4 ms·
Do a search for any files in /Users and connected volumes which are suffixed with .encrypted. Apparently that's the interim filename suffix used by the malware.
by leonroy 11y ago
Do a search for any files in /Users and connected volumes which are suffixed with .encrypted. Apparently that's the interim filename suffix used by the malware.
- jws 11y agoThanks, I appear to be clear of .encrypted files. The good of this mess is that I realized I only had one Time Machine backup going on that machine. I had turned off the remote backup a month ago while shoving backups around on the remote server to make more room and hadn't restored it. One backup is too few. The weakness exposed is that if the remote were mounted, this malware would have nailed it too. I'll have to look at having the remote make filesystem snapshots on its end so malware can't corrupt my older backups.