Cryptolocker: chargeback on credit card payment?

Forums › IT Pro and developers › Cryptolocker: chargeback on credit card payment?

1 | 2

gzt

18688 posts

Uber Geek
+1 received by user: 7827

Lifetime subscriber

#966837 14-Jan-2014 14:28

freitasm: Despite of what people are running as AV in their Windows machines, everyone should install EMET as well.

Seen any issues with normal operation after installing EMET?

freitasm

BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41070

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#966853 14-Jan-2014 14:52

Not in its default configuration.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

jaymz

1136 posts

Uber Geek
+1 received by user: 76

#966868 14-Jan-2014 15:14

networkn: Hi There!

Anyone who has been infected by this, paid the ransom and then used the credit card chargeback to cancel the transaction? Anyone personally paid and got their files unencrypted? We have a fringe client infected who hasn't had a backup for a few days over xmas wondering if he should pay or restore.

Having dealt with this virus several times already, i can also confirm that there is no "cancel-able" way to pay the ransom.

You either pay the ransom and hope to recover your files, or restore from backup (unless you dont have a backup then you are buggered)

Quite a neat virus to be honest, but lacking in so many areas. It could have a mechanism in it to scan for and encrypt UNC shares along with the network drives!

Reports i have read that over 250,000 machines have been hit with this, and the creators have made an estimated $30Million. not a bad effort!

networkn

Networkn
32871 posts

Uber Geek
+1 received by user: 15468

ID Verified

Trusted

Lifetime subscriber

#966928 14-Jan-2014 16:00

jaymz:
networkn: Hi There!

Anyone who has been infected by this, paid the ransom and then used the credit card chargeback to cancel the transaction? Anyone personally paid and got their files unencrypted? We have a fringe client infected who hasn't had a backup for a few days over xmas wondering if he should pay or restore.

Having dealt with this virus several times already, i can also confirm that there is no "cancel-able" way to pay the ransom.

You either pay the ransom and hope to recover your files, or restore from backup (unless you dont have a backup then you are buggered)

Quite a neat virus to be honest, but lacking in so many areas. It could have a mechanism in it to scan for and encrypt UNC shares along with the network drives!

Reports i have read that over 250,000 machines have been hit with this, and the creators have made an estimated $30Million. not a bad effort!

It would be such a nightmare if it accessed UNC paths.

gzt

18688 posts

Uber Geek
+1 received by user: 7827

Lifetime subscriber

#966991 14-Jan-2014 17:32

Sensible move from the scammers there. You would have to figure out which machine encrypted it and it could possibly be encrypted by multiple machines sequentially. That would be a mess. The last thing they want is unhappy customers. Reports so far indicate it is pretty damn reliable ; ).

sonyxperiageek

2984 posts

Uber Geek
+1 received by user: 397

Trusted

#967000 14-Jan-2014 17:49

freitasm: Despite of what people are running as AV in their Windows machines, everyone should install EMET as well.

Trying to load the link but it's taking forever! In fact the support.microsoft.com site is taking an age!

Sony

Geekzone

Want to support Geekzone and browse the site without the ads? Subscribe to Geekzone now (monthly, annual and lifetime options).

nathan

5695 posts

Uber Geek
+1 received by user: 1630
Inactive user

#967221 15-Jan-2014 01:19

Get a new ISP?

http://support.microsoft.com/kb/2458544

nathan

5695 posts

Uber Geek
+1 received by user: 1630
Inactive user

#967222 15-Jan-2014 01:23

networkn:
jaymz:
networkn: Hi There!

Anyone who has been infected by this, paid the ransom and then used the credit card chargeback to cancel the transaction? Anyone personally paid and got their files unencrypted? We have a fringe client infected who hasn't had a backup for a few days over xmas wondering if he should pay or restore.

Having dealt with this virus several times already, i can also confirm that there is no "cancel-able" way to pay the ransom.

You either pay the ransom and hope to recover your files, or restore from backup (unless you dont have a backup then you are buggered)

Quite a neat virus to be honest, but lacking in so many areas. It could have a mechanism in it to scan for and encrypt UNC shares along with the network drives!

Reports i have read that over 250,000 machines have been hit with this, and the creators have made an estimated $30Million. not a bad effort!

It would be such a nightmare if it accessed UNC paths.

hopefully plebs silly enough to execute the malicious code don't have W access to those shares that don't have a backup

1 | 2