Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Cipriano
Contributor

How to remove ransomware pos infection

Dear colleagues,

We have a company in angola that got Ransomware and as expected had no backup. They contacted me asking for help to solve the problem.

Do we have any way to solve a post-infection with the end point?

We could sell, install the endpoint to remove the threat, but would it install with the infected machine?

As far as I know, after infecting if encrypted the files were already ... the only solution would be to remove the ransonware and protect it from happening any more.

What is the recommendation to clean the machines before installing the endpoint?

0 Kudos
3 Replies
Gal_Carmeli
Employee
Employee

Hi,

Unfortunately, if the machine was already infected and the files were encrypted before Sandblast Agent was installed, there is nothing we can do in order to restore the encrypted files.

The best way would be to reimage the machine, and install the endpoint protection afterwards.

Thanks,

Gal.

0 Kudos
Marcel_Afrahim
Employee Alumnus
Employee Alumnus

What kind of ransomware was it? There are few decryptors out there based on leaked or reverse engineered by the researchers which can help.

0 Kudos
Markusevc
Employee
Employee

Maybe worth to have a look here: https://www.nomoreransom.org/en/index.html

Also this post is useful https://community.checkpoint.com/docs/DOC-2363 

Security Solutions Expert for Global Strategic Partners GSI/MSP/Telco & Consultancy Firms
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Wed 01 May 2024 @ 02:00 PM (EDT)

    South US: HTTPS Inspection Best Practices

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Wed 01 May 2024 @ 02:00 PM (EDT)

    South US: HTTPS Inspection Best Practices

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82
    CheckMates Events