4 ms·

I don't see any mention here, but as someone who deals with front-line response to users regularly, take a look at CryptoPrevent from FoolishIT (yes, really, ht

I don't see any mention here, but as someone who deals with front-line response to users regularly, take a look at CryptoPrevent from FoolishIT (yes, really, https://www.foolishit.com/vb6-projects/cryptoprevent/ https://www.foolishit.com/vb6-projects/cryptoprevent/) and HitmanPro.Alert (http://www.surfright.nl/en/alert http://www.surfright.nl/en/alert) with CryptoGuard. The first does a bunch of local policy setup to restrict where executables can run along with some optional subscription signature watching;the second does more watching for encrypting behavior including on a host sharing files via SMB. I also recommend making sure that shadow copies are turned on and allocated plenty of space - including on a separate partition or drive if the user in question regularly comes close to filling the drive. It's not a backup, but it is much faster to restore from a shadow copy than from an offsite backup. edit: added links

HackinOut 12y ago
CryptoWall apparently delete shadow copies with a simple vssadmin command. http://stopmalvertising.com/malware-reports/cryptowall-behind-the-scenes.html http://stopmalvertising.com/malware-reports/cryptowall-behin...
- fencepost 12y ago
  Good to know; I've only dealt with a couple and they were on workstations that encrypted files on mapped network shares - vssadmin wouldn't have any access to remove shadow copies on the file server, and in all but one of those cases we had both shadow copies locally on the file server and offsite file backups in place (backups only for the last).
  - HackinOut 12y ago
    Yes, I meant try to delete... My first impression about CryptoWall is that it was hacked together quicker than CryptoLocker. It doesn't bother with generating a symmetric key per file but rather seems to use a single asymmetric key. It also apparently make a copy of the file before encrypting and doesn't zero-out after deleting the plain text file (see another of my comment in this thread)
    - HackinOut 12y ago
      * asymmetric key pair

HackinOut 12y ago

CryptoWall apparently delete shadow copies with a simple vssadmin command. http://stopmalvertising.com/malware-reports/cryptowall-behind-the-scenes.html http://stopmalvertising.com/malware-reports/cryptowall-behin...

fencepost 12y ago
Good to know; I've only dealt with a couple and they were on workstations that encrypted files on mapped network shares - vssadmin wouldn't have any access to remove shadow copies on the file server, and in all but one of those cases we had both shadow copies locally on the file server and offsite file backups in place (backups only for the last).
- HackinOut 12y ago
  Yes, I meant try to delete... My first impression about CryptoWall is that it was hacked together quicker than CryptoLocker. It doesn't bother with generating a symmetric key per file but rather seems to use a single asymmetric key. It also apparently make a copy of the file before encrypting and doesn't zero-out after deleting the plain text file (see another of my comment in this thread)
  - HackinOut 12y ago
    * asymmetric key pair