I might be wrong, but while Kaspersky will remove the infection from a system it will not prevent it from being infected and it will not, of course, decrypt any affected files.
-KeithP
Microsoft Security Essentials definitely does not block this virus yet.
...reminds me to update to the most current version of kaspersky on my own computer...
I might be wrong, but while Kaspersky will remove the infection from a system it will not prevent it from being infected and it will not, of course, decrypt any affected files.
-KeithP
How do you become infected with CryptoLocker
This infection is typically spread through emails sent to company email addresses that pretend to be customer support related issues from Fedex, UPS, DHS, etc. These emails would contain a zip attachment that when opened would infect the computer.
These zip files contain executables that are disguised as PDF files as they have a PDF icon and are typically named something like FORM_101513.exe or FORM_101513.pdf.exe. Since Microsoft does not show extensions by default, they look like normal PDF files and people open them.
How to prevent your computer from becoming infected by CryptoLocker
You can use the Windows Group or Local Policy Editor to create Software Restriction Policies that block executables from running when they are located in specific paths. For more information on how to configure Software Restriction Policies, please see these articles from MS:
http://support.microsoft.com/kb/310791
http://technet.microsoft.com/en-us/library/cc786941(v=ws.10).aspx
The file paths that have been used by this infection and its droppers are:
C:\Users\<User>\AppData\Local\<random>.exe (Vista/7/8)
C:\Users\<User>\AppData\Local\<random>.exe (Vista/7/8)
C:\Documents and Settings\<User>\Application Data\<random>.exe (XP)
C:\Documents and Settings\<User>\Local Application Data\<random>.exe (XP)
In order to block the CryptoLocker and Zbot infections you want to create Path Rules so that they are not allowed to execute. To create these Software Restriction Policies, you can either use the CryptoPrevent tool or add the policies manually. Both methods are described below.
Thanks everyone for posting the SRP info and other details.
So if I enable SRP as a local policy on my workstation, how can I test it out to see if it is working as expected?
Also the SHA hash is provided for the file so you can check that way to make sure the download you get is the one the author
wrote.
Weird - I tried downloading the QuickHash tool from their site
and Avast alerted on it
URL: http://www.foolishit.com/download/quickhash/|QuickHa...
Infection: Win32:Evo-gen [Susp]
Avast has been oversensitive in the past and it could be a false positive
Has anyone else get an alert on it?
Bad A/V
Anti-Virus software isn’t just a pain in the ass for PC users and techs alike, but it can also cause major headaches for small developers. Compound aggressive and sloppy heuristics with the fact that my software in particular is very powerful and has many capabilities – for both good and evil so to speak – and you can easily realize that my software is a natural target for many A/V engines.
If you are receiving a detection, I encourage you to fill out a false positive submission with the vendor, via the software if possible or the website if not. Likewise I will do the same – in some cases an A/V vendor will have a special submission form for software developers. The more people we get filing false positives, the better the odds are of getting these detections removed/whitelisted. Below is a list of A/V vendors / links to their false positive submission forms:
Avast (email only)
AVG (20MB file limit, else use this email and compress it with a password.)
Avira (or this email)
Bitdefender (or this email)
ClamAV (or this email; uses Immunet Protect definitions)
Comodo (or this email)
Emsisoft (email only)
Kaspersky (or this email)
McAfee (email only)
Microsoft Security Essentials (or this email – good luck – major waste of time!)
NOD32 (email only)
Panda (or this email)
Sophos (or this email)
Symantec
Trend Micro
Vipre (or this email)
IF your product is not listed here, a more comprehensive list with links is available on techsupportalert.com here.
If you need to report a new detection to me, please use the contact form below. I will need details on the specific A/V and definitions version, and which components were detected and under what detection name, in order to successfully submit false positive reports with the vendor. If you do not have them, then please do NOT submit this form until you do. Note also that it is critical to report the A/V brand, version and definitions version, and detection name given — the A/V vendors ALWAYS ask for this information and rarely help if you don’t have it.
That's really good to know, thank you!I just go with full-blown SRP, fully audited to eliminate all loopholes. For my environments (home and SOHO), that works with just a few gotchas. Both Steam and Origin won't work with their loopholes closed, unless I elevate them to run when I want them to run. While that's not ideal, in that it hands them more privilege than I'd like, it's my solution for now.
Those interested in setting up SRP and closing the remaining loopholes, here ya go: http://www.mechbgon.com/srp If you use a Home version of Windows, you won't have a Local Group Policy and will have to settle for Family Safety whitelisting with a Standard User account.
Tangentially, set your UAC to "Always Notify" to eliminate an escalation-of-privilege issue that might be used against you. ZeroAccess was known for using it.
As geeks we're automatically suspicious of e-mail links and attachments but we can't protect laymen from themselves LOL It seems like the cases of infection I've dealt with have come through those fake e-mails from the USPS or Fedex.So far the only protection I rely on is NoScript for Firefox and Pale Moon, Bitdefender, updating plugins and not clicking on E-mails with attachments I know are suspect.
The question is, do anti-virus programs detect Cryptolocker before it encrypts your computer? Surly you would see some activity on your computer if Cryptolocker were to start encrypting your HDD.
Oh, one more protection. Comodo's firewall and it's defense shield.
edit- Actually there is a small tool that is specifically designed to look for the behavior of CL and runs nicely alongside any AV: HitmanPro.Alert with Cryptoguard.