File-trashing Cryptolocker PC malware

[edscdk]

There are various utilities to try and decrypt files last year's version of this virus was reversible. Not tried this year's version yet HOWEVER you do need one file that's got a encrypted and untouched version to get the key used

 

[timebomb26]

This may be a stupid question but can't the Police trace these criminals through where they're being paid too?

 

[Nikumba]

What about cloud accounts things like Dropbox, Skydrive that both accessed within Windows file explorer as another folder

Would these be susceptible to this or not?

 

[asim18]

What about cloud accounts things like Dropbox, Skydrive that both accessed within Windows file explorer as another folder

Would these be susceptible to this or not?

Depends on what kind of protocol is used. If you have permission to modify files on the fly and the remote location is mounted "live", then I don't see why not. Would take a long time though depending on how much data there is. It wouldn't occur server-side (unless it's the remote server that is infected), so the file would probably have to be downloaded, encrypted locally then re-uploaded.....
However if you have a local<=>remote sync set up (such as a dropbox folder) it will simply encrypt the local file which will then get synced to the remote server and overwrite it.


If you require login/password each time to log in to some kind of web interface with only basic manual operations over HTTP like upload/move/delete (such as skydrive's web interface), then I highly doubt it can cause any damage to the remote files. Actually I'd say impossible.


What would I recommend? Be very cautious if you have any folders which sync, in fact remove sync if viable and limit to manual uploads. If you must have a sync active, keep an eye on the relevant activity icon in the system tray, or monitor bandwidth usage with a tool such as DUmeter, or keep an eye on your router LEDs for any idle activity.

 

[Herman Gelmet]

Depends on what kind of protocol is used. If you have permission to modify files on the fly and the remote location is mounted "live", then I don't see why not. Would take a long time though depending on how much data there is. It wouldn't occur server-side (unless it's the remote server that is infected), so the file would probably have to be downloaded, encrypted locally then re-uploaded.....
However if you have a local<=>remote sync set up (such as a dropbox folder) it will simply encrypt the local file which will then get synced to the remote server and overwrite it.


If you require login/password each time to log in to some kind of web interface with only basic manual operations over HTTP like upload/move/delete (such as skydrive's web interface), then I highly doubt it can cause any damage to the remote files. Actually I'd say impossible.


What would I recommend? Be very cautious if you have any folders which sync, in fact remove sync if viable and limit to manual uploads. If you must have a sync active, keep an eye on the relevant activity icon in the system tray, or monitor bandwidth usage with a tool such as DUmeter, or keep an eye on your router LEDs for any idle activity.

Interesting... So do you know if Hubic would be safe, or whether the 'secure transfer' it mentions actually means it does require password access?
https://hubic.com/en/discover-hubic

If you don't know I can email them to ask. Thanks

 

[Jono8]

This may be a stupid question but can't the Police trace these criminals through where they're being paid too?

This is what i was thinking as well. Where does the money go?

 

[Dunks]

This may be a stupid question but can't the Police trace these criminals through where they're being paid too?

Depends where it's being paid to though, if it's some dodgy bank in Russia probably not

 

[Soundood]

How does that change anything?

Nate

it isolates the virus to within the virtual machine, the virus as such cannot see anything outside the OS it is sitting on if set up properly

 

[Judgeneo]

Like Nate says, how does using a virtual machine help?
Presumably running on a Windows host, therefore the virus can potentially infect the host surely?

I am also interested how it can spread to machines across networks. I know it can access any files the infected machine have access to across a network, but how does it hit other machines? Would it only work if there are shares the infected machine had access to?

Seriously considering with so many threats appearing to keep one machine completely disconnected most of the time for my main uses and just keep an older machine for anything internet based.

Only communication from VM to host is the bridged wifi, my virtual shared folders are not persistent and need a password to activate. So the virus could lock down the VM, bit hopefully not move across to the host.

I'll be moving to a Ubuntu host in the near future, which should mitigate the problem further

 

[Deus Ex]

This is pretty heavy ********, instead of spying on Angela Merkel our honky secret police should be hunting these criminals down.

 

[Nate--IRL--]

it isolates the virus to within the virtual machine, the virus as such cannot see anything outside the OS it is sitting on if set up properly

Only communication from VM to host is the bridged wifi, my virtual shared folders are not persistent and need a password to activate. So the virus could lock down the VM, bit hopefully not move across to the host.

I'll be moving to a Ubuntu host in the near future, which should mitigate the problem further

OK, but if the host has any access to the internet then the host can be infected directly. Bridging or Double NATing isn't going to help.

I'm not saying your idea has no merit, I'm just trying to understand it.

Nate

 

[estebanrey]

One of the many reasons why I converted my mum to linux

I've got something to tell you son.....The Dell 256k isn't your mother

 

[MartynB85]

This is a nasty one for sure. I had to look at one of our work laptops that was infected, we decided not to pay the ransom, but all his data is gone.

 

[bainbridge]

So running is running Chrome with free AV software and as usual watching what I open enough to keep this nasty thing out of my machine?

 

[Abraxaz1]

So running is running Chrome with free AV software and as usual watching what I open enough to keep this nasty thing out of my machine?

or just don't open files from unknown sources

 

[dfarrall]

it isolates the virus to within the virtual machine, the virus as such cannot see anything outside the OS it is sitting on if set up properly

Erm, how?

Only if your VM is set up to have no network access, but then it's fairly useless as an everyday OS anyway..
Not sure why you would restrict yourself like that unless you hardly use it.

 

[marc2003]

Erm, how?

you do realise computers (a virtual machine is nothing special in that respect) can be on the same network but be invisible to each other through the use of a correctly configured firewall. even the firewall built into windows should be good enough providing you don't use the default settings.

 

[Nate--IRL--]

Yes, but what stops the virus infecting the host computer directly, if that host has access to the internet? Why does the VM even matter?

Nate

 

[marc2003]

Yes, but what stops the virus infecting the host computer directly

how? the only way a guest has access to the host is via networking. it goes without saying it would be configured to use a disk image file rather than giving it full access to a hard drive partition.

 

[Hotwired]

Sounds like fun.

Think I'll disconnect the hard drives with my backup/secondary OS on.