Cryptolocker virus

50Twuncle

Johnmcl7 wrote: »

The news outlets have been very slow in picking this up as this malware has been in the wild for over two months now. The following topic is a very good source of information on the malware:

http://www.bleepingcomputer.com/forums/t/506924/cryptolocker-hijack-program/

The e-mail format has changed a few times, so far the fake mails have been US orientated or very general. The current mails are using an encrypted zip file (with the password in the mail body) in an attempt to bypass AV scanners:

http://www.bleepingcomputer.com/forums/t/506924/cryptolocker-hijack-program/?p=3210453

I'm surprised the malware has managed to spread as far as it has as I've found mail systems to be very restrictive on sending exes, even within an encrypted zip file but it appears some companies do allow zips and exes.

The worrying part is that this is only the first wave, the current virus is relatively straightforward in that it relies on the user executing the file within the attachment and it runs from the user profile only requiring write access to the files to encrypt them. With the success it's had it's likely it become more advanced and start using browser exploits or unpatched windows vulnerabilities to spread itself.

John

Am I correct in thinking that they only come in attachments - rather than the main body of an email - so as long as you don't open the attachment - you are safe ?

GunJack

50Twuncle wrote: »

Am I correct in thinking that they only come in attachments - rather than the main body of an email - so as long as you don't open the attachment - you are safe ?

for the time being, probably.... the trouble is the rate of evolution of these things....