You’re infected—if you want to see your data again, pay us $300 in Bitcoins

Re:You’re infected—if you want to see your data again, pay u... by bcoates on Thursday October 17, 2013 @07:55PM (#6568974)

Don't do that, that's crazy. If you don't want your users running random binaries turn on applocker: http://technet.microsoft.com/en-us/library/dd723683(v=ws.10)...

If the "1002.exe" sample on Reddit is accurate the installer is unsigned, so forbidding unsigned binaries should be sufficient. The number of legitimate unsigned Windows binaries is small enough that you should be able to whitelist them by hand.

[ Parent | on HN ]

Re:You’re infected—if you want to see your data again, pay u... by ary on Thursday October 17, 2013 @09:31PM (#6569257)

AppLocker can't be enforced on Windows 7 Professional (or lower). In my case that was a deal breaker.

http://technet.microsoft.com/en-us/library/ee424382.aspx

That being said a very restrictive Software Restriction Policy as linked below would mitigate CryptoLocker as it exists today. It has worked well for me so far.

http://www.mechbgon.com/srp/

[ Parent | on HN ]