Blocking Cryptowall/Cryptolocker writing to network shares
Does anyone have a suggestion for a file monitoring program or a group policy that would identify when Cryptowall or Cryptolocker (or any of the new variants) is encrypting files on a network drive and actively block that PC from writing to the server? Based on my research it is almost impossible to stop cryptowall/locker if a user activates it but there has to be a way to minimize the damage on the network drives. I have had 2 clients infected with cryptowall/locker this week and no one seems to have a good solution for preventing it. I have implemented software restriction policies but that will be marginally effective at best since I can't restrict all executables in the appdata folder. One person recommended locking down the outbound ports on the firewall but both of the networks that were infected already had the firewall locked down to the minimum required outbound ports. Any help would be appreciated.
Last Comment
SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER CERTIFIED SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
You are welcome and good luck. Check out the acknowledgements in the article. Some experts here on EE contributed a lot.
Windows Server 2008
Windows Server 2008 and Windows Server 2008 R2, based on the Microsoft Vista codebase, is the last 32-bit server operating system released by Microsoft. It has a number of versions, including including Foundation, Standard, Enterprise, Datacenter, Web, HPC Server, Itanium and Storage; new features included server core installation and Hyper-V.
86K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
TRUSTED BY
ASKER
I will certainly check out CryptoPrevent. The sooner I know something is going on, the easier to mitigate the damage.
One of the biggest problems I have had is determining where the infection actually originated. In every case the users deny seeing anything or clicking anything. By the end of the discussion they weren't even in the office that day. The only internet cache data I can find within the time window of the last infection was from expedia.com so either it was a drive by or the user isn't being forthcoming.
Thanks for Thomas Zucker-Scharff for the link to your article. Reading your article and related/linked articles should keep me busy today!
Thanks again to all for your help!