<div dir="ltr">We have come accross it. Delivery was via .pdf.exe in a zip attachment to an email. Email was processed by Trend Micro IMSVA that was up to date, and workstation had trend antivirus with latest definitions and it still managed to run unchecked for a couple of hours(it encrypts local system first so there was a lag time before it hit the file servers). It hit the mapped drives last, but didnt try to touch VSS / Previous versions on the windows file servers so once we identified and isolated the machine we rolled back to the last good checkpoint. <div>
<br></div><div>If you have home directories a good way to identify the offending client is check which users home drives have been encrypted, as long as your corp mapped drives have a higher letter than the home drive as it seems to walk the drives in alphabetical order.<br>
<div><br></div><div>Very annoying, and from what I have seen around on forums, it has picked up a lot more this week. We decided to move ahead with blocking all executables in emails on the clients that didn't already have the policy.</div>
<div><br></div><div>--Damian</div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Oct 23, 2013 at 8:48 PM, Sean Slater <span dir="ltr"><<a href="mailto:sean@farrellmedia.com.au" target="_blank">sean@farrellmedia.com.au</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi all,<div><br></div><div>Leading on from Daniel's post, the best resource I've come across for CrypoLocker is on BleepingComputer.com,</div>
<div><br></div><div><a href="http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information" target="_blank">http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information</a><br>
</div><div><br></div><div>I haven't come across this thing yet personally, but it sounds nasty.</div><div><br></div><div>Kind Regards,<br></div><div class="gmail_extra"><div>
<br>Sean Slater<br><br>--<br><b>Farrell Media Pty. Ltd.</b><br><font size="1">ABN: 30 135 592 291 ACN: 135592291</font><br><b>Email <a href="mailto:sean@farrellmedia.com.au" target="_blank">sean@farrellmedia.com.au</a></b><br>
Phone <a href="tel:08%208311%203955" value="+61883113955" target="_blank">08 8311 3955</a> : Fax <a href="tel:08%208311%205299" value="+61883115299" target="_blank">08 8311 5299</a><br></div>
<br><br><div class="gmail_quote"><div><div class="h5">On Wed, Oct 23, 2013 at 10:26 PM, Daniel Pearson <span dir="ltr"><<a href="mailto:dpearson@pingco.com.au" target="_blank">dpearson@pingco.com.au</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div lang="EN-AU" link="#0563C1" vlink="#954F72">
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Hi All,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Not sure if anyone else has come across this nasty piece of work…. Definitely worth everyone knowing about it. Already has caused havoc for a number of people I know. New versions look at network resources and delete *.bak, *.vbk etc… so
even backups will become encrypted.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Anyway just thought I would make sure everyone is aware of it.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Regards,<u></u><u></u></p>
<p class="MsoNormal">DP<u></u><u></u></p>
</div>
</div>
<br></div></div>_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br></blockquote></div><br></div></div>
<br>_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br></blockquote></div><br></div>