Ramblings of an old Doc
Published on April 23, 2016 By DrJBHL In Personal Computing

 

The Windows Club has published a pretty extensive list of tools to help you if you get zapped. First of all, it’ll probably be Petya or Locky as they’re the most common ones encountered currently. First you have to identify the malware. You upload the ransom note or a file which has been encrypted by the malware (and hope it identifies the malware) here: https://id-ransomware.malwarehunterteam.com/index.php

There’s a great list of the tools here: http://www.thewindowsclub.com/list-ransomware-decryptor-tools and each tool is specific to the malware identified, so…step one is very important.

There are also several intrusion detection tools, but according to the Windows Club, WinPatrol is free and probably the best. You can read about it at the linked url.

There are also free anti-Ransomware tools. I've written about one, but there are several, and you can read about (and get links to them) here: http://www.thewindowsclub.com/free-anti-ransomware-tools 

Probably another article to read to help you get organized about what you should do if you get attacked is located here: http://www.thewindowsclub.com/what-to-do-after-ransomware-attack

The most important thing to is have recent backups, so don't be lazy: Make one now. The only backup you'll ever regret making is the one you didn't make.

Hope this helps in case you get hit. I’ve bookmarked the links above…and you might consider doing the same.

Have a great weekend!

Sources:

http://www.thewindowsclub.com/list-ransomware-decryptor-tools 

https://www.winpatrol.com/ 

http://www.thewindowsclub.com/free-anti-ransomware-tools

 

 

 

 


Comments (Page 1)
3 Pages1 2 3 
on Apr 23, 2016

Doc -

I bought the 5-PC license for WinAntiRansomPlus and I'm running it alongside BitDefender AntiRansomware and MWB AntiRansomware.  So far, they seem to be playing nice together.

BitDefender goes about its business quietly without notifications but it may have blocked Locky on two of my rigs.  I happened to spot an obsolete software key on each when running the CCleaner Registry cleaner yesterday: HKCU\Software\Locky.  Which means I'm 'lucky' to have paid attention to your posts here.

So you know you may have saved at least one poor soul some misery.  For that, I say "Thanks!"

 

Addendum:  That 'obsolete' software key keeps getting rewritten to the registry after being deleted.  Not immediately, but it shows up again if I run CCleaner an hour or two after deleting it.

Got some work to do.

on Apr 23, 2016

If I helped, I'm truly happy Daiwa. Are you sure that registry key isn't being written by one of your AR program updates (I assume they update daily...and maybe stuff is hanging around in memory and getting rewritten?). 

If I were you, I would definitely be asking the AR makers about this and making a post about it in MWB's Forum...and maybe WARPs as well...

on Apr 24, 2016

McAfee's site says the presence of that specific reg key is indicative of infection, but so far no harm.  I'll keep this thread updated.

on Apr 25, 2016

After reading Daiwa's reply #1 I decided to run CCleaner's registry cleaner and found the same obsolete reg key, HKCU\Locky. When I clicked on fix issues a window opened and said the key is left behind after uninstalling software. The only ones I uninstalled was CCleaner and BitDefender Anti-Ransomeware to update to the latest versions.

on Apr 25, 2016

Interesting, Uvah.  I'm talking to my tech guy this morning on this issue.  My first suspicion was that BitDefender had blocked a Locky attempt and that a harmless reg key was left behind.  Now not so sure.  I'll post back.

on Apr 27, 2016

After a lengthy session with my tech guy, it appears probable that the reg key in question is actually being written by one of the antiransomware apps, most likely BitDefender Antiransomware, for reasons unclear.  We actually found a set of two related keys in 6 different locations in the reg - CCleaner only found 1 set flagged as 'obsolete'.  It may be part of a strategy to 'immunize' against Locky.

One more little experiment to conduct before I can be sure.  More to follow.

on Apr 27, 2016

Locations please.

on Apr 27, 2016

Daiwa...I guessed correctly (response #2). . Glad about that!

on Apr 27, 2016

DrJBHL

Daiwa...I guessed correctly (response #2). . Glad about that!

You were close, Doc.  Not just on program update, but within an hour of the keys being deleted.

on Apr 27, 2016

I'd love to give you the locations, Uvah, but I wasn't watching real-time as he did the reg search.  All you need to do is search in regedit for Locky & delete all found keys.

on Apr 28, 2016

Thank you!

on Apr 28, 2016

@Daiwa...thanks, I will.

on Apr 28, 2016

There was a second key in the same section as each Locky key, gibberish alphanumeric name starting with 7ou, that CCleaner had also flagged as obsolete.  It, too, kept getting rewritten to the reg, so we nuked all those, too.

on Apr 28, 2016

I can report that 18 hours after deleting all found Locky keys and all the 7ou... keys, they remain gone on both rigs.  Interesting that CCleaner only picked up one set of the keys as obsolete when there were multiple sets.  The only protectionware difference between the two rigs is one runs BitDefender AV, the other Avast Pro AV.  Both run MWB, MWB Anti-exploit and BD Antiransomware.  And they are now both running WinPatrol WinAntiRansomwarePlus.  Still not sure where those Locky keys came from.

on Apr 29, 2016

Additional info today.

Avast Pro blocked the Locky trojan in several emails this morning - first time I'd seen a popup indicating so, but I assume there were others that I missed in the past.  This happened with active scanning of the inbound emails before they reached my inbox.

Found 4 instances of the Locky & 7ouHlW14R0XZ0x keys in the reg, all empty, suggesting that the trojan is able to get that far before Avast blocks it.

BitDefender on the other machine doesn't show popups, just does its biz in the background so it appears to be effectively blocking Locky as well.

3 Pages1 2 3