Major Issues with the Ransom Testcrypt. encryption Virus :-(

[hillskill]

Hi All,

 

Are any other schools having problems with this horrible encryption virus thing ( Ransom Testcrypt.)? Its causing us a major headache and I cant seem to find a patch or fix to prevent it. The only way we seem to be able to get rid of it at moment is to delete the files and folder and restore from unaffected backup. Obviously though, this isn't really practical and won't prevent it from coming back! Its affecting network drives, staff laptops everything.

 

Any suggestions would be greatly appreciated.

 

Best Wishes,

[speckytecky]

Sorry to see you have been hit by this; what AV product are you using?

[synaesthesia]

One of the best ways to help prevent this in the first place is locking down access and execution rights for staff & pupils, so programs cant be run from any areas except those you specify - so an instant no to anything in the temp or appdata folders, USB drives etc. Staff laptops are usually going to be one of the biggest infection points if they have the ability to install software etc when at home.

Unfortunately quite a few of these crypto infections seem to waltz straight past most AV packages. Has yours picked anything up at all?

[hillskill]

Thanks Guys- we are using Microsoft Forefront Endpoint Protection. It does detect it and and tries to delete the infected files but more often that not fails. We then end up having to restore the folder. You are correct that our staff have the ability to install software on their own laptops but taking this priliagave agway would be a major headache too! So far students have not been hit but worried they will be soon.

[synaesthesia]

Disaster recovery plan time if it's that far down. Pull the network *now*. Get the file servers clean. Get your admin staff up and running as priority. Get curriculum machines up and running as second priority. Then concentrate on mobile devices - call in all staff laptops, flatten and re-image them.

[gaz350b]

The encrypted files are not the infection. The infection is at a desktop or most likely a laptop.

 

Pull the cable from the file server, go lockdown and get hunting. Change wireless settings or create a new wifi network for "clean" devices.

 

Make sure you use READ ONLY media for your security tool kit don't risk spreading via a sub stick

[synaesthesia]

^. I do like to overcomplicate sometimes

 

We're only up the road from you if you need a hand, cheap day rates for over Easter!

[5tu]

... You are correct that our staff have the ability to install software on their own laptops but taking this privilege away would be a major headache too!...

 

This has got to change otherwise you're powerless to stop the issue occurring again and again. It is not unreasonable to remove local admin rights for staff , it is required in this day and age. You could create a whitelist of allowed installers via Applocker if required - might help to soften the blow!

[Bruce123]

This has got to change otherwise you're powerless to stop the issue occurring again and again. It is not unreasonable to remove local admin rights for staff , it is required in this day and age. You could create a whitelist of allowed installers via Applocker if required - might help to soften the blow!

 

I agree with this, you can't go on allowing staff to install anything on their laptops and then let them connect them to the network (Wifi/Ethernet).

 

We have two Wifi Networks (APs broadcasting two SSIDs).

 

One is for staff and students to connect their own kit (which they may have admin rights on of course) and basically just allows Internet Access (ACLs on the switches prevent connections to any internal servers/devices).

The other is for College Managed devices, which only IT staff can install software on (mostly domain jointed laptops).

 

It's something to think about (after sorting out the Malware issue of course).

 

Thanks,

 

Bruce.

[Bruce123]

Hi All,

 

Are any other schools having problems with this horrible encryption virus thing ( Ransom Testcrypt.)? Its causing us a major headache and I cant seem to find a patch or fix to prevent it. The only way we seem to be able to get rid of it at moment is to delete the files and folder and restore from unaffected backup. Obviously though, this isn't really practical and won't prevent it from coming back! Its affecting network drives, staff laptops everything.

 

Any suggestions would be greatly appreciated.

 

Best Wishes,

 

You should start by trying to understand how TeslaCrypt works and which variant is, this is a very good article on it:

 

Achievement Locked: New Crypto-Ransomware Pwns Video Gamers | Bromium Labs

 

It's strange, I don't know if it's just me but there seems to a distinct lack of info out there on precisely what it does and how it works.... (but as I said, the above article is good).

 

Thanks,

 

Bruce.

[The_IT_Guy]

Sorry to jump in but the info may help aswell.

 

I'm paranoid and doing everything we can to prevent it etc.

 

But if you get infected how to you trace the source? What tools are best to do this with?

 

Cheers

[Arthur]

I don't know if it's just me but there seems to a distinct lack of info out there on precisely what it does and how it works.

Cisco Talos Blog: TeslaCrypt 3.0.1 - Tales From The Crypt(o)!

[Bruce123]

Sorry to jump in but the info may help aswell.

 

I'm paranoid and doing everything we can to prevent it etc.

 

But if you get infected how to you trace the source? What tools are best to do this with?

 

Cheers

 

Really simple, check the owner of the .txt ransom note it creates, the owner is the user who created the file (i.e. the infected user). Disable their AD object immediately.

 

[under Windows 7, Right click -> Security -> Advanced -> Owner]

 

Thanks,

 

Bruce.

[disk]

To help bolster your endpoint security, you might consider adding something like Microsoft EMET or Malwarebytes Anti-Exploit. They are not antivirus replacements but rather designed to work in conjunction with your AV solution.

 

https://technet.microsoft.com/en-us/security/jj653751

 

https://www.malwarebytes.org/business/antiexploit/

[fiendishlyclever]

To help bolster your endpoint security, you might consider adding something like Microsoft EMET or Malwarebytes Anti-Exploit. They are not antivirus replacements but rather designed to work in conjunction with your AV solution.

 

https://technet.microsoft.com/en-us/security/jj653751

 

https://www.malwarebytes.org/business/antiexploit/

 

Malwarebytes premium saved my bacon at home when I was half asleep - it blocked the ransomware. I'll stick to sleepy surfing on my iPad from now on

[Dos_Box]

I wonder whether one of you 'geekers out there would care to make up a ransomware disaster recovery sheet we could give out to the members on the site as it seems to be hitting some members quite hard and a checklist of actions would go some way to helping calm down the panic as well as giving sensible step by step instructions which will also give members ideas on things they should be doing even before they are infected to help recover/secure their networks.

Anyone want to volunteer?

[Eudora931]

Would be interested in this .. We got hit 4 weeks ago ...

[john]

I wonder whether one of you 'geekers out there would care to make up a ransomware disaster recovery sheet we could give out to the members on the site as it seems to be hitting some members quite hard and a checklist of actions would go some way to helping calm down the panic as well as giving sensible step by step instructions which will also give members ideas on things they should be doing even before they are infected to help recover/secure their networks.

Anyone want to volunteer?

 

Backups, Backups, Backups, Backups and more Backups oh and test your backups

 

Don't run old vulnerable versions of software ever, so that means that old Edu-Soft that needs Java 1.6 U4 only or Flash V14 needs to be replaced / made to work (that will be a massively hard sell) but patch everything promptly, if the plugin's are not needed such as flash, java, silverlight, Air etc don't install them on the machine

 

Those would be my 2 big points after having had it.

[Geoff]

Prior to an infection:

 

1. Tested backups kept offline (ideally offsite).

2. Disable files running from AppData/LocalAppData folders.

3. Take local admin rights of users.

4. Have a separate admin account from your day to day account. Only use the privileged account for 'admin' work.

5. Use FSRM filters to look for common ransomware file names.

6. Filter ALL attachments coming in via email.

7. Lock down USB / Optical drive access.

8. Install an IDS.

9. Use a reputable AV solution and keep it updated.

10. Keep up with patches. Especially web browsers, plugins and the OS.

11. Educate users about dodgy emails, pen drives and general computer hygiene. Test them on it (phish your own users).

 

During / Post Cleanup.

 

1. Take the network down.

2. Thoroughly record what steps you are taking (important for 7).

3. Identify the source of the ransomware. How easy this will be is dependant on exactly what's got encrypted. Check the file server first.

4. Wipe and reimage any infected machines.

5. Restore your data from your backup.

6. Slowly bring everything back online one by one. If you spot encryption happening again go back to step 1 and try again.

7. Evaluate what happened and make recommendations on how to prevent it (usually due to SMT refusing to let you do something in the other list)

[The_IT_Guy]

I wonder whether one of you 'geekers out there would care to make up a ransomware disaster recovery sheet we could give out to the members on the site as it seems to be hitting some members quite hard and a checklist of actions would go some way to helping calm down the panic as well as giving sensible step by step instructions which will also give members ideas on things they should be doing even before they are infected to help recover/secure their networks.

Anyone want to volunteer?

 

This is something i have been working on as an action plan if we found we were infected still in its early days. A few bits borrowed from websites and articles about ransomware.

 

I have also put in place a number of the restrictions mentioned on here such as the software restriction policies, email filters, adding warning messages at the top of emails with ZIPs as i couldn't block them completely etc.

 

Ransomware Procedure Edugeek version.pdf

[hallb15]

These are the locations/files I've prevented .exe files from running (via group policy). Are there any others I should add to this?

 

%localAppData%\*.exe

%localAppData%\*\*.exe

%localAppData%\Temp\*.zip\*.exe

%localAppData%\Temp\7z*\*.exe

%localAppData%\Temp\Rar*\*.exe

%localAppData%\Temp\wz*\*.exe

 

The following paths are for Windows XP machines (I've left these in just in case)

%AppData%\*.exe

%AppData%*\*\*.exe

[Geoff]

Also consider whitelisting instead of blacklisting.

[FragglePete]

These are the locations/files I've prevented .exe files from running (via group policy). Are there any others I should add to this?

 

%localAppData%\*.exe

%localAppData%\*\*.exe

%localAppData%\Temp\*.zip\*.exe

%localAppData%\Temp\7z*\*.exe

%localAppData%\Temp\Rar*\*.exe

%localAppData%\Temp\wz*\*.exe

 

The following paths are for Windows XP machines (I've left these in just in case)

%AppData%\*.exe

%AppData%*\*\*.exe

 

I've recently re-enforced these restrictions our 'admin' users and it's now causing me all sorts of headaches. PSF Financials are using a Citrix based remote tool that runs from the Local App Data folders - I've asked them to re-evaluate how they support their customers in light of these recent virus attacks and their response...... "The onus is on you to provide a fix so we can run the remote support application".

 

Pete

[Steve21]

I've recently re-enforced these restrictions our 'admin' users and it's now causing me all sorts of headaches. PSF Financials are using a Citrix based remote tool that runs from the Local App Data folders - I've asked them to re-evaluate how they support their customers in light of these recent virus attacks and their response...... "The onus is on you to provide a fix so we can run the remote support application".

 

Pete

 

Haha that's helpful Is it GoToMeeting by any chance?

 

We found the same issues with them but they do have a MSI installer option so it doesn't need to run the temporary exe's once the MSI is installed

 

Steve

[Geoff]

I've recently re-enforced these restrictions our 'admin' users and it's now causing me all sorts of headaches. PSF Financials are using a Citrix based remote tool that runs from the Local App Data folders - I've asked them to re-evaluate how they support their customers in light of these recent virus attacks and their response...... "The onus is on you to provide a fix so we can run the remote support application".

 

Pete

 

You have to put an exception in for the Logmein/Gotoassist/whatever executable to run from appdata. However be aware that many 'Microsoft Technical Support' scammers use the same tools. We avoid this by having a dedicated PC in IT that is exempt from the setup for remote support to use and only use. That way we can categorically blame them if we get infected via that machine. They are generally using a domain admin login anyway.