Database broker fails to start database with error (44) due to Locky virus.

Database broker fails to start database with error (44).

Restoring the database works then fails again afterwards.


 

Files with format 77317D93DE39AAF780615EC724BC4C6E.locky  are generated in the directory.

Newer strain of the virus create files with UUID with the extension .zepto 

Newer strain of the virus generates a _2_HELP_instructions.html file.

The machine is infected with the Locky virus. It has been observed so far that it encrypts the .db file and causes a wrong version number error.

To recover from this problem try the following:
 
1) Make sure the machine is disinfected.

2) Make an OS  backup of the database files.

3) Delete the database .db file.

4) From proenv run the command:

 prostrct builddb  <database name>

5) Verify the database by starting it in single user mode using the command:

 pro <database name> -p dict.p

6) If you still have a problem restore from the last good backup.

Note: This virus seems to spread through the network so all the connected machines need to be scanned for virus to avoid future problems. 

Unix file systems that use Samba to be accessible to Windows are vulnerable to a Windows infected machine.

Progress Articles:

 What causes Error 44 when accessing an OpenEdge database?   
AdminServer only partially functional due to corruption of OEM / Fathom data files by Locky virus. Error (10148) listed in admserv.log file.​

Symantec web site: Ransom Locky

http://www.symantec.com/security_response/earthlink_writeup.jsp?docid=2016-021706-1402-99

Sophos web site: Locky” ransomware – what you need to know

https://nakedsecurity.sophos.com/2016/02/17/locky-ransomware-what-you-need-to-know/