<story><title>Linux ransomware in the wild</title><url>https://forums.gentoo.org/viewtopic-t-1060828.html</url></story><parent_chain><item><author>ddevault</author><text>It doesn&amp;#x27;t seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to &lt;i&gt;shut it the fuck down&lt;/i&gt;. Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable.&lt;p&gt;Take the data you can recover offline and then reinstall from scratch. Don&amp;#x27;t try to fix it, just recover what you can and throw the rest away.</text></item></parent_chain><comment><author>zokier</author><text>&amp;gt; from which you can do some forensic work to find out how you were owned&lt;p&gt;It&amp;#x27;s worth noting that if you are really serious about doing forensics and investigating the attack, then shutting down can be pretty destructive.&lt;p&gt;&amp;gt; what data is recoverable.&lt;p&gt;Another point I&amp;#x27;d make is that try to recover as little as possible from the infected system and prefer using clean backups instead.&lt;p&gt;I agree on the overall sentiment though, attempting to recover a infected system is unnecessarily risky. Nuke it from the orbit, it is the only way to be sure.</text></comment>
<story><title>Linux ransomware in the wild</title><url>https://forums.gentoo.org/viewtopic-t-1060828.html</url></story><parent_chain><item><author>ddevault</author><text>It doesn&amp;#x27;t seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to &lt;i&gt;shut it the fuck down&lt;/i&gt;. Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable.&lt;p&gt;Take the data you can recover offline and then reinstall from scratch. Don&amp;#x27;t try to fix it, just recover what you can and throw the rest away.</text></item></parent_chain><comment><author>zython</author><text>well, when wannacry was around, you could &amp;quot;salvage&amp;quot; the decryption key from an infected machine before it was rebooted.&lt;p&gt;not saying your idea is bad advice but you need the full picture to counter ransomware attacks</text></comment>