How can we remove a virus from the Vault?

[SteveASmith1990]

We had at least a couple of different viruses going around. One was a Trojan but we also had a ransomware virus. Just before we shut everything down we noticed that we lost access to the Vault ( 2019 Vault Basic).

Our IT people are afraid that the files in the Vault have been infected. Is that possible? And if it is, does anyone know how we can scrub these files?

[JamesMcMullen]

Hi Steve,

I am not aware of a way to "clean" the Vault of viruses.  But, if you think files inside the Vault might be infected, I would take whatever system your Vault filestore was on offline (off the network even).  Run a virus scan on the machine and see what it returns.  I think once we know if it is infected or to what extent the infection is, we can advise on different things to potentially do.

Thanks,

[SteveASmith1990]

Hi James,

Thanks for the reply. I will forward it on to our IT people.

My regards,

Steve Smith

[JamesMcMullen]

I should have probably called it out.  But taking the file store offline will take your Vault offline as well.  I made an assumption that the file store and Vault were on the same machine.

[SteveASmith1990]

They are on a virtual machine which was taken down as well as the actual server it was on as soon as IT realized that we had ransomware going around.

[SteveASmith1990]

Our IT people tell me that because the Vault filed are encrypted they can’t tell if they are infected or not. So they feel that it is best to error on the side of caution and to erase those files.

We do have an old backup from several months ago but would lose all of our work since last summer. We are having a meeting tomorrow go over our options which are very limited at the moment. Please tell me there is a  better option.

[swalton]

I didn't think that Vault encrypted anything.

I know our filestore is not encrypted.  Vault renames all the files and stores them in its own way, so you can't manually navigate the folder structure to "my-latest-design.iam".  Instead Vault stores the mapping between "my-latest-design.iam" to "Vault's-name-for-my-latest-design.iam" in one of the SQL databases.

Maybe the various SQL databases that Vault uses are encrypted.   I am not enough of a database person to know.