Crypto Locker Virus Takes Over Windows PCs With 'Ransomware'

The Inquisitor ^ | 27 October 2013 | James Kosur

[discostu]

That thread also has instructions for a Windows setting that will stop it outright, and a few other things. That’s where all my other solutions came from.

[Windflier]

You send them money, how hard could it be for the FBI with all its, super powers to find where the money goes and bust this bunch?

Protecting the American people isn't part of Emperor Obama's mission directives to his spy agencies.

Now get back to work, prole. Someone's got to feed the 47%.

[Windflier]

These people should be skinned alive

Slowly. In public. Tied over fire ant mounds.

[Windflier]

the ‘hide file extension’ function is one of the easiest to undo.

Are the instructions to do that something you can quickly type out for those of us who don't know how?

[The Great RJ]

You should already be backing up your important files especially your digital photos anyway. External hard drives are cheap and there are cloud storage sites that will provide a limited amount of storage for free. To be really safe I back up my photo files on flash drives and store them in my bank safety deposit box.

[Lurkina.n.Learnin]

I’m bookmarking this. I’m not that computer savvy but this sounds like something that should be done.

[Windflier]

You should already be backing up your important files especially your digital photos anyway.

That's true, but life is messy, and not everyone backs up their files when they should. Criminals, such as those who launched this menace, are exploiting that human shortcoming.

They ought to be hung by the neck til dead for committing this crime.

[Windflier]

Glad I could help, friend. That’s the whole idea of this thread.

[NoCmpromiz]

The CryptoLocker virus is being called one of the worst computing threats ever seen...

There's this from Malwarebytes...

Cryptolocker Ransomware: What You Need To Know

[roamer_1]

Are the instructions to do that something you can quickly type out for those of us who don't know how?

A pet peeve of mine - *No* windows box leaves my bench with extensions hidden, ever.

WinXP-Win7 (32/64bit)
Control Panel => Folder Options [Tab='View'] - Remove the check from 'Hide extensions for known file types'. Apply/OK.

[I want the USA back]

Any operating system that is so full of holes that this can happen, is nothing but junk.

[Zathras]

Malwarebytes just picked up 3 files which got past Kaspersky.

[Windflier]

There's this from Malwarebytes... Cryptolocker Ransomware: What You Need To Know

Thanks for the link, NC.

Per the article, only paid users of Malwarebytes Pro versions have protection against their computers being infected by this virus. Free users have no protection, and will lose their files (or be forced to pay the ransom) if they're infected.

Here's an interesting tidbit about infection vectors from a link in the article:

CryptoLocker currently has the following infection vectors:

1. This infection was originally spread sent to company email addresses that pretend to be customer support related issues from Fedex, UPS, DHS, etc. These emails would contain an attachment that when opened would infect the computer.

2. Currently dropped by Zbot infections disguised as PDF attachments

3. Via exploit kits located on hacked web sites that exploit vulnerabilities on your computer to install the infection.

4. Through Trojans that pretend to be programs required to view online videos. These are typically encountered through Porn sites.

So this thing isn't just being spread through email attachments. That makes the threat level a lot higher.

[Windflier]

Thanks much, Roamer. I’m going to make that change right away.

[Windflier]

Any operating system that is so full of holes that this can happen, is nothing but junk.

No point in barking at reality, friend. We live in an imperfect world.

[NoCmpromiz]

And this from bleepingcomputer.com...

CryptoLocker Ransomware Information Guide and FAQ

[Windflier]

Malwarebytes just picked up 3 files which got past Kaspersky.

It's structured differently than virus protection programs, and regularly picks up things that anti-virus programs miss. I use the free version and run it at least once a week.

[Windflier]

How to block this infection from running on other computers on your computer.

You can use Software Restriction Policies to block executables from running when they are located in the %AppData% folder, or any other folder, which this thing launches from. See these articles from MS:

http://support.microsoft.com/kb/310791
http://technet.microsoft.com/en-us/library/cc786941(v=ws.10).aspx

This can also be set up in group policy.

File paths of the infection are:

C:\Users\User\AppData\Roaming\{213D7F33-4942-1C20-3D56=8-1A0B31CDFFF3}.exe (Vista/7/8)

C:\Documents and Settings\User\Application Data\{213D7F33-4942-1C20-3D56=8-1A0B31CDFFF3}.exe

Please see further instructions at this link to manually protect your computer from the CryptoLocker virus.

[NoCmpromiz]

Any operating system that is so full of holes ... is nothing but junk.
No point in barking at reality... We live in an imperfect world.

And this is why you should make sure whatever opsys you use is locked up tighter than the NSA files. You can bark at Windoze all you want but keep in mind that the beloved MACos and the penguin are also subject to attack.

NO operating system is bullet proof. Security is the users' responsibility. What I run may not be everyone's cup of tea so your mileage may vary but for starters Firefox with NoScript. At least with that combo if something executes from a web link, you OK'd it...

There are other options to lock down (originally typed 'lock-up' but windoze manages that quite well on its own..;-) your machine including some in the link in post #56.

Your choice as to whether you want to do that or just complain about the holes...

[zeugma]

Any operating system that is so full of holes that this can happen, is nothing but junk.

I've been calling the use of MS-Windows in the business sphere criminal fiduciary negligence for years. The lost productivity guaranteed by use of microsoft software is staggering.