« Upvoted: Using CryptoLocker's powers for good over the scam callers from "Windows" | Home | Upvoted: Disaster Recovery plans for sudden out of business cloud providers »

October 24, 2013

Upvoted: CryptoLocker Recap: A new guide to the bleepingest virus of 2013.

As the previous post, "Proper Care & Feeding of your CryptoLocker Infection: A rundown on what we know," has hit the 500 comment mark and the 15,000 character limit on self-posts, I'm going to break down the collected information into individual comments so I have a potential 10000 characters for each topic. There is a cleaner FAQ-style article about CryptoLocker on BleepingComputer.

Special thanks to the following users who contributed to this post:

  • /u/zfs_balla
  • /u/soulscore
  • /u/Spinal33
  • /u/CANT_ARGUE_DAT_LOGIC
  • /u/Maybe_Forged
  • Fabian Wosar of Emsisoft
  • Grinler of Bleepingcomputer for his Software Restriction Policy which has been adapted for new variants
  • Anonymous Carbonite rep for clarification on Carbonite's mass reversion feature.
  • Anyone else that's sent me a message that I haven't yet included in the post.

I will be keeping a tl;dr recap of what we know in this post, updating it as new developments arise.


tl;dr: CryptoLocker encrypts a set of file masks on a local PC and any mapped network drives with 2048-bit RSA encryption, which is uncrackable for quite a while yet. WinXP through Win8 are vulnerable, and infection isn't dependent on being a local admin or having UAC on or off. MalwareBytes Pro and Avast stop the virus from running. Sysadmins in a domain should create this Software Restriction Policy which has very little downside (you need both rules). The timer it presents is real and you cannot pay them once it expires. You can pay them with a GreenDot MoneyPak or 2 Bitcoins, attempt to restore a previous version using ShadowExplorer, go to a backup (including versioning-based cloud backups), or be SOL.


EDIT: I will be updating individual comments through the evening to flesh out areas I had to leave bare due to character limitations or lack of info when they were originally written.

EDIT 2: There are reports and screenshots regarding a variant that sits in AppData/Local instead of Roaming. This is a huge development and I would really appreciate a message with a link to a sample of this variant if it does indeed exist. A current link to the known variant that sits in Roaming would also be appreciated.

10/24/13 EDIT: Please upvote How You Can Help for visibility. If you can contribute in any of those fashions it will help all of us a lot.

submitted by bluesoul to sysadmin
[link] [294 comments]

via reddit: the front page of the internet