?
Solved

cryptowall infection

Posted on 2014-11-12
11
Medium Priority
?
324 Views
Last Modified: 2014-11-21
Hey guys,

One of our PC's got infected with the cryptowall virus. It also affected a file share on our NAS. Does this virus spread through the network?

How can it be contained?
0
Comment
Question by:Cobra25
  • 3
  • 3
  • 2
  • +2
11 Comments
 

Accepted Solution

by:
Wesley Johnson earned 664 total points
ID: 40438461
I'm at a public library and this happened to us on the staff-side recently. It jumped from the PC to NAS, but, as best as we can tell, it went no further than that.

Here's a Symantec guide for removal: http://www.symantec.com/security_response/writeup.jsp?docid=2013-091122-3112-99&tabid=3. Unfortunately, if there suggestions don't work, it looks like re-installing Windows is the only way to remove it from the machine. The latest version of Symantec's A/V does offer crytpolocker protection. From what I understand, the professional version of Malwarebytes Anti-Malware does, too.

I've yet to find a way to unlock the files damaged by this infection nor has my boss. That appears to be hopeless. This issue struck us at a time when our backups weren't working properly, so the one that was restored was about a month old. Luckily I found another that was just a couple of weeks old.

Good luck!
0
 
LVL 17

Expert Comment

by:James H
ID: 40438464
Cryptowall scans all drives on an infected machine, including mapped drives. Once it has completed its scan, it will send the payload to the encryption server and lock those files. There is nothing you can do at this point, even if you pay they may not get the decryption key before the timer runs out. You will have to restore from backup.
0
 

Expert Comment

by:Wesley Johnson
ID: 40438467
Also, according to a site I found: "CryptoLocker is not a virus (self-replicating malware), so it doesn't spread across your network by itself."
0
The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.

 
LVL 30

Expert Comment

by:Thomas Zucker-Scharff
ID: 40438562
Cryptolocker/Cryptowall is not really a virus - Wesley is correct.  The problem is it does so much damage, especially on network shares.  The only reasonable defense is good backups (ones that have been tested).  There is another option, we have recovered files from cryptolocker by using a cloud file backup that does versioning, like crashplan.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40438566
So ive heard it does spread and it doesnt spread, which one is it?

Thanks for the responses so far!
0
 
LVL 17

Expert Comment

by:James H
ID: 40438581
It doesn't affect other PC's, it only searches for documents on the local HDD and mapped drives.
0
 

Expert Comment

by:Wesley Johnson
ID: 40438583
My boss tells me that Cryptolocker infects drives on a machine, so, if NAS is mapped, then it will find its way to it. You actually have to download an attachment to bring Crypto to your machine.
0
 
LVL 30

Expert Comment

by:Thomas Zucker-Scharff
ID: 40438609
Yes it will affect any mapped drives.  This is why anyone who maps a drive to their computer should have limited rights.  Even so, files for that person will be encrypted at the very least.  A good backup policy that includes frequent testing of restores is the only defense.  Periodic imaging and reimaging of computers can't hurt.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40438670
Thomas, when you say limited rights, do you mean obviously not a local admin on their PC?
0
 
LVL 30

Assisted Solution

by:Thomas Zucker-Scharff
Thomas Zucker-Scharff earned 668 total points
ID: 40438727
That would be best.  I also mean that if they need write permissions on the share, well they need it - but only to their own directory.  Many will need write perms to shared directories, almost the definition of a share, just be careful when granting these perms.
0
 
LVL 58

Assisted Solution

by:McKnife
McKnife earned 668 total points
ID: 40439393
Cryoptolocker teaches us three lessons:

-have current backups at any time
-don't rely on anti virus software but try to implement some application whitelisting instead
-only grant write access to shares when really needed.
0

Featured Post

Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This blog will spread awareness about Dropbox. We have given the statements based upon our experience. Along with this, there is a section of some new plans that should be added in Dropbox this year. This will make the storage service enhanced from …
Data security in the cloud is very much like a security in an on-premises data center - only without costs for maintaining facilities and computer hardware.
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…

599 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question