Loading...
 
[Zobrazit/Skrýt nabídky vlevo]
[Zobrazit/Skrýt nabídky vpravo]

restore_samba_virus_encrypted

To restore files encrypted by Locky virus, one must first delete all files with .locky extension

find /chroots/samba/data -type f -iname "*.locky" -delete
find /chroots/samba/data -type f -iname "_Locky_recover_instructions.txt" -delete


Then it is necessary to restore all of the missing files. The easiest way is to change rsync flags in the BackupPC host config and restore the entire samba data tree.

  1. Go to the BackupPC web page
  2. Navigate to the correct host
  3. Add --ignore-existing to Edit config -> XFER -> RsyncRestoreArgs
  4. Press Save
  5. Restore the entire tree /chroots/samba/data from the appropriate backup
  6. Remove --ignore-existing from the configuration
  7. Press Save


This approach has an additional benefit in that rsync won't hang forever on currently opened files (typical for samba).


Created by dfabian. Last Modification: Pátek 11 of březen, 2016 09:02:56 CET by dfabian.