If the timer expires, the software uninstalls itself(!) and your data is lost
The malware will set a timer to decrypt your files if you so decide to pay the ransom You will be asked to pay a ransom via GreenDot MoneyPaks, BitCoin, CashU, paysafecard, or Ukash of either $100 or $300 depending on which variant you have
It will encrypt files on volumes (network, locally attached) where the user has modify permissions You will be presented with a splashscreen similar to the one attached below Paths of infection so far: C:\Users\User\AppData\Roaming\.exeįiles on the local system are encrypted, starting with local drives (at the beginning of the alphabet), moving up to network connected shares. In one of the keys above, a list of your encrypted files are stored SplashScreen is presented to you, hijacking your Windows Desktop completelyĮvidence of the malware is found in the registry (HKCU\Software\CryptoLocker, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Cryptolocker, others?) Propagation seems to be through social networking, botnets, and email links at this time (9/16/13) The malware executes (as many others do) from the %AppData% folder. The major AV vendors don't seem to catch it (Microsoft has dubbed it ' CriLock. Let's see if we can compile the information here as well with what we know. It is a matter of diligent user education, limiting modify/full user access on your shares (I'm guilty of this one), and knowing how/where the thing will spread. It seems that even limiting admin rights on a computer doesn't keep it from spreading. Note the bit about using a software restriction policy to block all. Guys - see this link: Proper care & feeding of your cryptlocker (Reddit)
0 kommentar(er)
