[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Post Thoughts & Ideas
  • Learn & ask questions
Ransomware - Wannacry/wcry and everything else ...

Ransomware in general is something none of us wish to deal with.  The latest Wannacry problem is worse.  This is not because of what it is but rather of the extent to which it has affected our users.  There have been a plethora of great suggestions all over this site.  I would add to those with the following suggestions:
•      Completely check your system for viruses with a reputable virus checker
•      Check any suspected files and or links at virustotal.com
•      Make sure you have a tested versioning backup system
•      Do a complete scan of your system
•      Updates
        o      Make sure all your programs and your operating system is up to date (even old Windows OS’s now
                have updates, like windows XP – check the Microsoft website and do a windows update)
        o      If you are unable to do updates on your own machine due to company policy, make sure that your IT
                department is doing the updates.
•      Do not, click on an attachment in your email, even if it is from someone you know – call them up and check
        that they sent it – they’ll understand.

Whenever I touch a system I do a “ransomware check” which involves the following:
•      Create a blank text file called myapp.txt in the root drive (c:\) and rename it to myapp.exe
•      Run FoolishIT’s Cryptoprevent
•      Install an anti-ransomware tool such as BD Antiransomware, MBAM Antiransomware, Kaspersky
        Antiransomware for business, etc.
•      Run SpyBHORemover and SpyDLLRemover from securityxploded.com
•      Run a full scan
•      Disable Autorun and Autoplay

The rest of what I do involves anti virus procedures.  It is important to do all of this at the very least to protect your systems.  I highly recommend using tools/software such as Cylance, SentinelOne, MBAM, Kaspersky, etc.
20
 
LVL 122

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE^2)
the issue now is the next coded attempt.... which will have no KILLSWITCH!
0
 
LVL 29

Author Comment

by:Thomas Zucker-Scharff
Yes that is the problem.  News says this release of wannacry was probably a mistake.
1
 
LVL 32

Expert Comment

by:Subodh Tiwari (Neeraj)
In India, the following msg is being circulated over social media...

Please do not open any email which has attachments with tasksche.exe file
1
 
LVL 122

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE^2)
Well most of these are re-hashes of something previously released. cut and pasted code, so the killswitch was probably left over code from before...
0
 

Expert Comment

by:Chad Crouch
I read somewhere that a researcher figured out the kill switch.
0
 
LVL 23

Expert Comment

by:Mohamed Osama
Personally I see ransomware issues as just another threat like other types of malware  (Viruses /worms,etc), but the only way that differs in dealing with it is by being proactive, not reactive, through proper patching of all the company's Operating system and software ,as well as Antivirus products (Preferably managed Trusted ones),, raising user awareness about "fishy" mails or "suspicious websites " that could act as a dropper for malware , either through IS training or enforcing web browsing security policy using a proxy  Preferably both ways together .
in case of mass exploits like this that cause outbreaks , keeping the DEP feature of windows does help against remote code execution exploits.,
also ensuring users are operating using the least privilege needed, someone who does data entry or type reports Does Not need Admin rights.
There is also a role for the system admin to keep researching such threats and apply best practices as they come out.
Also we keep advising clients of constant backups preferably stored off site or at the very least backup to a personal  cloud or removable media all critical files ,because most ransomware infections are fatal, let us be realistic here , nobody is paying and nobody is getting a decryption key .in some cases security researchers either in AV companies or Experts of Cryptology provide a solution, but the chances of recovering Everything is practically Null , Data Loss and corruption is bound to happen ,This is where constant incremental backups come in.
this is is how I see it , hope it helps.
2
 
LVL 97

Expert Comment

by:Experienced Member
The overall advice to keep automatic updates on to keep updates current, keep Antivirus up to date and firewalls up to date is something we have said many times in here (sometimes to deaf ears).

Two really important points. Stop the excuses and dump all desktop operating system earlier than Windows 7 and all server operating systems earlier that Server 2008.

Second: get top notch spam filters. That is how this malware gets in.
3
 
LVL 14

Expert Comment

by:Natty Greg
I can not stress enough about proxy and spam filter, content filter along with gateway antivirus scanning, patching all systems and educating users.
2

Keep in touch with Experts Exchange

Tech news and trends delivered to your inbox every month