Solved

cryptowall infection

Posted on 2014-11-12
11
311 Views
Last Modified: 2014-11-21
Hey guys,

One of our PC's got infected with the cryptowall virus. It also affected a file share on our NAS. Does this virus spread through the network?

How can it be contained?
0
Comment
Question by:Cobra25
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
  • +2
11 Comments
 

Accepted Solution

by:
Wesley Johnson earned 166 total points
ID: 40438461
I'm at a public library and this happened to us on the staff-side recently. It jumped from the PC to NAS, but, as best as we can tell, it went no further than that.

Here's a Symantec guide for removal: http://www.symantec.com/security_response/writeup.jsp?docid=2013-091122-3112-99&tabid=3. Unfortunately, if there suggestions don't work, it looks like re-installing Windows is the only way to remove it from the machine. The latest version of Symantec's A/V does offer crytpolocker protection. From what I understand, the professional version of Malwarebytes Anti-Malware does, too.

I've yet to find a way to unlock the files damaged by this infection nor has my boss. That appears to be hopeless. This issue struck us at a time when our backups weren't working properly, so the one that was restored was about a month old. Luckily I found another that was just a couple of weeks old.

Good luck!
0
 
LVL 17

Expert Comment

by:Spartan_1337
ID: 40438464
Cryptowall scans all drives on an infected machine, including mapped drives. Once it has completed its scan, it will send the payload to the encryption server and lock those files. There is nothing you can do at this point, even if you pay they may not get the decryption key before the timer runs out. You will have to restore from backup.
0
 

Expert Comment

by:Wesley Johnson
ID: 40438467
Also, according to a site I found: "CryptoLocker is not a virus (self-replicating malware), so it doesn't spread across your network by itself."
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 27

Expert Comment

by:Thomas Zucker-Scharff
ID: 40438562
Cryptolocker/Cryptowall is not really a virus - Wesley is correct.  The problem is it does so much damage, especially on network shares.  The only reasonable defense is good backups (ones that have been tested).  There is another option, we have recovered files from cryptolocker by using a cloud file backup that does versioning, like crashplan.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40438566
So ive heard it does spread and it doesnt spread, which one is it?

Thanks for the responses so far!
0
 
LVL 17

Expert Comment

by:Spartan_1337
ID: 40438581
It doesn't affect other PC's, it only searches for documents on the local HDD and mapped drives.
0
 

Expert Comment

by:Wesley Johnson
ID: 40438583
My boss tells me that Cryptolocker infects drives on a machine, so, if NAS is mapped, then it will find its way to it. You actually have to download an attachment to bring Crypto to your machine.
0
 
LVL 27

Expert Comment

by:Thomas Zucker-Scharff
ID: 40438609
Yes it will affect any mapped drives.  This is why anyone who maps a drive to their computer should have limited rights.  Even so, files for that person will be encrypted at the very least.  A good backup policy that includes frequent testing of restores is the only defense.  Periodic imaging and reimaging of computers can't hurt.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40438670
Thomas, when you say limited rights, do you mean obviously not a local admin on their PC?
0
 
LVL 27

Assisted Solution

by:Thomas Zucker-Scharff
Thomas Zucker-Scharff earned 167 total points
ID: 40438727
That would be best.  I also mean that if they need write permissions on the share, well they need it - but only to their own directory.  Many will need write perms to shared directories, almost the definition of a share, just be careful when granting these perms.
0
 
LVL 54

Assisted Solution

by:McKnife
McKnife earned 167 total points
ID: 40439393
Cryoptolocker teaches us three lessons:

-have current backups at any time
-don't rely on anti virus software but try to implement some application whitelisting instead
-only grant write access to shares when really needed.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

The related questions "How do I recover the passwords for my Q-See DVR" and "How can I reset my Q-See DVR to eliminate a password" are seen several times a week.  Here we discuss the grim reality of the situation.
No single Antivirus application (despite claims by manufacturers) will catch or protect you from all Virus / Malware or Spyware threats. That doesn't stop you from further protecting yourself however - and this article is to show you how.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question