2

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected.

The set up is like this:

  • 1x Windows 2003 server (SMB1)
  • 4x Windows 10 Client computers

Every time, the server and 3x Windows 10 machines are infected. 1 machine remains unaffected.

They are all part of the same domain.

Is it possible, that a virus infection resides on that one computer that never gets infected, and spreads the crypto onto the other machines without infecting it's host? Has anyone experiences likewise behavior?

  • 1
    The machine that is spreading the virus in this scenario would be infected, it would just not be encrypted. And yes, this is theorethically possible. Does it happend in practice? I have no idea. – Anders May 23 at 19:09
0

I don't see how it is possible for a virus to spread from a computer that is not infected. With that in mind, security updates for Windows server 2003 stopped in 2015. Since that date, a number of vulnerabilities have been identified:

https://www.cvedetails.com/product/7108/Microsoft-Windows-Server-2003.html?vendor_id=26

This could leave the machine wide open to automated attacks.

This vulnerability is oddly consistent with the configuration you are describing:

https://www.cvedetails.com/cve/CVE-2017-0176/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.