Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

151–160 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#151

Post by marcosdumay »

haberman wrote: post #79

You could imagine the Bitcoin community deciding to blacklist any wallets to which funds like this were demanded and disbursed. That seems like a great idea until you then realize that this would be a way of denying anyone access to their own funds, by specifying their wallet as the recipient even though the attacker doesn't control it. There really doesn't seem to be any good countermeasure to this.

Or the police could just investigate the wallet, because it there is a feature that Bitcoin does not have, it's anonymity.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#152

Post by socillion »

jussij wrote: post #95
crb wrote: post #53

Earlier quoted context omitted.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

Google Chrome Updater certainly does have a few virus like characteristics. Every time my interent connection slows (WiFi) I know it's Chrome Updater so I kill it via Task Manager and everthing is good again. There doesn't apear to be away to turn it off inside Chrome itself and turning off updates via the registry does not seem to stop it.

You can try disabling (not deleting) the startup task. Start > Run > msconfig > Startup > Disable GoogleUpdater.exe

Or try Firefox!

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#153

Post by Silhouette »

fekberg wrote: post #106
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

Here's a command you can run to find out what executables exist in AppData: dir /S /P "%userprofile%\AppData\*.exe" > %userprofile%\Desktop\FoundFiles.txt

It's helpful to add /A (shows .exe files even if they have hidden/system attributes set) and maybe /B (bare format, just the path/filenames without all the header/footer information).

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#154

Post by mistercow »

waqf wrote: post #100
mistercow wrote: post #68

Earlier quoted context omitted.

The only virus I ever got was the SevenDust 666 virus on Mac OS 8. An infected machine would have a "666" extension that couldn't be deleted (it would instantly replace itself) and then start losing files. So losing files as a target has been around for many years. The interesting change to me is that now viruses have been effectively monetized.

Not such a new change, for it's been known since at least 1989: https://en.wikipedia.org/wiki/AIDS_(trojan_horse)

So in other words, nothing ever changes, everything has always been terrible.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#156

Post by marcosdumay »

abstractConcept wrote: post #137

Has anyone attempted to run this using Wine? As long as you keep all drives (/ or ~/) unmounted, I assume it would be `safe' to test it. Might be a simpler environment to analyze CryptoLocker in, as apposed to a full Windows install.

I'd try it in a virtual machine just in case.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#157

Post by j00lz »

marcosdumay wrote: post #150
susi22 wrote: post #12

In a corporate environment I'd expect crucial data to be on the network drive and snapshotted every few hours. We run ZFS on our network and all the secretaries have to do their doc/excel work on the drive. Nowadays that everybody has a Gigabit Ethernet connection read/writes are extremely quick. Use ZFS and make read only snapshots that are only accessible to the sysadmins. You'll solve many problems that way. We do…

In about any corporation you look, crucial data will be in a Windows server (no ZFS available, sorry), and backed up on intervals that are some integer multiple of 24 hours. Or, better, the above is the best case scenario that IT dreams of achieving some day. In practice, a huge share of the crucial data sits on people's machine, with no backups, and go on vacation every year.

Most corporate windows file servers (since 2003) use shadow copy, which saves previous versions of files every couple of hours. Any decent IT dept will use folder redirection, which redirects deskop, my documents to the local file server.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#158

Post by fekberg »

jonhohle wrote: post #149
fekberg wrote: post #147

I've been trying to raise awareness in my social medias, since my family, friends and co-workers might not spend time on HackerNews. If you want, copy my message and share with your family, friends and co-workers: "Hi folks, There's a new virus out there that I want to raise awareness of, it's called CryptoLocker. Basically what this virus does is that it tracks all your files - hard drives, flash drives, usb sticks,…

5. Consider alternatives to Windows so you won't have to deal with these silly things that have largely only been affecting Windows users for the last decade+.

Sure, I'll ask my 70+ year old relatives that have been using PC with Windows since they first got their computer to download an Ubuntu ISO, burn that and re-install their system.

Joking aside. I'd love for everyone to just jump on a virus free OS, but as soon as that OS is mainstream there will be viruses.

The problem isn't the OS, the problem is that people trust everything that is for instance sent to them via e-mail. Users need to be educated on security, no matter the OS.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#159

Post by elliottcarlson »

tempestn wrote: post #94
pavel_lishin wrote: post #52

Earlier quoted context omitted.

Would it actually help? Does the ransomware contact the servers prior to encrypting everything?

Even if it encrypts regardless, preventing the perpetrators from profiting will remove their incentive to keep spreading this stuff. Once antivirus catches up to the copies in the wild, the problem would be solved. Of course, whether it's actually possible to shut down enough servers to prevent them from profiting is another question. But it seems to me anything that makes it more difficult is a good thing, even thou…

This wouldn't really prevent them from profiting - an unsuspecting user could still pay the ransom, and then never receive a decryption key, so would be both out of the money and lose their data.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#160

Post by WiseWeasel »

samstave wrote: post #112
jussij wrote: post #95

Earlier quoted context omitted.

Google Chrome Updater certainly does have a few virus like characteristics. Every time my interent connection slows (WiFi) I know it's Chrome Updater so I kill it via Task Manager and everthing is good again. There doesn't apear to be away to turn it off inside Chrome itself and turning off updates via the registry does not seem to stop it.

> Google Chrome Updater certainly does have a few virus like characteristics. You could say it's in its DNA

Wouldn't it have to be in its RNA?

/ducks

Post reply on HN