Author Topic: CryptoLocker hits  (Read 14979 times)

0 Members and 1 Guest are viewing this topic.

Offline Rednose

  • Pirate Party Member
  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 3739
  • Bits of Freedom : https://www.bof.nl
    • Nederlandstalig Avast! forum
Re: CryptoLocker hits
« Reply #15 on: July 11, 2015, 12:32:34 AM »
Hi ItsAllGoodMan, welcome to the forum :)

So, Avast failed me tremendously.  I am 1000% disappointed it didn't prevent this virus/malware from getting so far out of hand.  It has blocked all sorts of things over the years, but this failure is so bad that I am going to look into other anti-virus software.

You should realise that another AV will have the same problem, as Essexboy pointed out :

The bottom line is no as the droppers change on a daily basis, no AV as far as I am aware can block this until the variant is probably two days old
http://www.bleepingcomputer.com/forums/t/563169/after-a-brief-hiatus-malware-developers-release-cryptowall-30/page-14

Bob3160 is right, that making regular image backups is essential !

Greetz, Red.
« Last Edit: July 11, 2015, 12:34:49 AM by Rednose »
OS: Win 10 / iOS 17 / Debian 12 / Tails 5
Real Time: Avast Premium Security
On Demand: Malwarebytes
VPN: NordVPN ( NordLynx ) with Threat Protection ( Lite )

Offline ItsAllGoodMan

  • Newbie
  • *
  • Posts: 19
Re: CryptoLocker hits
« Reply #16 on: July 11, 2015, 02:37:09 AM »
The main thing was that what I was using to protect my computer gave me a false sense of security.  Avast did give pop-up warning messages to show some things were being blocked, but it might as well have announced "Your computer is going to be extremely messed up, and there's nothing Avast can do to stop it."

I'm still not exactly sure what malware/virus was installed (it seemed different than what was described: https://blog.malwarebytes.org/exploits-2/2015/07/neutrino-ek-leverages-latest-flash-0day/ ), but it had something to do with CryptoWall 3.0 and explorer.exe... as I was trying to clear things off, I did notice a file displayed Asian (probably Korean) text in the Windows Explorer description area.  I should have written down the 2 IPs that were being blocked over and over by Avast... I remember one started with 33.?.?.?, but that could pretty much point to anything.

The only thing I really would use Adobe Flash for is to watch videos or play Flash games.  The time and aggravation of going through the "computer redoing" process doesn't make either of those activities worth it, and  I'm not going to reinstall Adobe Flash.  I used to create simple, website animations using Flash while doing website development, but I'm no longer going to use Flash for anything.  While it isn't perfect yet, HTML5 is good enough for videos (like on YouTube) and some of the things Flash could do.  While it could've been other things that caused the malware/virus problem, it definitely sounds like Adobe Flash created the security hole.  There used to be tons of plug-ins back in the Netscape browser days... most of their usefulness disappeared as browsers improved.  Just like the Java plug-in, the Adobe Flash plug-in will be uninstalled from most users' browsers because of the constant security problems the plug-ins create.

After I'm all done with the reinstall/reconfiguration/setup, I'll look into making a clone (ghost image) of the drive (any suggestions on the best application to use for this would be appreciated)... then, if something major happens, the redoing process shouldn't take nearly as long... just the updates for Windows 7 took hours to download and install... that was something like 180 Windows 7 updates.  I did already have most of my files already backed-up off of my computer, so I can just transfer things over when things are finally setup.

I'm curious what others would try if this happened to your computer... what steps would you take and what programs would you use to try and fix the problem (remove the virus/malware and restore the computer to how it was before the infection)?

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48552
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: CryptoLocker hits
« Reply #17 on: July 11, 2015, 04:20:39 AM »
Simple answer is to format the drive that contained the malware and restore the most recently created Image prior to the infection.
What to use for creation of an image already comes with windows. :)
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline ItsAllGoodMan

  • Newbie
  • *
  • Posts: 19
Re: CryptoLocker hits
« Reply #18 on: July 13, 2015, 02:28:09 AM »
I finally have the computer set pretty much how I had it before.  There is no way I am going to install Adobe Flash again.  I also read there are two more security holes in Adobe Flash that haven't been patched yet:
http://www.theregister.co.uk/2015/07/12/adobe_flash_zero_day_cve_2015_5122/

I just ordered a USB Flash drive for back-ups.  I also downloaded and burned Redo Backup & Recovery (http://redobackup.org/).  So hopefully, no other problems come up before I get a chance to actually make a back-up.

I recommend uninstalling the plug-in for Adobe Flash (and Java if you haven't already).  Definitely make a back-up of your hard drive.

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48552
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: CryptoLocker hits
« Reply #19 on: July 13, 2015, 01:42:09 PM »
If you intend to make an image backup, you'll need more than a USB flash drive.
You'll need an external hard drive to hold a full image backup. :)
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline Rednose

  • Pirate Party Member
  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 3739
  • Bits of Freedom : https://www.bof.nl
    • Nederlandstalig Avast! forum
Re: CryptoLocker hits
« Reply #20 on: July 13, 2015, 03:08:54 PM »
You definitely need an external harddrive.

I recommend to make an image of a fresh, clean and updated Windows installation, and to keep that as a starting point for a next time.
Also keep images from the last 6 - 8 week before you delete them, just in case.
And definitely keep them when you participate in Beta testing etc.

Greetz, Red.

OS: Win 10 / iOS 17 / Debian 12 / Tails 5
Real Time: Avast Premium Security
On Demand: Malwarebytes
VPN: NordVPN ( NordLynx ) with Threat Protection ( Lite )

Offline schmidthouse

  • VIRUS FREE A Long Time
  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7170
  • When you think you know, Think Again
Re: CryptoLocker hits
« Reply #21 on: July 13, 2015, 04:49:32 PM »
I finally have the computer set pretty much how I had it before.  There is no way I am going to install Adobe Flash again.  I also read there are two more security holes in Adobe Flash that haven't been patched yet:
http://www.theregister.co.uk/2015/07/12/adobe_flash_zero_day_cve_2015_5122/

I just ordered a USB Flash drive for back-ups.  I also downloaded and burned Redo Backup & Recovery (http://redobackup.org/).  So hopefully, no other problems come up before I get a chance to actually make a back-up.

I recommend uninstalling the plug-in for Adobe Flash (and Java if you haven't already).  Definitely make a back-up of your hard drive.

So did you install 'CryptoPrevent' ? ???

Offline ItsAllGoodMan

  • Newbie
  • *
  • Posts: 19
Re: CryptoLocker hits
« Reply #22 on: July 13, 2015, 06:57:14 PM »
My hard drive is 80GB, and I'm currently only using about 20GB of space.  The 20GB includes all of the software I wanted to install and personal files.  I really try not to store much on the hard drive just in case there is a problem.  I also use CCleaner and PrivaZer, and that helps remove things that just waste space.  The USB Flash drive I ordered holds 128GB, so the full disk image should fit.  Are the backup disk images the exact since of the drive's capacity or just about the size of what is stored on the drive?

I've looked at the CryptoPrevent website (https://www.foolishit.com/cryptoprevent-malware-prevention/), but I have not installed the software yet.  I will look more into what the software does to prevent CryptoWall.  I try not to have additional applications running all the time, and if there are security settings/changes I can manually make instead of installing the software I'd prefer to make them.  Is CryptoPrevent that much better than following the steps mentioned here to manually secure the computer: http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#prevent

I think the best thing to do was to just not install Adobe Flash.  Software requiring regular updates because of potential security holes and is a regular target for malicious software attacks is not a good thing to install in the first place.  So at the moment, it is pretty much just Windows and IE that have the potential for problems while using the Internet.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: CryptoLocker hits
« Reply #23 on: July 13, 2015, 07:44:53 PM »
Cryptoprevent does not run .. It makes policy changes in the registry

Offline schmidthouse

  • VIRUS FREE A Long Time
  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7170
  • When you think you know, Think Again
Re: CryptoLocker hits
« Reply #24 on: July 13, 2015, 08:19:49 PM »
My hard drive is 80GB, and I'm currently only using about 20GB of space.  The 20GB includes all of the software I wanted to install and personal files.  I really try not to store much on the hard drive just in case there is a problem.  I also use CCleaner and PrivaZer, and that helps remove things that just waste space.  The USB Flash drive I ordered holds 128GB, so the full disk image should fit.  Are the backup disk images the exact since of the drive's capacity or just about the size of what is stored on the drive?

I've looked at the CryptoPrevent website (https://www.foolishit.com/cryptoprevent-malware-prevention/), but I have not installed the software yet.  I will look more into what the software does to prevent CryptoWall.  I try not to have additional applications running all the time, and if there are security settings/changes I can manually make instead of installing the software I'd prefer to make them.  Is CryptoPrevent that much better than following the steps mentioned here to manually secure the computer: http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#prevent

I think the best thing to do was to just not install Adobe Flash.  Software requiring regular updates because of potential security holes and is a regular target for malicious software attacks is not a good thing to install in the first place.  So at the moment, it is pretty much just Windows and IE that have the potential for problems while using the Internet.


CryptoPrevent does not consume resourse in space or CPU.
As essexboy stated it only changes/add Reg Entries.

But hey, your security decision.

edit
« Last Edit: July 14, 2015, 04:34:34 PM by schmidthouse »

Offline ItsAllGoodMan

  • Newbie
  • *
  • Posts: 19
Re: CryptoLocker hits
« Reply #25 on: July 13, 2015, 09:28:24 PM »
I decided to just try out the manual Software Restriction Policies update described here:
http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#manual

The only difference I noted was that for Windows 7 you can just go to Administrative Tools->Security Configuration Management instead of typing in Local Security Policy in the Start Menu search.

The steps to add the 8 new rules were very easy.  I'm not sure how the changes will impact my system, but we'll see how things go.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: CryptoLocker hits
« Reply #26 on: July 13, 2015, 09:33:46 PM »
The attached text file shows the elements that cryptoprevent changes


Offline ItsAllGoodMan

  • Newbie
  • *
  • Posts: 19
Re: CryptoLocker hits
« Reply #27 on: July 13, 2015, 10:53:53 PM »
Thanks for posting the file that shows what Cryptoprevent creates rules for.

It looks like the majority of the restrictions are on files that can run/execute (.bat, .cmd, .com, .exe, .js, .jse., .pif, and .scr), are in locations where programs should not be running, or are of files that appear to be named as multimedia/compression/MS Office files but are actual files that can run/execute.  There also are restrictions on svchost.exe running in odd locations.  And, cipher.exe, lsassvrtdbks.exe, lsassw86s.exe, scsvserv.exe, syskey.exe, and vssadmin.exe are restricted... it looks like all of these except ciphere.exe and vssadmin.exe are malware programs... does Avast already block all of these malware programs?

I'm not sure what this restriction does:
HKLM Group Policy restriction on software: ** <====== ATTENTION
« Last Edit: July 13, 2015, 10:55:43 PM by ItsAllGoodMan »


Offline mchain

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 5604
  • Spartan Warrior
Re: CryptoLocker hits
« Reply #29 on: July 14, 2015, 08:21:18 PM »
Adobe Flash gone from my Windows system for more than two months now:

HTML5:  https://en.wikipedia.org/wiki/HTML5  No recommendation as to which browser HTML5 player to use.
Windows 10 Home 64-bit 22H2 Avast Premier Security version 24.1.6099 (build 24.1.88821.762)  UI version 1.0.797
 UI version 1.0.788.  Windows 11 Home 23H2 - Windows 11 Pro 23H2 Avast Premier Security version 24.2.6105 (build 24.1.8918.827) UI version 1.0.801