New Computer Virus - serious business

CT4ME

CT4ME

Cleared for Takeoff
Joined
Oct 24, 2011
Messages
1,321
Location
Phoenix, AZ
Display Name
CT4ME
Home Airfield
KDVT
A new virus is circulating that goes beyond anything done before. Google CryptoLocker for a real scare. It attacks all the data files (docs, pics, vids, music, etc) and encrypts them. Then, it asks for a $300 ransom to get the encryption key to unlock everything. The virus also encrypts all data files on any hard drive connected to the computer... this means it will encrypt all data files on your server. To make things worse, if your virus program finds and eliminates even part of the virus, you won't even be able to pay the ransom to get your stuff back. And worse yet, the servers that hold the encryption key may have been taken down (by authorities), so even if you pay the ransom, you may not be able to un-encrypt your files.
We have seen this with some of our clients, and it is real. Restoring from a backup is your only possible solution, besides avoiding it in the first place.
So far, our clients have got the virus through bogus email attachments, but it is also spreading with fake "updates" that pop up on web pages.
=-=-=- BEWARE =-=-=-=-
 
Last edited:
Windows users are so cute, it brightens your day.
 
Just make sure your computer gets 20 minutes of sunlight daily, it will be fine.
 
Co-worker got this virus 2 days ago. He didn't pay the "ransom", the virus was fairly easily removed, but the his files were toast. Our company computers are backed up online every day around noon, so he only lost about 4 hours of work. He said that he had opened an image of a receipt sent to him from his son, and believes that's how he contracted the virus. This is a very real threat.
 
After reading this thread, I turned off my DSL modem and cloned my hard drive.

I wonder if there is a way to track this person down by making a payment and then following the money.
 
I'm so glad you got the 8.1 upgrade for free.
 
Palmpilot said:
After reading this thread, I turned off my DSL modem and cloned my hard drive.

I wonder if there is a way to track this person down by making a payment and then following the money.
Click to expand...

The ransom is payable in "bitcoins". I wonder how you trace bitcoins.
 
Steve Job said:
The ransom is payable in "bitcoins". I wonder how you trace bitcoins.
Click to expand...

This article seems to say that it may be possible, though not necessarily easy:

https://en.wikipedia.org/wiki/Bitcoin#Privacy

I hadn't heard of bitcoins before. If this virus turns out to have a large impact, I bet it will lend impetus to efforts to regulate the bitcoin business.
 
Friend who runs a PC shop says this isn't new, not even close. Everyone pays the ransom before they bring their machine into his shop, all giving out their credit card info, and none have ever gotten their data back. He's making a killing wiping and reloading Windows machines and teaching people what updates, anti-virus, and anti-malware are for, and recommending folks cancel that credit card.
 
The Snopes article that Henning posted says that people who pay are getting their data back.
 
zaitcev said:
Windows users are so cute, it brightens your day.
Click to expand...

Apple used to release security fixes for their older operating system versions. At the least, they'd release them for the version that came before their newest one. It doesn't look they are this time.

We all know what happens when a company reveals security holes don't we? Yes, that's right. We get zero day attacks: Lots and lots of zero day attacks. It's like giving every junior-high hacker in the world a free treasure map.

What's that? The Mac has no security problems? Please, ever hear of the Flashback Trojan? Icefog? Backdoor:OSX/KitM.A? You would have if you'd been paying attention to Apple security. They're all successful Mac malware programs.

No, Macs don't have the dozens of new malware attackers every month that Windows PCs have... yet. But then, we never had a major, widely used Mac OS without the latest security fixes either.​

http://www.zdnet.com/mavericks-the-end-of-macs-in-the-enterprise-7000022410/?s_cid=e539&ttag=e539
 
Palmpilot said:
The Snopes article that Henning posted says that people who pay are getting their data back.
Click to expand...
Things are moving fast, beyond that. The Government and big companies like Microsoft and Google are taking measures stop the virus, which involves the shutdown of their servers. So, if the de-cryption key isn't available, then you are stuck. Most antivirus programs are now able to detect and remove the virus, but may not prevent the initial infection. So, they catch it and disable the program, but not quick enough to stop the encryption. So you're stuck again. A movement is underway to use "DNS sinkholes" to stop the spread from server to server. 'Can't wait until these guys are caught and show up on the news.
 
CT4ME said:
Things are moving fast, beyond that. The Government and big companies like Microsoft and Google are taking measures stop the virus, which involves the shutdown of their servers. So, if the de-cryption key isn't available, then you are stuck. Most antivirus programs are now able to detect and remove the virus, but may not prevent the initial infection. So, they catch it and disable the program, but not quick enough to stop the encryption. So you're stuck again. A movement is underway to use "DNS sinkholes" to stop the spread from server to server. 'Can't wait until these guys are caught and show up on the news.
Click to expand...

I have a bet with an old boss who's now in the IT security biz, he thinks it's Russian Mafia, I think it's an online backup company.
 
Where's the NSA when you need them? As a show of good faith, they could release software to decrypt the files.
 
The reality is, there's no secure consumer grade OS available. The market hasn't demanded one. They can't afford the price tag.
 
I think I may have just been emailed this under the guise of 'I just deposited $32,000 in your bank account' with an HTML attachment.
 
denverpilot said:
Friend who runs a PC shop says this isn't new, not even close. Everyone pays the ransom before they bring their machine into his shop, all giving out their credit card info, and none have ever gotten their data back. He's making a killing wiping and reloading Windows machines and teaching people what updates, anti-virus, and anti-malware are for, and recommending folks cancel that credit card.
Click to expand...

Your friend is right. I fail to understand the hoopla. It's a new variation on ransomware that's been around for quite a while, mainly out of Russia.

Some of the older variations of the malware actually did encrypt the files, making it theoretically possible to recover them. There was a security company, also in Russia, of all places, that was decrypting them for free. However, I'm under the impression that most of the newer variations don't actually encrypt the files at all. They just destroy them. The purveyors want your credit card information, not your business.

-Rich
 
With this latest one, it sounds like one needs to somehow ensure that the backups are not accessible to the virus.
 
John221us said:
There is no substitute for regular backups. Pay me now or pay me later...
Click to expand...

For Windows machines, any recommendation for back up software? I know the external hard drives are cheep enough. And I do need to do a full back up and make a good image of the drive.
 
You want offsite backup. If you're robbed or the house burns down then an external hard drive isn't going to help.

I recommend carbonite. It's like $50 a year and backs up to their servers. You can access your data any time from any computer with an Internet connection. You sign up and it starts uploading. That first upload takes awhile depending on how much you have. After that it only backs up files that change.

Good luck.
 
Windows 7 came with a pretty good backup program. If you want an easy solution for your external hard drive, you've already got it. You just have to set it up.

If you want a third-party backup program, ShadowProtect is rated highly by PC Magazine. There are plenty of other choices, too.

Carbonite, as mentioned by Captain, is easy to use. I tried a competitor and dumped it when their servers went down during the hurricane a year ago.
 
Last edited:
Forgot to add machines are WinXP Pro
 
Captain said:
You want offsite backup. If you're robbed or the house burns down then an external hard drive isn't going to help.

I recommend carbonite. It's like $50 a year and backs up to their servers. You can access your data any time from any computer with an Internet connection. You sign up and it starts uploading. That first upload takes awhile depending on how much you have. After that it only backs up files that change.

Good luck.
Click to expand...

And the download to restore takes ten times as long on most asymmetric Internet services. Try it sometime. You'll be without the machine for a very long time.

Offsite is secondary to something onsite you can restore from before your next birthday rolls by.
 
denverpilot said:
And the download to restore takes ten times as long on most asymmetric Internet services. Try it sometime. You'll be without the machine for a very long time.

Offsite is secondary to something onsite you can restore from before your next birthday rolls by.
Click to expand...

This is true. Off site backup is good, but you still need a local copy. The built n Windows 7 utility will protect your data fine. Something like Acronis True Image will let you do a bare metal recovery (you don't have to install the OS first), which can save a bunch of time. If you depend on your computer for work, this is what I would recommend.


Sent from my iPad using Tapatalk HD
 
denverpilot said:
And the download to restore takes ten times as long on most asymmetric Internet services. Try it sometime. You'll be without the machine for a very long time.

Offsite is secondary to something onsite you can restore from before your next birthday rolls by.
Click to expand...

I've never done a complete restore, just individual files. I can say though, if my machine is stolen I don't really care how long the restore process is. I'd be happy to wait the day or so.
 
denverpilot said:
And the download to restore takes ten times as long on most asymmetric Internet services. Try it sometime. You'll be without the machine for a very long time.

Offsite is secondary to something onsite you can restore from before your next birthday rolls by.
Click to expand...

That's my position, as well.

I actually use a three-backup strategy, of which two are local and one is offsite.

The first is hard drive cloning or imaging. Personally, I prefer cloning using Casper because it eliminates the step of extracting the image. You just take out the failed or hosed drive and swap in the clone. It reduces downtime to minutes. (The downside to cloning is that you lose the ability to make incremental or differential backups. But hey, everything's in life is a trade-off. Pick the option that's best for you, or do both.)

The second is onsite backup of my documents, settings, email, downloaded programs, and so forth onto a NAS. Windows backup is a good option for this on Windows machines. There are a bazillion others, as well. This complements cloning rather well because you can use it as an incremental / differential option for your personal stuff, and reduce your cloning frequency to, say, weekly plus whenever you make system changes (installing new software, etc.).

The third prong is offsite backup. Presently I'm using Backblaze. It's not perfect: Downloading ZIP files is not the most elegant restore method I can think of. But all in all, Backblaze is as good as most solutions, and better than some.

Others I've tried included Mozy (initially decent, then became awful), Carbonite (too resource-hungry for my liking), and a few others over the years. Backblaze is the least intrusive and the most trouble-free, in my opinion, at this particular moment in time. Tomorrow that could change: That's the way this business goes. But for now, I like Backblaze.

In the interest of full disclosure, I also sell Backblaze. You can get a free trial (and also contribute to my avgas / mogas fund) here. Also in the interest of full disclosure, I'm also authorized to resell Carbonite and Mozy, but I don't. I don't like the former very much, and I think the latter is absolute garbage. I only sell stuff that I personally use, or at lease that I would use if I needed that particular stuff.

Note that I didn't mention RAID mirroring. That's because I really don't consider it a "backup" strategy so much as a downtime-prevention one. If you have any systemic problem other than a hard drive failure (infection, registry meltdown, etc.), RAID will dutifully copy it over to the whole array; so all you'll have is multiple hosed copies of your system. I don't even consider whether a machine is RAIDed or not when implementing backup. RAID is nice, but it's not backup.

I really don't have a whole lot of sympathy for people who don't do backup. It's both simple and cheap nowadays. So unless you have absolutely nothing of importance on your computer, there's really no excuse not to have a redundant backup strategy.

-Rich
 
I know ,lets have the company that launched Health care.gov fix this virus problem.
I'm sure they could handle it:wink2:
We live in a Obamanation.
 
RJM62 said:
That's my position, as well.

I actually use a three-backup strategy, of which two are local and one is offsite.

The first is hard drive cloning or imaging. Personally, I prefer cloning using Casper because it eliminates the step of extracting the image. You just take out the failed or hosed drive and swap in the clone. It reduces downtime to minutes. (The downside to cloning is that you lose the ability to make incremental or differential backups. But hey, everything's in life is a trade-off. Pick the option that's best for you, or do both.)

The second is onsite backup of my documents, settings, email, downloaded programs, and so forth onto a NAS. Windows backup is a good option for this on Windows machines. There are a bazillion others, as well. This complements cloning rather well because you can use it as an incremental / differential option for your personal stuff, and reduce your cloning frequency to, say, weekly plus whenever you make system changes (installing new software, etc.).

The third prong is offsite backup. Presently I'm using Backblaze. It's not perfect: Downloading ZIP files is not the most elegant restore method I can think of. But all in all, Backblaze is as good as most solutions, and better than some.

Others I've tried included Mozy (initially decent, then became awful), Carbonite (too resource-hungry for my liking), and a few others over the years. Backblaze is the least intrusive and the most trouble-free, in my opinion, at this particular moment in time. Tomorrow that could change: That's the way this business goes. But for now, I like Backblaze.

In the interest of full disclosure, I also sell Backblaze. You can get a free trial (and also contribute to my avgas / mogas fund) here. Also in the interest of full disclosure, I'm also authorized to resell Carbonite and Mozy, but I don't. I don't like the former very much, and I think the latter is absolute garbage. I only sell stuff that I personally use, or at lease that I would use if I needed that particular stuff.

Note that I didn't mention RAID mirroring. That's because I really don't consider it a "backup" strategy so much as a downtime-prevention one. If you have any systemic problem other than a hard drive failure (infection, registry meltdown, etc.), RAID will dutifully copy it over to the whole array; so all you'll have is multiple hosed copies of your system. I don't even consider whether a machine is RAIDed or not when implementing backup. RAID is nice, but it's not backup.

I really don't have a whole lot of sympathy for people who don't do backup. It's both simple and cheap nowadays. So unless you have absolutely nothing of importance on your computer, there's really no excuse not to have a redundant backup strategy.

-Rich
Click to expand...

Yea, all that....or buy a MAC and not have to worry.:rolleyes:
 
RJM62 said:
If you think you don't have to back up a Mac, you are mistaken. Macs don't crash often, but when they do, they crash with gusto.

-Rich
Click to expand...

Has Apple done anything to significantly reduce the rate at which hard disks fail?
 
You must log in or register to reply here.
Back
Top