[Samba] CryptoLocker

[Jeremy Allison]

On Wed, Apr 01, 2015 at 01:04:42PM -0500, John Schmerold john at katy.com KatyComputerSystems wrote:
> For a CryptoLocker infection to be successful, a few things must be
> occur including:
> 1) No backup
> 
> 2) Many files need to be encrypted
> 
> Has anyone developed a Samba plugin to prevent successful
> CryptoLocker infections by shutting down Samba when an unusual
> number of data files are modified by a specific workstation?

Not to my knowledge, but the Samba VFS API is easy enough
to code to that there are probably lots of site-specific
VFS modules that people use.