Summing Up CryptoLocker.

After a month, the news of the CryptoLocker ransomware has finally hit the mainstream media. Leaving me questioning where they have been.

I was one of the first to report on it, and as far as I can tell, the first independent blogger to report on it.

Unfortunately, along with the mainstream coverage of this ransomware comes quite a bit of dangerous misinformation. This blog post will attempt to gather the truth about what we know in order to help those infected.

Infection:

As of now, the infection seems to be spreading through email. In the office, this email may claim to have a new protocol that needs to be looked at. At home, it may claim to be from Fedex or UPS. This email claims that you have a package waiting for you and you need to print out a receipt to claim it.

In either case, the attachment is a zipped up executable that contains the ransomware. You go to unzip it and read the "document" when all of a sudden, CryptoLocker pops up.

At this point, you are now infected. There's no going back from here. Your files are encrypted.


Encryption:

CryptoLocker does not lie when it says it encrypts your files. It encrypts files with RSA 2048 bit encryption. Which is a very safe encryption that has never been broken and likely will not be for at least another 10 years.

This means that you cannot decrypt the files.

Recovery of Files:

If you do pay the ransom, the program does actually decrypt your files. And while I would not advocate paying the ransom, it may be needed if you have exhausted all other alternatives. You know you are just encouraging the writers to keep making ransomware, but your files might be worth more to you then the $300 it demands.

Another way is with a program called Shadow Explorer. This program finds Shadow Copies of your files that are saved at System Restore points.

The bad news is that it only works with Computers running Windows XP with the second service pack installed or higher. With the exception of the home oriented editions of Windows Vista. And Windows 8 does not have it enabled by default.

So, if you run Windows 8, you may want to make a change in case you do get infected.

You can find how to activate File History here:

http://windows.microsoft.com/en-us/windows-8/how-use-file-history

http://windows.microsoft.com/en-us/windows-8/set-drive-file-history

Removal:

Recovering the encrypted files may be the hard part, but removing the actual ransomware is easy. Although you should not do this unless you know you have Shadow Copies of the encrypted files that you can get. For your convenience, the guide below deals with removal including recovering your files.

Step 1: Download Shadow Explorer here: http://www.shadowexplorer.com/downloads.html

Step 2: Run the executable and install Shadow Explorer.

Step 3: Select the disk name and time you wish to restore from. This time should be before the infection took place.

Step 4: Right click on a folder and click export. You will then be asked where you want to export to. Export to a convenient location for you.

Step 5: Repeat step 4 until all folders and files have been restored.

Step 6: Download and install MalwareBytes Anti-Malware from here: http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button

Step 7: Once you have installed MalwareBytes Anti-Malware, run a full scan. This scan will take some time, most likely over an hour depending on how much you have on your computer. So I suggest you do something else while remaining in close distance to the computer to that you can check on the scan every 15 minutes.

Step 8: Once the scan is finished, you will be alerted that malware was found. Please click OK on this message box to view the infections.

Step 9: If an infection is not checked, leave it alone. These are PUPs and are not harmful.

Step 10: Click on remove selected and allow it to restart your computer when prompted.

Step 11: Your computer should now be free of the CryptoLocker ransomware.

Please note that this removal guide might not work in some cases. If this is the case, you may be forced to reinstall the ransomware via the link given on the desktop wallpaper it sets. Once you have done this, you have no option remaining but to pay the ransom via the following ways:

GreenDot MoneyPak

Bitcoin

Ukash

For info on how to prevent yourself from getting infected with CryptoLocker, please read this blog post: http://www.malwareaware.com/2013/10/cryptolocker-prevention.html

Thank you for reading. Feel free to comment if you have any questions or comments.

Read More

CryptoLocker Prevention.

It's been some time since I last wrote about the ransomware called CryptoLocker. A piece of ransomware that actually encrypts your files so that you cannot access them without paying the ransom.

Fortunately, a utility has been written by FoolishIT which will set up software restriction policies on Windows. These restriction policies will prevent the execution of CryptoLocker. And they will also prevent the execution of the now included Zbot Trojan.

What follows is a step by step guide to setting the restriction policies up using the utility.

Step #1: Download the utility here: http://www.foolishit.com/download/cryptoprevent/

Step #2: Make sure that the open with Windows Explorer option is selected and then click on the Open button.

Step #3: Somewhere at the top of the Windows Explorer window, you should see an option to extract all files. Choose that option and extract the files to the folder.

Step #4: Double click CryptoPrevent.exe to execute the utility.

Step #5: On the screen that just popped up, press OK.

Step #6: On the new screen, make sure all checkboxes are checked.

Step #7: Click on the Block button. This shall set up the restriction policies which will prevent the execution of CryptoLocker.

Step #8: To make sure it worked, click on the Test button. It will return with either success or failure. Success means that the included test executable was able to get through. Failure means that it was blocked.


If you find that the restriction causes issues with some of your applications, you can go back to the utility and click on the Undo button to remove the changes. After you are done with that application, you can go back and click on the Block button again to set up the restrictions again.

Please note that this utility merely prevents you from getting infected. It does no good if you are already infected.

For more info about the utility, please visit this website: http://www.foolishit.com/vb6-projects/cryptoprevent/

Thank you for reading. Feel free to comment if you have any questions or comments.

Read More

How to remove the Cyber Command of New York Ransomware.

Alright, there's a new piece of ransomware making the rounds. It's called the Cyber Command of New York Ransomware.

This ransomware is a variant of the infamous Reveton ransomware, also known as the FBI MoneyPak Ransomware.

The following is a removal guide for this ransomware.

Step 1: Get a flash drive that can store at least 32 MB

Step 2: On an uninfected computer, go to http://www.bleepingcomputer.com/download/hitmanpro/ and download the bit version corresponding to the bit type of the uninfected computer.

Step 3: Once the file has been downloaded, insert the flash drive you are going to use.

Step 4: Run the downloaded file.

Step 5: Once you see the start screen of Hitman Pro, click on the little picture of a person preforming a kick at the bottom of the window.

Step 6: You will now see instructions on how to create the Kickstarter Live USB. Click on the flash drive you will be using, then press install kickstart. You will then be presented with a warning that the flash drive will be erased. Click on yes to continue.

Step 7: Once the files have been downloaded and installed onto the flash drive, click the close button and take out the flash drive.

Step 8: Insert the flash drive into the infected computer with the computer turned off. Turn it on and then look for info on how to access the boot menu. If you cannot see any info, keys commonly used for the boot menu are F8, F11, or F12.

Step 9: Restart your computer and start tapping the indicated key. If one key does not work restart the computer and try another key on the above list.

Step 10: Now, select the flash drive with the Kickstart program installed and press enter. Once you see the new screen, press 1.

Step 11: Windows will load normally. After you log in, you will see the ransomware. Wait 15-20 seconds and you will see the Hitman Pro start screen. Click next to start the scanning process.

Step 12: Click No, I only want to perform a one-time scan to check this computer. Then click next.

Step 13: Once Hitman Pro has finished scanning, it will display a list of malware that it found. Click next, and if prompted, choose the 30 day free trial. Hitman Pro will now reboot your computer. Once it boots up, it will be free of the ransomware.

Read More

How to remove Antimalware (Rogue)

There is a new rogue antivirus program making the rounds on the internet. It's name is Antimalware. Original name, right?

For those of you who do not know, a rogue antivirus program is a piece of malware that pretends to be an antivirus program. It then scans your computer and detects threats that are not actually on your computer. It is just trying to make you purchase it.

A removal guide follows:

Step #1: Reboot your computer into safe mode with networking. To do this, turn the computer off and turn it back on. Immediately after you press the power button to turn the computer back on, press the F8 key on your keyboard repeatedly until you come to a menu that gives you options such as Safe Mode. Use the arrow keys on your keyboard to select Safe Mode With Networking.

Step #2: To make sure that the rogue will not interfere with removal, we must run Rkill. Download iExplore.exe here: http://www.bleepingcomputer.com/download/rkill/

Step #3: Run the downloaded executable. It will open a black box, this is normal. Once the black box has closed on its own, proceed to step 4.

Step #4: Download Malwarebytes Anti-Malware from here: http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/

Step #5: Run the downloaded installer and install Malwarebytes Anti-Malware.

Step #6: Once the program is installed, it will automatically open a window. Once this window is open, click Perform Full Scan, and then click the scan button.

Step #7: As this scan will take some time, I suggest you do something else while remaining in close proximity to the computer so you can check on the scan every once in a while. Once the scan is complete, proceed to step 8.

Step #8: When the scan is complete, it will open a message box. Click OK, and then click show results.

Step #9: Click Remove Selected. If Malwarebytes prompts you to restart your computer, please allow it to do so.

Step #10: Enjoy your computer which should now be free of Antimalware.

Read More

How to remove Security Cleaner Pro (Rogue)

There is a new rogue antivirus program making the rounds on the internet. It's called Security Cleaner Pro.

For those of you who do not know, rogue antivirus software is a piece of software that attempts to scare you into buying it by claiming that you computer is infected with malware. The malware it claims is on your computer is not on your computer.

What follows is a removal guide for this rogue antivirus.

Step #1: Reboot your computer into safe mode with networking. To do this, turn the computer off and turn it back on. Immediately after you press the power button to turn the computer back on, press the F8 key on your keyboard repeatedly until you come to a menu that gives you options such as Safe Mode. Use the arrow keys on your keyboard to select Safe Mode With Networking.

Step #2: To make sure that the rogue will not interfere with removal, we must run Rkill. Download iExplore.exe here: http://www.bleepingcomputer.com/download/rkill/

Step #3: Run the downloaded executable. It will open a black box, this is normal. Once the black box has closed on its own, proceed to step 4.

Step #4: Download Malwarebytes Anti-Malware from here: http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/

Step #5: Run the downloaded installer and install Malwarebytes Anti-Malware.

Step #6: Once the program is installed, it will automatically open a window. Once this window is open, click Perform Full Scan, and then click the scan button.

Step #7: As this scan will take some time, I suggest you do something else while remaining in close proximity to the computer so you can check on the scan every once in a while. Once the scan is complete, proceed to step 8.

Step #8: When the scan is complete, it will open a message box. Click OK, and then click show results.

Step #9: Click Remove Selected. If Malwarebytes prompts you to restart your computer, please allow it to do so.

Step #10: Enjoy your computer which should now be free of Security Cleaner Pro.

Read More