Locky Virus

spud17

Just a heads up.
Friend/employer was going through his business emails on his home laptop, and opened one headed "This Invoice is Overdue".
He insists he didn't install or click anything, just opened it, saw it was rubbish and deleted it.
Luckily the laptop is only used for browsing from the sofa and nothing business related is stored on it.
The few photos and documents are now all encrypted with the file extension '.osiris'.

More,
https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-egyptian-mythology-with-the-osiris-extension/

AndyPix

spud17 wrote: »

He insists he didn't install or click anything, just opened it, saw it was rubbish and deleted it.

Always good to keep these kinds of threeats in the forefront of peoples minds.
However, your frind is telling you porkies.


He opened the loaded excel/word/pdf file that was attached and the resulting macro downloaded locky for him.


If you recieve any emails that you are not expecting, dont open the attachments or click the links.
They are very clever and convincing titles, like invoices, or missed deliver notices etc.


But they cant do anything unless you open the attachment/click the link


(Ok, some of them used to be able to using the preview function in outlook client, but not anymore)

spud17

AndyPix
I hear what you're saying, and I have to believe him.
According to the link, this is distributed via a macro in an Excel spreadsheet, the laptop in question has no Office software.
He is adamant that it was not a .pdf file.
It's going to be wiped and the latest Win 10 installed instead of the current mishmash of Windows 8.1/10.

Strider590

spud17 wrote: »

He insists he didn't install or click anything, just opened it, saw it was rubbish and deleted it.

This is why there is so much false information and paranoia about malware and viruses, people can't admit when they've ****ed up.

In this case the thing about Excel is somewhat false, all that macro would do is install the payload (possibly even via the internet), but virtually any script could be used to do that.

JJ_Egan

some can be unlocked .
https://www.nomoreransom.org/

AndyPix

spud17 wrote: »

AndyPix
I hear what you're saying, and I have to believe him.
According to the link, this is distributed via a macro in an Excel spreadsheet, the laptop in question has no Office software.
He is adamant that it was not a .pdf file.
It's going to be wiped and the latest Win 10 installed instead of the current mishmash of Windows 8.1/10.

The method of delivery varies greatly but ALWAYS requires some action on the email receivers behalf.
Whatever kind of file it is/was .. Your friend opened it .. Fact


Sometimes they are office documents, sometimes pdfs, sometimes they are even exe files with an icon to make it look like a pdf or excel sheet. They can be java scripts etc etc etc.


But they ALWAYS require the inquisitive user to open them

AndyPix

spud17 wrote: »

just opened it, saw it was rubbish and deleted it.

If he opened the email, how would he know the invoice was rubbish unless he opened it ?
If it was because of the sender etc then he wouldnt have needed to open the email to see that !!


As said above, people tend tro get a bit embarrases/defensive and insist things happened that are technically impossible to happen - Just smile and agree with him

Syman

is it possible your colleague had file preview enabled on his email client?

spud17

AndyPix wrote: »

If he opened the email, how would he know the invoice was rubbish unless he opened it ?
If it was because of the sender etc then he wouldnt have needed to open the email to see that !!


As said above, people tend tro get a bit embarrases/defensive and insist things happened that are technically impossible to happen - Just smile and agree with him

I didn't say he opened the invoice.
He opened the email, the text made him suspicious, he didn't open the attached 'invoice'.