts

  • 1 year later...
On 11/19/2017 at 6:57 PM, Bjonness406 said:

So if I want to make all the files uneditable, can I run this command?


find /mnt/disk1/Media/ -type f -exec chattr +i "{}" \;
find /mnt/disk2/Media/ -type f -exec chattr +i "{}" \;

 

A question to that command if I want to just "immutable" certain files. I was trying e.g.:

find /mnt/disk2/Kino/*.m4v -type f -exec chattr +i "{}" \;

That is working well except with sub-directories. I was trying to use the -R (recursively changes attributes of directories and their contents) flag but this is not working. HAs anyone tried this? Thanks a lot.

Link to comment
1 hour ago, EdgarWallace said:

A question to that command if I want to just "immutable" certain files. I was trying e.g.:


find /mnt/disk2/Kino/*.m4v -type f -exec chattr +i "{}" \;

That is working well except with sub-directories. I was trying to use the -R (recursively changes attributes of directories and their contents) flag but this is not working. HAs anyone tried this? Thanks a lot.

 

Try:

 

find /mnt/disk2/Kino -type f -name \*.m4v -print

 

 

if that produces what you what then:

 

find /mnt/disk2/Kino -type f -name \*.m4v -exec chattr +i "{}" \;

  • Thanks 1
Link to comment
  • 4 weeks later...

Hi, just read the whole posts and still have one doubt, hope someone can explain it.

 

The situation is: I have in unraid´s CACHE one ssd running several vm´s. One of these vm´s is running windows and gets infected. My doubt is: will the other vdisks get infected (encrypted) too since they reside in the same disk (cache)?

 

Also, just to double check, regarding all accessible shares within the infected windows vm, if they are accessible they will be encrypted. I understand that. But what about other shares that are not accessible to this vm. If the windows vm can access i.e. a share called movies, and movies also resides on a disk that contains other shares (not accessible by the windows vm)...will all this shares be encrypted too?

 

  • Like 1
Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.