3

Has anyone devised a "preventive plan" against the ever growing issues with Cryptolocker and Cryptowall?

The goal:

On a server with DC and AD, apply rules on all users with either a script or manual set for each users to prevent unwanted files from being installed on the user's PC(s).

I was looking at: http://www.foolishit.com/posts/cryptolocker-prevention/ website, but it doesn't have the ability to use it on a server for multiple users at once, it seems he only has a script that are applied by each individual users.

I want to be able to deploy rules on every users in the Users directory on a domain.

Improve this question
5
  • Yes, use only thin clients. Alternately, walk loudly and carry a big LART menacingly.
    – HopelessN00b
    Jun 25, 2014 at 14:23
  • 2
    There's a link there that leads to a site with AD templates...have you tried that? Also, be aware of the side-effects of using these tools as some software (I'm looking at you, Chrome) runs out of AppData.
    – Nathan C
    Jun 25, 2014 at 14:28
  • +1 for @NathanC and his comment. I deployed one of these policies and accidentally blocked an uncommon but needed app.
    – Katherine Villyard
    Jun 25, 2014 at 17:42
  • We've got hit a couple of weeks ago by a Cryptolocker (through a limited user, and we had backups for all). Bottom line, I think that, as it has always been, you can't really fully block all the viruses and the likes of it using blacklist - it's just never enough, since there are always new bad programs. The better, but far more difficult to apply, approach is white-listing all the software you use and block everything else.
    – EliadTech
    Jun 25, 2014 at 18:43
  • I agreed! There is no software or methods that prevents or keeps you and your employees, friends, etc... immune from these ever growing malware infected app. But we can prevent using policies that highly restricts one from opening an unknown file. Sure, cryptography can bypass virus scanners but once they're on your desktop or folder, you launch it, it starts propagating instantly. We had at least 7 or so clients gotten hit. The problem is, "end user" carelessness. It happens...
    – GeekRick
    Jun 26, 2014 at 16:18

3 Answers 3

Reset to default
7

You can use Software Restriction Policies to block executables from running when they are located in the %AppData% folder, or any other folder.

File paths of the infection are:
C:\Users\User\AppData\Roaming\{213D7F33-4942-1C20-3D56=8-1A0B31CDFFF3}.exe (Vista/7/8) C:\Documents and Settings\User\Application Data\{213D7F33-4942-1C20-3D56=8-1A0B31CDFFF3}.exe

So the path rule you want to basically setup is a new Windows Setting Policy:

Path: %AppData%\*.exe
Security Level: Disallowed
Description: Don't allow executables from AppData.

Source: http://www.thirdtier.net/downloads/CryptolockerPreventionKit.zip

The above download contains the GPO's for Win7/8 and XP.

Improve this answer
1
  • I am testing this in an environment, like VMWare WorkStation servers running with users on the next host in VMWare. It's best to apply these policies in a test environment. I will share my responses when I gt a chance. Thank you for you reply..
    – GeekRick
    Jun 25, 2014 at 15:12
4

I would like to echo Answer #1 with regards to the Windows Setting Policy, but add a recommendation that you aggressively test this for all of your user groups before deploying it in a widespread environment. My org used this exact same policy setting, but we soon found out that it blocked updates and installations of our own IT ticketing software. As such, we had to create exceptions such as:

Path: %LocalAppData%\[path to installer]\[name of installer].exe
Security Level: Unrestricted.

As it turns out, quite a lot of valid, poorly written software makes extensive use of the %AppData folder, so heavy testing may be needed to avoid a big headache with your users.

Improve this answer
0

You need also to protect yourself from launching exes within zip files and other popular archivers. these path will catch almost anything

%LocalAppData%\*\*.exe
%LocalAppData%\*.exe
%temp%\*\*.exe
%temp%\*.exe
%Userprofile%\*.exe

But remember , these are not recursive . eg : %temp%\aaa\aaa*.exe would still be executed.

Another approach would be to lock everything and unblock what is only permitted.

here are some good starting point resources :

http://mechbgon.com/srp/

http://home.arcor.de/skanthak/SAFER.html

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.