Cryptowall Infection - Stuck now, any help ?

Somerset

poppellerant wrote: »

From what I've heard of Cryptowall, I wouldn't give a second thought about completely formatting the drive and reinstalling the OS. I would never trust a computer after that's been on it. :eek:

If it happens again, I will. I think I've got rid of the virus itself but time will tell. I'll have to get what I saved backed up sharpish.

bluesnake

Somerset wrote: »

Same story with my crypto, encrypted into a new file then deleted the original'. I was looking at restore packages tonight, nothing looked like it would work. Looked at utube stuff/websites - nobody had a fix for corrupted documents. I'll have a look at exewatch tomorrow, cheers.

You will probably not get back the encrypted files without £.

That exewatch needs a directory to be installed into a directory to which it can write to, rather than c:\program files\ otherwise it will not keep 'open history' and may stop working but still show as ok

Providing that nothing has overwitten them, the working but deleted files should still be on the disk I would try the free Recuva in advanced mode, you have nothing to loose any more and and use the surface scan??? mode for another pass.

Name and shame - Which a/v were you using and how did it get in?

securityguy

I find it absolutely amazing that after twenty years of the regular availability of computers in households there are still people who don't have daily backups.

forgotmyname

Daily backups on a home PC?

Where do i back my 4 TB? Another 4TB? How long will that take and doing that daily will shorten the drives life by how much?

JJ_Egan

securityguy wrote: »

I find it absolutely amazing that after twenty years of the regular availability of computers in households there are still people who don't have daily backups.

What for 3 emails and 4 facebook messages you need a daily backup .

Roland_Sausage

forgotmyname wrote: »

Daily backups on a home PC?

Where do i back my 4 TB? Another 4TB? How long will that take and doing that daily will shorten the drives life by how much?

That is why you get incremental backups.

Somerset

bluesnake wrote: »

Name and shame - Which a/v were you using and how did it get in?

a/v was avast free. No idea how it got in, must be website browsing as I'm not daft enough to open unsolicited e-mail attachments.


From what I read crypto can sit on your pc for a few days, maybe up to a week before it activates. I run ccleaner a few times a day and I'm pretty sure I ran malwarebytes two days before this appeared. Neither spotted anything untoward.

Fightsback

Somerset wrote: »

a/v was avast free. No idea how it got in, must be website browsing as I'm not daft enough to open unsolicited e-mail attachments.


From what I read crypto can sit on your pc for a few days, maybe up to a week before it activates. I run ccleaner a few times a day and I'm pretty sure I ran malwarebytes two days before this appeared. Neither spotted anything untoward.

Something that you can do to help yourself to be less vulnerable in the future is running as a standard user as opposed to full administrator login, it mitigates about 90% of remote code vulnerabilities. This has zero cost and a slight inconvenience factor but well worth the effort, it's not going to protect you 100% but anything you can do to strengthen the security for free isn't to be sneezed at.

http://www.zdnet.com/article/admin-rights-key-to-mitigating-vulnerabilities-study-shows/

Malware writers are in the business of not having their wares detected.

securityguy

forgotmyname wrote: »

Daily backups on a home PC?

Where do i back my 4 TB? Another 4TB? How long will that take and doing that daily will shorten the drives life by how much?

Incremental backups, obviously. And that nice mr crash plan will do it for you, either locally or remotely. I have hourly backups from all my machines.

bluesnake

Somerset wrote: »

a/v was avast free. No idea how it got in, must be website browsing as I'm not daft enough to open unsolicited e-mail attachments.


From what I read crypto can sit on your pc for a few days, maybe up to a week before it activates. I run ccleaner a few times a day and I'm pretty sure I ran malwarebytes two days before this appeared. Neither spotted anything untoward.

Some a/v companies do not seem to push update as fast as one would wish.

Crypto creators keep modifying it, so the signature always changes and the file names created change too, making it virtually impossible for av companies to detect via traditional methods, no matter how much you scan. For work, mitigation rather than detection was the answer.

One of our other ones was a pdf of some description that got downloaded via the web.

Another workable way is to download Virtual PC and run your system in that and on a monthly basis you could consolidate or remove snapshots.

If you do not trust 'the cloud' then DriveImage XML is free for home use, and is very good.