Ransomware napada

Zaraza najcesce dolazi sa net-a i maila tak da ako nitko nije pristupao mailu onda je ocito surfanjem kroz exploit. Moguce je i preko usb-a (manje vjerojatno ali moguce) te kroz dijeljene datoteke (npr.Dropbox).

Ako nije bilo backupa onda su podatci nwjvjerojqtnije izgubljeni osim ako platiš kriminalcima što opet ne gwrantira povrat podataka a i potičeš ih na daljnji rad!

Probaj vratiti iz shadow files ili restore point (malo vjerovatno ali probaj) a mozda pomogne i neki programcic za vracanje obrisanih datoteka.

Naravno, poskeniraj si sa Kaspersky alatom za uklanjanje malwera te HitmanPro i MBAM.

Za ubuduce,neka svaki pc ima MBAE i u browserima uBlock Origin i BitDef.TrafficLight.

Datoteke mozes jednostavno zastititi sa Secure Folders (osim u slucaju Petyja), jednostavno napravi si folder gdje ces trpati sve sto zelis zastititi i kroz SecureFolders ga stavi u "read only"!

To mi se cini nekak najjednostavnije ali svejedno razmisli i pravom offline backupu jer je on najbitniji (neki hdd ti takodjer moze prdnut) pa je backup must have!

Nije ni on bas nesto...(staviti na 2:10min)

Stranica na kojoj mozete saznati s kojom vrstom Ransomware-a ste zarazeni:

https://id-ransomware.malwarehunterteam.com/

=========================================================

Ransomware Removal Kit is a collection of anti-ransomware programs designed to be used by security professionals and system administrators.

Ransomware takes files or the entire computer hostage and pressures the user or administrator of the device into paying a ransom to regain access to files or the system.

Most security experts suggest that ransoms are not paid, as there is no guarantee that an unlock code will be provided and because it encourages further investments into attacks and code improvements.

The suggested course of actions usually involves quarantining the affected system, creating a backup image of the data, identifying the ransomware used in the attack, and eliminating the threat if removal tools are available.

Ransomware Removal Kit helps with the removal of ransomware. Download the 500+ Megabyte archive to the local system and extract it afterwards.

Tools and information are sorted into folders, and it is usually the case that you find one or multiple informational files in each folder, and a software archive containing the ransomware removal program.

Resources are provided as HTML files which you can load in any web browser. They have been saved from websites across the web and provide information about the particular ransomware type the program can remove from the system.

It is a bit unfortunate that the programs are provided as zip archives, as you will have to extract them individually in each subfolder before you can make use of them. A program like Extract Now may be of service as it can parse a directory and all its sub-folders for archives to extract them all at once.

The Ransomware Removal Kit may help you indirectly in the identification of the ransomware used in an attack as the included resources may reveal screenshots and other characteristics about it.

Still, it may be better to use a service like ID Ransomware instead which supports more than 50 different types of ransomware currently. All you need to do is upload the ransom note and/or an encrypted file to have it identified by the service provided that the ransomware is in the service's database.

The resource files may also provide removal instructions which you need to follow.

Closing Words
Ransomware Removal Kit is a collection of resources and programs designed to remove certain types of ransomware. While it is certainly possible to create a similar collection manually, using the kit as a general starting point for your own collection may be a good idea.

All in all, a resource you may want to keep an eye on, especially if you are asked frequently or even regularly to remove ransomware from computer systems.

http://www.ghacks.net/2016/04/16/ransomware-removal-kit/

Nikaj im nije sveto 

Pirate bay zaražen

Malo više info, odakle, zašto :)

Sve datoteke kriptirane TeslaCrypt 3.0 and 4.x možete dekriptirati pomoću BloodDolly's TeslaDecoder.

Upute i download

TeslaCrypt Developers recommend TeslaDecoder to Decrypt Files

Provjereno za TeslaCrypt 3.0

Security researcher Michael Gillespie has created a decrypter that can recover files locked by the MIRCOP ransomware, without paying the ransom fee.

The MIRCOP ransomware appeared towards the end of June and had two unique features that made it stand apart from all the ransomware variants discovered each day.

One of them is its ransom note, which uses the masked Guy Fawkes figure, usually employed by Anonymous hackers. The ransom note has a threatening tone and tells the user to return stolen money or face payback, supposedly from the robbed Anonymous hacker.

The second feature was the exorbitant amount of money asked in the ransom note, which was 48.48 Bitcoin (~$32,000).

Three days after Trend Micro and security researcher Nyxbone revealed the presence of this new family, Gillespie had already put together a decrypter for this threat.

You can download the decrypter from here. Just unzip the file and run the application. The decrypter will leave the original encrypted files in place, just in case the decryption routine fails, so you can use it without fearing you'll lose your original files.

Once the decryption ends, you'll receive a notification message on your screen, like the one pictured below.

If you need help with the decrypter, Gillespie provides support for needy users on this Bleeping Computer forum thread.

Boot crypter? Divno, kao u počecima raznih DAZovih uradaka koji su imali običaj polomiti boot

Opet će biti para. Moram samo neke stvari backupirati na A4 prvo....

U zadnje vrijeme učestali su mejlovi sa zipovanim JavaSript fajlovima. Jednom sam promijenio ekstenziju iz JS u TXT i šaljem Vam CODE na analizu....

http://pastebin.com/cMJrWkCq

Da li se iza ovog krije Ransomware?

Situacija je slijedeća.

Prijatelj mi donio svoj prijenostnik jer mu "ne radi" PowerPoint i "neće otvoriti" PDF dokumente.  

Krenem s instalacijom offica. Ne prolazi s CD pa pokušavam isto uraditi s USB sticka. Nakon par neuspjelih pokušaja i čišćenja s CCleanerom određujem Restore point i nakon toga sve obavim bez problema. Kako sam istovremeno radio još par poslova koji nisu vezani uz taj laptop, nisam obraćao pažnju što se na njemu nalazi. Idem pogledati što je s PDFom i tek onda vidim pravi problem. Dokumenti, slike i video je kriptiran s Helpme @ freespeechmail. org. Podaci na laptopu koji su zaključani uopće nisu bitni, nego mene muči to što se laptop automatski bežično spojio na moju kućnu mrežu. Tri kompa + NAS. Pored toga, ovaj USB s kojim sam pokušao instalirati office je par puta išao iz mog kompa u zaraženi laptop.

Trenutno sam skenirao sve uređaje s malwarebytes i niti na jednom nije pronašao ništa ozbiljno. Čak i na ovom zaraženom laptopu nije bilo ništa osim par nebitinih sitnica. Predpostavljam da je netko prije mene skinuo uljeza jer sam pored instaliranog malwarebyta vidio i instalaciju Spyhuntera. Ili se sam izbrisao nakon što je obavio "posao".

Zanima me da li postoji šansa da se ova gamad prebacila na neko od računala koja su u mreži. Kažem, nakon što sam otpojio laptop, skenirao sam sve sa malwarebytes i sve je bilo OK. Sada sam kućna računala instalirao i Malwarebytes anti ransomware.  Ne znam koliko dugo je zaraženi laptop ali moguće je da to stoji mjescima na njemu. Restore point je bio dostupan u zadnjih 7-8 vraćanja, sve tamo do početka kolovoza.

1. Obično se nakon obavljenog posla obrišu (da se oteža reverse engineering)

2. Po mreži se širi tako da koristi r/w prava korisnika kod kojeg je pokrenut. Ako su ti neki folderi na Everyone: allow read/write onda bi mogao nešto napraviti

3. Ako imaš shareove tako podešene, odmah to mijenjaj!

4. Ako ga nije bilo u sustavu, onda se nije niti mogao prebaciti na mrežu ili stickove...

Hvala na savjetima.

Kriptirani podaci na spornom laptopu uopće nisu bitni niti meni, a niti vlasniku. Krenuo sam s dekripcijom pomoću alata od Kasperskog ali je nakon 10 sati rada odradio svega par posto. Nije mi se dalo dalje čekati i trošiti struju bez veze .

S obzirom da je postojalo barem 7-8 Restore pointa, predpostavljam da uljeza u njemu više nema upravo od perioda od kada postoji najstarija točka vraćanja (početak kolovoza). To je samo moje nagađanje jer nemam uvida da li je netko pokušao čistiti računalo prije nego je došlo meni.

U svakom slučaju, idem još odraditi scan s predloženim alatima, provjeriti šerane fajlove i zamjeniti Malwarebytes s Kasperskim. Predpostavljam da ne smiju raditi oba u isto vrijeme?

Novi opasni Ransomware .Shit je pušten!

http://manual-removal.com/shit-encrypted-files/

http://www.bleepingcomputer.com/news/security/locky-ransomwares-new-shit-extension-shows-that-you-cant-polish-a-turd/