Some Hacker with Ransom Virus using Team Viewer to Infect Our Servers

Hi @mohammedemad,

Thanks for your query. What indication do you have, that the hacker actually used TeamViewer to install the ransomware onto the other computer? It's possible they gained access to the computer using some other method.

In any case, it's not possible for someone to connect to a computer with TeamViewer unless they know both the ID and the password of that computer. It's therefore important to make sure that the TeamViewer password is kept safe and secure, and furthermore that the password is unique - ie. not used anywhere else.

As an additional security measure, you can enable the whitelist feature in TeamViewer's options on all of the computers that you need to connect to. This setting can be found by going into the Options, then to the Security page, and clicking the "Black and whitelist" Configure button.

Then you can, for example, set "Allow access only for the following partners", and add your own TeamViewer account to the list below.

That means only you - signed in with your TeamViewer account - will be able to connect to the remote computer that is using this whitelist. If someone else tries to connect to that computer - even if they know the computer's ID and password - they won't be able to, as the whitelist will block them.

Hi @mohammedemad,

Ransomware usually gets onto a computer in the same way as many other viruses: through phishing attacks. For example, a fake email that is made to look like a legitimate email from someone you trust (eg. your bank or ISP or IT Department, etc), or perhaps a fake website that is made to look like a legitimate website. Then you are instructed to download a file, which contains the ransomware virus, and that's how it gets onto your computer. (There are other methods used too, but this is a common method: tricking the computer user into downloading an infected file, or visiting an infected website).

If you search on Google, you can find lots of articles on security or tech websites that discuss ransomware and how to prevent it or remove it. For example, I found these helpful articles:

• http://time.com/4303129/hackers-computer-ransom-ransomware/
• http://www.pcworld.com/article/2084002/security/how-to-rescue-your-pc-from-ransomware.html

Depending on the type of ransomware that has infected your servers, you may or may not be able to remove it yourself. You will probably need to do further research to find out if it's possible, or get help from a security expert.

Closing port 3389, which is used by the Microsoft Remote Desktop protocol, isn't necessary to avoid ransomware, as ransomware doesn't get into your computer through RDP.