Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3747

Re: Gameover Zeus and Cryptolocker - odd warning

Show all headers | View raw

On 18/06/2014 17:24, James Harris wrote:
> If Crptolocker has encrypted them what's the point of advising
> people to back them up? Wouldn't the backed-up copies also be encrypted?

It would be a waste of time backing them up after they have been 
encrypted, I agree. Though it might be a good idea to do so before they 
are encrypted.

I was involved in a relatively minor infection some time ago. A single 
computer on a network had become infected and started to encrypt some 
files on a server. However the various blocking mechanisms in place 
prevented the full fury being unleashed so no demand appeared. Initially 
it looked as if the server had suffered a storage malfunction - and the 
files were simply restored from backup. Next day, when the same files 
were trashed again, it became clear what had caused it. Re-restore the 
files and clean the affected PC - all was well.

The way in which Crytolocker works requires a mechanism for passing the 
encryption key to a secure location and then delivering it back when the 
ransom has been paid. Strikes me that disruption to that process could 
easily be the thing that could only be achieved for a brief period. Once 
the owners realise what has happened, they will move the servers.

-- 
Rod

Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Gameover Zeus and Cryptolocker - odd warning "James Harris" <james.harris.1@gmail.com> - 2014-06-18 17:24 +0100
  Re: Gameover Zeus and Cryptolocker - odd warning Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2014-06-18 18:06 +0100
  Re: Gameover Zeus and Cryptolocker - odd warning polygonum <rmoudndgers@vrod.co.uk> - 2014-06-18 21:48 +0100
  Re: Gameover Zeus and Cryptolocker - odd warning David Harmon <source@netcom.com> - 2014-06-18 16:12 -0700

csiph-web