The Sophos Community will be offline for scheduled maintenance this Saturday, May 27th, at 13:00 UTC for approximately 1 hour. Apologies for any inconvenience caused.
"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
When you apply encryption rules that point to the path of public user files, e.g. C:\users\public\public documents\*.* the files do not become encrypted.
First seen in
SafeGuard LAN Crypt Client for PC
The name "Public Documents" is displayed (and also translated) by Windows Explorer and by file opening dialogs. However, "Public Documents" is not its true name, it is actually the "Documents" folder. The same applies to the folder called "My Documents", which is also the "Documents" folder.
Note: If you select "Public Documents" from the browse button, the correct folder name is taken.
In general, it is better to use the well known folder (special folder) names and IDs, e.g. <Common Documents> and <0x002e>\*.* This also takes in to account factors such as the location being moved to a different path.
An encryption rule containing c:\users\public will also work correctly.
The following Microsoft article provides further information: http://msdn.microsoft.com/en-us/library/ms649274.aspx.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.