Just received virus from hell, be warned!

[Chris Hewitt]

Hi guys, here's something you really need to be aware of. I've just been hit by a lethal virus called Cryptowall 3. It re-encrypts most of your system and is ransom based, in other words , they want 500 Euros to send you the decrypter file and double that if you delay a week. It is aimed at business based people like us and in my case, it came as an attachment to an email from a guy sending his resume.My AV didn't pick it up.

For me, I'm 95% backed up so not too bad but I will have to format my drive partitions and reinstall Windows.

Just thought I'd warn you because this one is the worst I've seen.

[Noa Put]

That reminds me in the very early days when I got my first pc, google didn't exist yet and you could download software to use as a search-engine, I found something which if I recall right was called Bullseye and as soon as I double clicked it to install my pc did shutdown, restarted and I got a black screen with with text which looked like instructions scrolling down and I did pull the plug by then. When I had my pc serviced because it didn't boot anymore Bullseye appeared to be a virus that deleted the content from your harddrive, fun days... :)

I now have a image that I can re install with window only and one with windows and programs just incase something goes really bad.

[Tim Polster]

Sorry to hear that Chris. Thanks for the warning. Shame this has to occur out there.

I keep a clone of my operating system drive on the shelf so if anything goes wrong I can just swap drives and go on. I am a firm believer that anything with malware or viruses is best dealt with a clean slate.

Glad you were not harmed by this.

[Craig McKenna]

This happened on a TV series about lawyers - I think it was called 'The Good Wife' recently. A hacker in Russia was hacking their system and witheld all of their documents regarding clients. They ended up threatening the hacker back by editing a video to show him insulting Putin. He changed his stance.

It's terrible that this is even possible. How can you even trust them to give you back your stuff if you give them £500, surely they could just ask for another £500 thereafter?!

Unreal. The police need to do a better job regarding this.

Sorry to hear of your troubles - great to hear that you have it sorted with the back up - even if the reformatting is a pain.

Are you using Windows or Mac?

[Noa Put]

How can you even trust them to give you back your stuff if you give them £500, surely they could just ask for another £500 thereafter?!

They won't, it's part of the scam, they are only after your money.

[Jim Michael]

which AV program were you using.

[Chris Hurd]

Some notes on that nastiness here: The dangers of opening suspicious emails: Crowti ransomware - Microsoft Malware Protection Center - Site Home - TechNet Blogs

Up-to-date backups and malware protection is key. I think it would be best not to pay, as that would just begin a spiraling cycle of ransom notes.

[Chris Medico]

I use an iPad to open any suspicious email attachments. Never on a computer I care about.

[Kyle Root]

Along similar lines, earlier this week, I upgraded my blog to a newer Wordpress theme.

I guess my website provider does scans for malicious code, and it turns out the one I had downloaded contained backdoors and other stuff.... so my accounts were suspended, meaning my website, blog, and other sites I run were taken offline.

Been cleaning and working on this for almost 24 hours now.

[Noa Put]

Originally Posted by Chris Medico

I use an iPad to open any suspicious email attachments. Never on a computer I care about.

Why would you want to open suspicious email attachments? :) I never ever do that. If I don't know the sender or if family or friends forward me these funny emails they get from other people that all goes straight to the bin.

[Dave Blackhurst]

There are a number of quite nasty viruses out there, the old rule of NEVER opening an attachment or downloading a file from an unknown source still applies.

I do a bit of computer repair for friends and family, and have been seeing some nasty stuff that piggybacks on legit downloads, hijacks your browser, and proceeds to suck in all kinds of garbage programs/malware/who knows what....

Recently I've seem more nasties that require a "wipe" and reinstall/restore to get things back right... rather than a clean and quarantine... just be careful out there!!

[Chris Harding]

Hey Chris

Bad luck on that one! I had a similar one many years ago that taught me the lesson about never opening attachments from someone you don't know. If a "bride" sent me an attachment I would also be very wary!! An enquiry never needs any attachment!!

We have had Malware Bytes on our machines now for ages and never an issue!

Hope you can get rid of it!!!

Chris

[Paul R Johnson]

Worse still is when a manufacturer installs virus type software on purpose! My wife bought a cheap Lenovo laptop. It's actually rather nice, but after I installed Firefox she had about three hours use before all hell broke loose. Every entry into google hijacked the browser, opening tons of windows, and a bit of research showed this is deliberate. Avg didn't help, and removing it the first time was ok for about three hours again, when it reinstalled. I eventually found a removal tool on the avg site, which worked. A bit of googling shows Lenovo are very unpopular for this, and for a manufacturer to sell the laptops cheap, but install dodgy software stinks a bit, doesn't it .

[Dave Baker]

You're right Paul, a manufacturer deliberately installing malware DOES stink.

My wife thinks I'm paranoid about computer security, but she bought a Lenovo laptop (Windows 8) about a year ago and let me check it out first. By that I mean I installed Firefox and Thunderbird, set Firefox preferences up to reject all but the cookies she allows and and delete the history on exit, then added my favourite security add-ons. I then scanned it with my toolbox which has things like Malware Bytes, CCleaner and SpyBot on it along with others, installed a good internet security suite and turned the silly Windows one off, cleaned off any malware found and she has had no troubles at all - so far, touch wood etc.

I would recommend any Windows user to make up a toolbox with privacy and security software on it. All freeware, it can be on a CD which is most secure, or a USB stick which is more convenient. The reason is, some malware searches out security tools which are installed on the computer and neutralises them (often called "denial of service"), so with the toolbox it's a fresh attack with software the malware didn't know was there, which has a much higher chance of success. A regular scan is best. I use my toolbox to help keep the family's machines in order.

Another thing worth doing is to download a Linux distribution, Puppy is most often recommended for this, again it can be put on a CD or USB stick. Puppy runs entirely in RAM, so can even boot a machine without a hard drive. It will boot a non-bootable Windows machine and, as long as the hard drive is working, be able to retrieve all stored files and save them to an external hard drive or similar. I'm not suggesting it will unscramble Chris' encrypted files, it won't! It can also be used to remove malware once the files have been identified. There are instructions how to do this on the 'net, just needs a search. I always have one ready.

Dave

[Robert Benda]

Another thing to do for safety is to disable flash in your browsers, or just uninstall it all together. Its not hard at all. with directions, takes maybe 15 seconds,