First on the list is protection from executables running from inside the Recycle Bin – you know that pesky type of malware that likes to hide in nested subfolders in there… Protected.
Next on the list is the new optional CryptoPrevent Automatic Updates service for home users!
’nuff said.
Tony
CryptoLocker is great!
My company was recently hit with this nasty thing. Luckily we have an outstanding backup system and were able to fully recover with nominal data loss in less than a day, but i know many others won’t be as fortunate. Thanks for fighting the good fight!
Cheers
I saw in your notes that distributing this tool through RMM may cause the white-list not to work. Is this possibly because the monitoring software runs under the system account so when the software looks at %appdata% or %localappdata% it’s not looking in the right location? Or does the tool manually parse the c:users folders for users and white-list that way?
I honestly don’t know why it isn’t working with Labtech RMM (only verified through one person) — my tool uses Microsoft’s GetProfilesDirectory call to userenv.dll which successfully reports the proper user profile directory even when run under the local system account in my testing.
still not sure why, but my other person using labtech states that it works properly using the ‘Process Execute as Admin’ or ‘Shell as Admin’ option, and not deploying it under the local system account.
john stuart
hi, just ran cryptoPrevent 3 – it seems to be happy with the changes but after a reboot I see the rules in secpol.msc (4 of them) all say “unrestricted”. Looks like they may be defaults to me.
The keys there are all HKLMsoftware…
I’ve not tried anything to do with policies before so there’s a good chance I’ve done something wrong rather than the program.
xp sp3 gigabyte GP1-ep45 mobo
these may be default values. when defining software restriction policies several default rules are created that begin with a % sign and specify a registry path – likely this is what you are seeing? Note that CryptoPrevent v3 currently creates (as far as block policies) well over 100 rules and none of them should be visible in secpol as they are artificially created. as for ‘unrestricted’ rules it only creates as many as you would have executables that exist in the block paths at the time of whitelisting — for most people in most cases, this is zero.
Ray
Hi Nick,
I just purchased the upgrade version after I installed it.
Is there a way to add the license key or should I delete and reinstall?
Will a registry cleaner like ccleaner harm the code you add to the registry?
Ray, you can enter the product key by running the program, selecting the top menu called Updates! and then selecting Learn More about Automatic Updates. On this page you can enter in your product key, and hit the Save Schedule button to create the automatic update schedule on your computer.
Also no, CCleaner should not undo what CryptoPrevent does to the registry.
Ray
Thanks Nick
By the way, I found your site thru a link on Brian Krebs security web site.
© 2024 · d7xtech.com
9 Comments
Leave your reply.