Cryptolocker: chargeback on credit card payment?

Forums › IT Pro and developers › Cryptolocker: chargeback on credit card payment?

1 | 2

gzt

17118 posts

Uber Geek

Lifetime subscriber

#966837 14-Jan-2014 14:28

freitasm: Despite of what people are running as AV in their Windows machines, everyone should install EMET as well.

Seen any issues with normal operation after installing EMET?

freitasm

BDFL - Memuneh
79268 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#966853 14-Jan-2014 14:52

Not in its default configuration.

jaymz

1133 posts

Uber Geek

#966868 14-Jan-2014 15:14

networkn: Hi There!

Anyone who has been infected by this, paid the ransom and then used the credit card chargeback to cancel the transaction? Anyone personally paid and got their files unencrypted? We have a fringe client infected who hasn't had a backup for a few days over xmas wondering if he should pay or restore.

Having dealt with this virus several times already, i can also confirm that there is no "cancel-able" way to pay the ransom.

You either pay the ransom and hope to recover your files, or restore from backup (unless you dont have a backup then you are buggered)

Quite a neat virus to be honest, but lacking in so many areas. It could have a mechanism in it to scan for and encrypt UNC shares along with the network drives!

Reports i have read that over 250,000 machines have been hit with this, and the creators have made an estimated $30Million. not a bad effort!

networkn

Networkn
32351 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#966928 14-Jan-2014 16:00

jaymz:
networkn: Hi There!

Anyone who has been infected by this, paid the ransom and then used the credit card chargeback to cancel the transaction? Anyone personally paid and got their files unencrypted? We have a fringe client infected who hasn't had a backup for a few days over xmas wondering if he should pay or restore.

Having dealt with this virus several times already, i can also confirm that there is no "cancel-able" way to pay the ransom.

You either pay the ransom and hope to recover your files, or restore from backup (unless you dont have a backup then you are buggered)

Quite a neat virus to be honest, but lacking in so many areas. It could have a mechanism in it to scan for and encrypt UNC shares along with the network drives!

Reports i have read that over 250,000 machines have been hit with this, and the creators have made an estimated $30Million. not a bad effort!

It would be such a nightmare if it accessed UNC paths.

gzt

17118 posts

Uber Geek

Lifetime subscriber

#966991 14-Jan-2014 17:32

Sensible move from the scammers there. You would have to figure out which machine encrypted it and it could possibly be encrypted by multiple machines sequentially. That would be a mess. The last thing they want is unhappy customers. Reports so far indicate it is pretty damn reliable ; ).

sonyxperiageek

2958 posts

Uber Geek

Trusted

#967000 14-Jan-2014 17:49

freitasm: Despite of what people are running as AV in their Windows machines, everyone should install EMET as well.

Trying to load the link but it's taking forever! In fact the support.microsoft.com site is taking an age!

Sony

nathan

5695 posts

Uber Geek
Inactive user

#967221 15-Jan-2014 01:19

Get a new ISP?

http://support.microsoft.com/kb/2458544

GoodSync

GoodSync. Easily back up and sync your files with GoodSync. Simple and secure file backup and synchronisation software will ensure that your files are never lost (affiliate link).

nathan

5695 posts

Uber Geek
Inactive user

#967222 15-Jan-2014 01:23

networkn:
jaymz:
networkn: Hi There!

Anyone who has been infected by this, paid the ransom and then used the credit card chargeback to cancel the transaction? Anyone personally paid and got their files unencrypted? We have a fringe client infected who hasn't had a backup for a few days over xmas wondering if he should pay or restore.

Having dealt with this virus several times already, i can also confirm that there is no "cancel-able" way to pay the ransom.

You either pay the ransom and hope to recover your files, or restore from backup (unless you dont have a backup then you are buggered)

Quite a neat virus to be honest, but lacking in so many areas. It could have a mechanism in it to scan for and encrypt UNC shares along with the network drives!

Reports i have read that over 250,000 machines have been hit with this, and the creators have made an estimated $30Million. not a bad effort!

It would be such a nightmare if it accessed UNC paths.

hopefully plebs silly enough to execute the malicious code don't have W access to those shares that don't have a backup

1 | 2