Support NeoGAF

[Coreda]

I wonder, if this thing gets into your Dropbox folder and Dropbox syncs all those files, are all your files on Dropbox fucked as well?
(Or any other cloud service, for that matter).

You need versioning to stay safe, that way you can roll back to known good files. Ideally you'd also want an offline backup, as this malware only encrypts the documents it can see through your computer network.

People will be fine if they don't open attachments in seemingly legit emails, and (so it seems from reading here) keeping your AV up to date.

I imagine the malware will find new ways to spread, so that's not the last thing you'll need to keep clean, but it's a good start.

 

[wandering goat]

Yup, this is pretty hardcore. I work at a computer place and we had some clients get this. Unlike the vast majority of infections we see, there's really not much you can do here at the moment except for either restore from a back-up if you have one or pay the price (in bitcoins of course). It's a killer when it hits a major system and they don't have a back-up. The situations we've seen so far came from opening email attachments.

 

[speculawyer]

Holy shit. There should be a nasty prison sentence for that.

 

[G-Fex]

sounds like I better get Avast Free.

Guess MSE won't cut it alone

 

[j_k_redtail]

Damn. Thats terrifying. So what sort of stuff should one look out for? What might be the main sources of such a malware. At this point I'm afraid to google.

Watch where you browse, and don't open attachments you're not expecting.

Turn on file extensions. These guys have been known to hide viruses by sending files like "Resume.pdf.exe". They can assign the PDF icon to the executable, and windows will hide the real file extension (.exe) by default.

 

[Branduil]

Someone should make a way for you to get $300 worth of bitcoins for free if you can prove you're infected with this.

 

[firehawk12]

Damn. Thats terrifying. So what sort of stuff should one look out for? What might be the main sources of such a malware. At this point I'm afraid to google.

Pretty much anything illegal, really.
I suppose the real fear would be someone inserting this malware into a big public site that everyone accesses, like Google or a government website or something.

I assume it would be impossible, but the damage would be tremendous.

 

[Nilaul]

Holy shit. There should be a nasty prison sentence for that.

This guy probably has so much money that he can dissapear and do whatever he wants.

 

[Amikami]

Yup, this is pretty hardcore. I work at a computer place and we had some clients get this. Unlike the vast majority of infections we see, there's really not much you can do here at the moment except for either restore from a back-up if you have one or pay the price (in bitcoins of course). It's a killer when it hits a major system and they don't have a back-up. The situations we've seen so far came from opening email attachments.

What kinds of emails if that can be answered? I'm curious to know in what form this monster comes in. Is it apparent junkmail?

 

[Sophia]

Watch where you browse, and don't open attachments you're not expecting.

Turn on file extensions. These guys have been known to hide viruses by sending files like "Resume.pdf.exe". They can assign the PDF icon to the executable, and windows will hide the real file extension (.exe) by default.

It's amazing that something like that in Windows is enabled by default. It causes so many problems for layman users. ><;

Some of avast's default settings are downright obnoxious (no I don't need my Antivirus to SPEAK to me), but it beats getting infected.

 

[Daingurse]

Damn, thats no game!

 

[Darkmakaimura]

So Malwarebytes Anti-Malware Free version isn't going to help. You need the paid version?

 

[Nilaul]

sounds like I better get Avast Free.

Guess MSE won't cut it alone

More like Avast internet security, you can stream a single movie or a flash advert and get screwed.

There was another similar virus pretending that it is a government anti-piracy organisation which remotely locked up your computer for illegal activities until your paid your fee. It happened to a few of my friends when they streamed movies online.

 

[Timedog]

Right now someone that has this is backing up their files and the files on their external harddrive are being encrypted.

 

[Sophia]

So Malwarebytes Anti-Malware Free version isn't going to help. You need the paid version?

The free version does not actively protect your PC. It only scans it when you request. By the time you knew you were compromised, you'd be too late.

 

[firehawk12]

It's amazing that something like that in Windows is enabled by default. It causes so many problems for layman users. ><;

Because people are too dumb to understand extensions and rely on the icons to tell them what a file is.

 

[Darkmakaimura]

The free version does not actively protect your PC. It only scans it when you request. By the time you knew you were compromised, you'd be too late.

Damn I've had Malwarebytes because so many people here on GAF recommended it a few years back. Should I go Avast now or stick to MB?

 

[Sophia]

Damn I've had Malwarebytes because so many people here on GAF recommended it a few years back? Should I go Avast now or stick to MB?

I use both free versions of avast! and Malwarebytes actually. Even if you don't have the paid version, Malwarebytes is an absolutely amazing security tool for the average user. Everyone should have it, really.

Avast! can actively block stuff, and Malwarebytes can remove the nasties that avast can't get to.

 

[BigJonsson]

What about AVG free?

 

[j_k_redtail]

What kinds of emails if that can be answered? I'm curious to know in what form this monster comes in. Is it apparent junkmail?

Reports state that the emails often mimic notifications from UPS, FedEx, XeroxWorkCentre ("scanned document"), banks, and the like. They do come in popups too - in some of the seeder parts of the web.

 

[Coreda]

This guy probably has so much money that he can dissapear and do whatever he wants.

I've heard 5 million dollars a year is not unheard of for successful ransomware.

What kinds of emails if that can be answered? I'm curious to know in what form this monster comes in. Is it apparent junkmail?

Apparently they're disguised in phishing emails, that is emails that appear to be from legitimate sources.

Hear a great explanation of CryptoLocker on Security Now #427:

- Youtube link (with background on such malware)
- Youtube link (straight to the story)

 

[mugurumakensei]

What kinds of emails if that can be answered? I'm curious to know in what form this monster comes in. Is it apparent junkmail?

A co-worker got infected by an infected file from one of our clients.

 

[Darkmakaimura]

I use both free versions of avast! and Malwarebytes actually. Even if you don't have the paid version, Malwarebytes is an absolutely amazing security tool for the average user. Everyone should have it, really.

Avast! can actively block stuff, and Malwarebytes can remove the nasties that avast can't get to.

Okay, wasn't aware I could run two of these types of programs. I know you could only run one anti-virus software on a PC at a time but I guess it's different with anti-malware?

Edit: Oh, I see.... Avast is anti-virus. I'm currently using MSE with Malwarebytes. So keep MSE or go Avast now....

 

[golem]

I dread the day my parents catch this.. And i know they will. I should just buy them all Macs

 

[Chris R]

At least this is just ransomware and not scareware as well. I've seen a bunch of people who freak the fuck out when they get the FBI Paypack one swearing up and down they've never looked at kiddie porn and have NO idea how that got on their computer.

 

[Sophia]

I dread the day my parents catch this.. And i know they will. I should just buy them all Macs

Yeah, tell me about it. I'm not at any risk myself, but I'm worried my stepdad, in his infinite foolishness, will get infected. In which case he'll have no choice but to reformat.

At least this is just ransomware and not scareware as well. I've seen a bunch of people who freak the fuck out when they get the FBI Paypack one swearing up and down they've never looked at kiddie porn and have NO idea how that got on their computer.

Give it time. I bet eventually a scareware version will appear too. It just seems like a logical step.

 

[Ifrit]

Sounds scary

 

[phosphor112]

Wow, what a bunch of fuckers.

 

[Amikami]

Watch where you browse, and don't open attachments you're not expecting.

Turn on file extensions. These guys have been known to hide viruses by sending files like "Resume.pdf.exe". They can assign the PDF icon to the executable, and windows will hide the real file extension (.exe) by default.

Pretty much anything illegal, really.
I suppose the real fear would be someone inserting this malware into a big public site that everyone accesses, like Google or a government website or something.

I assume it would be impossible, but the damage would be tremendous.

Reports state that the emails often mimic notifications from UPS, FedEx, XeroxWorkCentre ("scanned document"), banks, and the like. They do come in popups too - in some of the seeder parts of the web.

Apparently they're disguised in phishing emails, that is emails that appear to be from legitimate sources.

Hear a great explanation of CryptoLocker on Security Now #427:

- Youtube link (with background on such malware)
- Youtube link (straight to the story)

A co-worker got infected by an infected file from one of our clients.

Thanks all for the responses, and will watch those links there. Man this is horrible.

 

[Camp Lo]

I had one on an old laptop.

It used the laptop camera, had some weird fbi logo and shit on it. Looked pretty crazy.

 

[ghst]

clever girl.

 

[williamsan]

What the hell? Rage inducing stuff. Thanks for the warning, OP. I've got my shit backed up on an external, but after reading this thread I feel that isn't going to cut it anymore.

 

[golem]

I had one on an old laptop.

It used the laptop camera, had some weird fbi logo and shit on it. Looked pretty crazy.

Yea my parents got that. Good thing they didnt pay

 

[criesofthepast]

Sad these dickheads are getting fucking rich off this and no one can do a damn thing about it.

 

[border]

Yeah, I got a virus like this once -- the FBI Moneypak virus.

When you start your computer an FBI logo and warning screen pops up, saying that your computer has been flagged by the FBI for trying to access illegal porn or bestiality porn. It demands that you pay an FBI "fine" using Moneypak. You can't bypass the screen at all. You are completely locked out from using the PC to do anything.

I went crazy trying to get rid of it before my girlfriend got home, because there's no way she would buy the "It's actually a virus" explanation, and would probably believe I'd been looking at all kinds of sicko stuff. I wonder how many relationships that virus ruined. I guess that was the idea of it -- to make people think "I'd better pay this ransom fast before my wife/GF sees it!"

Anyhow, I'm sure I got it from some weird Javascript pop-up on a"gentleman's streaming website" (whose letters rearranged spell xxnx), so don't think it can't happen to you just because you don't click on strange emails or authorize web pages to install shit on your PC. I clicked on no e-mails, did not say "Yes" to running any executables or installations.

 

[Keyouta]

running two AV software just in case

Don't run two at once. Choose one, stick with it.

 

[BigJonsson]

So those phishing e-mails actually get people?

 

[G-Fex]

More like Avast internet security, you can stream a single movie or a flash advert and get screwed.

There was another similar virus pretending that it is a government anti-piracy organisation which remotely locked up your computer for illegal activities until your paid your fee. It happened to a few of my friends when they streamed movies online.

cool thanks man. I just bought a years worth of Avast Internet Security

 

[i_am_ben]

horrifying

 

[Camp Lo]

Yea my parents got that. Good thing they didnt pay

Yeah, there was no way I'd pay. Took me a bit to realize I could safemode and go back on a previously saved state. It was nerve-wrecking though

 

[Sophia]

Don't run two at once. Choose one, stick with it.

Yes, running two actual antiviruses at the same time is generally a bad idea, as they'll interfere with each other.

So those phishing e-mails actually get people?

You would be surprised at how crafty these emails can be. The average layman computer user can easily be tricked into thinking its a legit email, allowing web content to be displayed for that particular email, and suddenly they're compromised.

Or you can be like my stepdad, and look at porn without using software such as NoScript to disable things at a domain level. Or install Screensavers thinking they're entirely trustworthy... the list goes on really.

 

[Dai101]

running two AV software just in case

This is just not only stupid but counterproductive. Never run 2 AV's software at the same time. And no, Malwarebytes AM is not an AV program per se.

Damn I've had Malwarebytes because so many people here on GAF recommended it a few years back. Should I go Avast now or stick to MB?

Usually MSE + MB is enough, but this time it seems like the paid version of MB is better than just one AV. Glad i have mine.

 

[User 100115]

Thanks for the heads up, I am watching this one like a hawk.

 

[freenudemacusers]

ugh, I need to call my wife's parents. I just cleaned out an ungodly amount of malware from their system a couple weeks ago. They are like prime targets for this shit.

 

[Coreda]

So those phishing e-mails actually get people?

Well, there was semi-recently the famous case of RSA - the inventors of public key cryptography ffs - having their network infiltrated and their entire database of master keys for their one-time password system stolen. All from a spearphishing email a receptionist opened.

 

[Piano]

Shit I haven't gotten a virus in years and have never paid for AV software...
...but I've got to say this is so malicious that it has me contemplating buying the Pro version of Malware Bytes.

Is it worth $25?

 

[teh_pwn]

It's too good. Whoever created this is over-reaching, will get caught and put in bars.

I'm going to make my Sandy Bridge desktop into an Ubuntu file server that crontab's a script to archive stuff and unmount the volume, and then only is used periodically.

 

[Dai101]

...but I've got to say this is so malicious that it has me contemplating buying the Pro version of Malware Bytes.

Is it worth $25?

I'll say YES. The real time protection it has is better than most AV's.

 

[j_k_redtail]

Shit I haven't gotten a virus in years and have never paid for AV software...
...but I've got to say this is so malicious that it has me contemplating buying the Pro version of Malware Bytes.

Is it worth $25?

Depends on how much your data is worth to you.

Remember: this is only going to get worse.

 

[BlackJace]

On a side note, I find the subject of cyber security really fascinating. Almost went to school for it.