Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


607 posts

Ultimate Geek
+1 received by user: 28


Topic # 123361 4-Jul-2013 19:53
Send private message

How exactly are people getting infected with this?  Ive had to remove this from several of our customers machines, but just cant work out how exactly they are being infected.  Im assuming web servers emplying poor security are being compomised and used to carry this ransomware?  Most of them have reported being in google image search.

View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
BDFL - Memuneh
61016 posts

Uber Geek
+1 received by user: 11849

Administrator
Trusted
Geekzone
Lifetime subscriber

  Reply # 849395 4-Jul-2013 19:55
Send private message

Most likely some injection in poorly designed/maintained websites distributing the malware. Usually those things are downloaded after the browser is redirected multiple times to different domains to hide what's going on.




2730 posts

Uber Geek
+1 received by user: 286


  Reply # 849415 4-Jul-2013 22:03
Send private message

Oh they made a NZ one now?

Had a few encounters with the Aussie federal police one.. smart too. Takes webcam pic and uses it against you :)

His particular one was an infected PDF I think. Emailed from an apparent known source (good ol yahoo harvest)

Another one to add to the list to remind NZPost staff too look our for. Made it hard to do Western Union transfers to help trap scams, and they should by rights flag warning warning for these too. Randoms walking in attempting to pay to an acct...

xpd

Chief Trash Bandit
8846 posts

Uber Geek
+1 received by user: 1303

Mod Emeritus
Trusted
Lifetime subscriber

  Reply # 849502 5-Jul-2013 09:05
Send private message

Its also pushed out by Apache systems that have been infected via a hole in the security (obviously patched by Apache now) but not everyone has updated to fix it. We just had a staff member get it and couldnt work out how, he was visiting legit "safe" sites.

I'll see if I can find the article I was reading on it.

Easiest fix we found for the malware was to create a new profile for the user and then run MalwareByes and Nod32 to flush it out of his old profile.



Found link 




XPD / Gavin / DemiseNZ

 

For Free Games, Geekiness and Reviews, visit :

 

Home Of The Overrated Raccoons

 

Battlenet : XPD#11535    Origin/Steam/Epic/Uplay : xpdnz


622 posts

Ultimate Geek
+1 received by user: 12


  Reply # 922299 27-Oct-2013 00:58
Send private message

I believe there are about 9 variants.. the new one uses a bug in flash player to install itself

the one I cleaned installed parts in users temp folder

and replaced the icons cache file in app data


just had to boot to win pe and delete both and then it booted normally

malware etc never found the new variants

I guess its changed again by now


then make sure shockwave and flash and adobe are the latest versions


since its flash hole didnt matter what browser.. but most infections always seem
mostly IE8-9 users



607 posts

Ultimate Geek
+1 received by user: 28


  Reply # 922304 27-Oct-2013 02:33
Send private message

There is also one variant which when removed, leaves the system booting to a dos prompt and nothing else.  The winnt shell reg key is changed so the system executes cmd.exe instead of explorer.exe.  Easiest way to remove this is a system restore if possible then it reverses anything else changed by this ransomware.  Otherwise, I just boot ubuntu from cd and locate/delete the exe to regain access to system.  Boot system up again, fix shell reg key to point back to explorer.exe, also remove msconfig entry, then run malwarebytes.

1 post

Wannabe Geek


  Reply # 923264 28-Oct-2013 21:39
Send private message

Just removed this scam. System restore works + AdwCleaner and Malwarebytes after restore! Both are free
The funniest thing that this virus was created by russians )
http://privacy-pc.com/news/your-pc-is-blocked-background-of-the-police-ransomware-virus.html

622 posts

Ultimate Geek
+1 received by user: 12


  Reply # 923272 28-Oct-2013 22:00
Send private message

malwarebytes doesnt detect the variant i encountered.. and system restore is brutal way often when used always seems to kill other drivers and apps installed when friends have used it making a bigger mess.

ideally a usb back image from ghost 15 is best but of course most users never that wise

I do a backup once a week of my system


anyhow its more fun unhacking it so can discover how it was done so can prevent next time

622 posts

Ultimate Geek
+1 received by user: 12


  Reply # 923273 28-Oct-2013 22:02
Send private message

also some say thats a lie and was a NSA project that got loose ;) but you never know really.. trust no one

2784 posts

Uber Geek
+1 received by user: 454


  Reply # 923840 29-Oct-2013 22:02
Send private message




Sony Xperia X running Sailfish
Jolla C
Nokia N1
Dell Inspiron 14z i5


aim

245 posts

Master Geek
+1 received by user: 9


  Reply # 923983 30-Oct-2013 09:14
Send private message

Cryptolocker is a nasty one.

960 posts

Ultimate Geek
+1 received by user: 194


  Reply # 927108 4-Nov-2013 16:46
Send private message

aim: Cryptolocker is a nasty one.

Security Now podcast listener by any chance? :)

aw

273 posts

Ultimate Geek
+1 received by user: 7

Subscriber

  Reply # 931222 12-Nov-2013 09:27
Send private message

Are the Police, DIA, or any other departments interested in receiving reports of these kind of incidents like CryptoLocker?

I just had a customer hit by this (fortunately on a PC that was both imaged and backed up, no data loss). The means of delivery was an e-mailed fake voicemail attachment.

BDFL - Memuneh
61016 posts

Uber Geek
+1 received by user: 11849

Administrator
Trusted
Geekzone
Lifetime subscriber

  Reply # 931224 12-Nov-2013 09:35
Send private message

I would say there's very little local law enforcement can do when it involves criminals based on the other side of the world...




aw

273 posts

Ultimate Geek
+1 received by user: 7

Subscriber

  Reply # 931252 12-Nov-2013 10:02
Send private message

Fortunately due to those backups nothing needs doing. I was thinking more for statistical purposes etc

1483 posts

Uber Geek
+1 received by user: 121

Subscriber

  Reply # 937399 19-Nov-2013 16:14
Send private message

I was asked to clean a friends computer today.  He is running XP and messages coming up that his files will be encrypted and locked by NZ Police for watching porn or something to that effect.
  I never saw the message myself so unsure exact wording.  Computer was still working but he said the message started Sunday.
  I ran MSE and that was clear and ran malwarebytes which picked up 15 infections.  I ran ccleaner as well.  Also installed Firefox and adblocker.  Everything else all updated.
Is that all i needed to do or will it still lock later




HTPC Intel Pentium G3258 cpu, Gigabyte H97n-wifi motherboard, , 8GB DDR3 ram, onboard  graphics. Hauppuage HVR 5500 tuner,  Silverstone LC16M case, Windows 10 pro 64 bit using Nextpvr and Kodi


 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Intel introduces new NUC kits and NUC mini PCs
Posted 16-Aug-2018 11:03


The Warehouse leaps into the AI future with Google
Posted 15-Aug-2018 17:56


Targus set sights on enterprise and consumer growth in New Zealand
Posted 13-Aug-2018 13:47


Huawei to distribute nova 3i in New Zealand
Posted 9-Aug-2018 16:23


Home robot Vector to be available in New Zealand stores
Posted 9-Aug-2018 14:47


Panasonic announces new 2018 OLED TV line up
Posted 7-Aug-2018 16:38


Kordia completes first live 4K TV broadcast
Posted 1-Aug-2018 13:00


Schools get safer and smarter internet with Managed Network Upgrade
Posted 30-Jul-2018 20:01


DNC wants a safer .nz in the coming year
Posted 26-Jul-2018 16:08


Auldhouse becomes an AWS Authorised Training Delivery Partner in New Zealand
Posted 26-Jul-2018 15:55


Rakuten Kobo launches Kobo Clara HD entry level reader
Posted 26-Jul-2018 15:44


Kiwi team reaches semi-finals at the Microsoft Imagine Cup
Posted 26-Jul-2018 15:38


KidsCan App to Help Kiwi Children in Need
Posted 26-Jul-2018 15:32


FUJIFILM announces new high-performance lenses
Posted 24-Jul-2018 14:57


New FUJIFILM XF10 introduces square mode for Instagram sharing
Posted 24-Jul-2018 14:44



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.