How to find the culprit computer where the TeslaCrypt is located?

I have 2 network drives wiped by *.vvv files (and the associated ransom files). Drives are located on a Synology box, which I don't think can be infected itself (?).

 

There are several Windows 7 computers possible connecting to these drives (this is an educational environment) but I haven't been able to find any tell-tale signs yet - none have local files destroyed with the .vvv extension. Went through the hosts file, processes, msconfig, etc. and found nothing. Is there an easy way/file that identifies what computer has the ransomware on it that spread to the network shares?

 

It would seem from the things I read (ransom messages, most files non opening, etc) an infected computer would be obvious, but I have not heard a thing/complaint from any user having problems with their laptop.

 

Thank you for any advice, if this is more appropriate in the Removal Forum, please let me know and I'll move this over.

 

Nathan

Edited by Chris Cosgrove, 04 December 2015 - 05:09 AM.
Moved from AII to 'General security'

Hi Nathan to BleepingComputer

 

If every user have different credentials to access the NAS check the file properties of those .vvv files on the NAS using the File Station, right click then Properties it should say how is the owner of the file.

 

If several users connect using the same user/pass and there are more vvv files been created right now you need to check the active connection on the NAS and the IP of the connected machines on the Resource Monitor.

What you need to know about TeslaCrypt, Alpha Crypt, and Network Shares.

There is an ongoing discussion in this topic where you can ask questions and seek further assistance.

• New TeslaCrypt version that uses the .EXX extension Support & Discussion

Rather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions, comments or requests for assistance in that topic discussion. Doing that will also ensure you receive proper assistance from our crypto malware experts since they may not see this thread. To avoid unnecessary confusion...this topic is closed.

Thanks
The BC Staff