Ransomware/Cryptolocker news articles popping up

[Boyiee]

Started seeing more reports of people getting hit by these that are supposedly "un-removable."

They "physically encrypt your computers files and will not let you access them unless you pay a ransom, or they will delete your files." They are being called "new" and "un-removable." People pay the ransom, ~$300.00, and sometimes don't even get the files back!

Anyone else seeing these reports popping up on their local news/facebook posts? The Jewish town next to me is getting hammered by this and the "local technicians" (unqualified, no-degree etc) are unable to get around it.

Personally I just find it hilarious and thought I'd share.

[Vandole]

Lol... These are so easy to get around. Just shows how good small town it people are

[Patriarch]

hard boot, safe mode w/ network

local admin user account

combo fix

boom

[octopus]

How do you plan to decrypt the data after removing the cryptolocker? Brute force?

[The Stig]

Scare tactic, it won't actually encrypt the data.

Unless some do ... but I've not come across any.

[octopus]

I think some actually do:

http://arstechnica.com/security/2013...0-in-bitcoins/

None of the reddit posters reported any success in breaking the encryption. Several also said they had paid the ransom and received a key that worked as promised. Full backup files belonging to Nic's clients were about a week old at the time that CryptoLocker first took hold of the network. Nic advised them to comply with the demand. The ransomware operators delivered a key, and about 24 hours later, some 400 gigabytes of data was restored.

[Grieverbk]

Scare tactic, it won't actually encrypt the data.

Unless some do ... but I've not come across any.

There are some that encrypt your data, even dating back into the 90s.

[Seraph]

Some of the variants actually do encrypt stuff.

[Melena]

Doing IT work in a jail, I always giggle when someone's profile gets nailed by the FBI Ransomware. Then I get to drink the glorious tears as they cry when I tell them their shit is bye bye and that they should have backed stuff up to the network drives.

[octopus]

Backing up to the network drives may not even be good enough:

http://blog.malwarebytes.org/intelli...-need-to-know/

Also, the existence of malware such as Cryptolocker reinforces the need to back up your personal files.

However, a local backup may not be enough in some instances, as Cryptolocker may even go after backups located on a network drive connected to an infected PC.

Cloud-based backup solutions are advisable for business professionals and consumers alike. Malwarebytes offers Malwarebytes Secure Backup, which offers an added layer of protection by scanning every file before it is stored within the cloud in an encrypted format (don’t worry, you can decrypt these).

[Yabby]

Backing up to the network drives may not even be good enough:

http://blog.malwarebytes.org/intelli...-need-to-know/

Yes, but most IT have backups of network shares. So if this happened, a simple wipe and restore would be easy. Can't infect an off-site tape.

[Melena]

Backing up to the network drives may not even be good enough:

http://blog.malwarebytes.org/intelli...-need-to-know/

Dual backups both onsite and at another location. Worst case for us is that we delete the corrupted one and restore from backup which won't be more than 7 days old. What's been more annoying was the fucking virus that renamed all office files to a screen saver extension. That was a pain in the ass.

[djzombie]

there are a bunch of free programs that will do batch renaming of files if you can't manage a simple batch file yourself.

haven't encountered crypto locker at work yet, hopefully it stays that way, but i deal with the dumbest fuckin computer users so... its only a matter of time.

[The Stig]

Same. It'd be interesting to encounter it.

My tech knowledge would be handwaved by "we need to contact the vendor first" despite me probably saying if users on Reddit can't hack it apart I seriously doubt our vendor can lol

[orinthia]

Pretty scary, easy to prevent ever running but ridiculously bad for tarded uses. Shadow copies is at least a built-in thing that can help with this, but backing up precious data offsite can be tough to drill into tards. Now you just hope they don't upgrade this to force 30+ writes on cloud services/shadow copies to kill old versions of the correct files (some services have a 30 old version limit on files).

https://www.youtube.com/watch?v=M4dN...ature=youtu.be
Nice video on prevention, though take caution as some software requires what this changes to run normally.

[Melena]

there are a bunch of free programs that will do batch renaming of files if you can't manage a simple batch file yourself.

haven't encountered crypto locker at work yet, hopefully it stays that way, but i deal with the dumbest fuckin computer users so... its only a matter of time.

That's what we had, but even batch files when you got hundreds of thousands of files still takes time

[Salodin]

Dealt with this at work last week. Was able to remove it, but yes it did actually encrypt the data. I'm not proficient enough to decrypt it, luckily it's a small restuarant with the only information worth a damn was a years worth of special menus. I recommended he just wipe and start over even though I removed the virus since all his files were useless any ways, but he hasn't done so yet. Maybe that's for the best, any one know how to recover such a thing?

[Builttolast]

Dealt with this at work last week. Was able to remove it, but yes it did actually encrypt the data. I'm not proficient enough to decrypt it, luckily it's a small restuarant with the only information worth a damn was a years worth of special menus. I recommended he just wipe and start over even though I removed the virus since all his files were useless any ways, but he hasn't done so yet. Maybe that's for the best, any one know how to recover such a thing?

You can't recover encrypted data without the private key. End of story. The current iteration of this malware does encrypt local and network files (mapped drives) which cannot be recovered. Delete and repair is your only option. System restore if they're documents etc. You have to catch it within minutes or hours before too much damage is done.

[Omniyoji]

Yes, as long as it's not some kind of ruse and they're actually encrypting you can't do anything. Also since no has noted yet, is this really only affecting Windows machines? A no go on OSX and linux?

[Boyiee]

all of the cases I've seen locally are on Windows.