No affiliation, just a user.
I'm so sick of this. The "open/save" dialog is in sore need of being revamped. There's really no such thing as "open" anyway -- it's really "save to some obscure profile temp directory and then open". Try explaining "you can't open a file that's not first saved to disk" to a user, though.
What I recall from my initial investigation was that the binary was completely different, but opening the image did not indicate any changes. Almost like it was converted from RGB to CMYK or something.
In the confusion, I missed that JPGs with certain naming patterns were encrypted and others were left alone. I took two unrelated facts, 1) that plenty of images were readable, and 2) that plenty of images had binary differences, and put them together to arrive at a faulty conclusion. I am not going to be too hard on myself based on how that day was going for me.
IMG_????.jpg and presumably DSC?????.jpg were encrypted and other patterns were left alone. I presume this is to inflict damage as quickly as possible without getting bogged down encrypting stuff from "Temporary Internet Files" for hours.
I wonder if they'd improve their conversion rate by leaving behind a thumbnail to remind people of how much they liked their pictures that now risk being gone forever.
I want to believe. I really do. But I'm not so sure based on personal experience.
This article made the rounds recently, and I think it is apt: http://www.coding2learn.org/blog/2013/07/29/kids-cant-use-co...
The pull-only archive w/ VSS versions really is massively convenient. It is the first line of defense against the scenario that comes up almost all of the time: "Help, I messed up this important file!"
Pull-only backups were the savior here, although because we didn't notice until the next day, the pulled backups on that system were also overwritten with encrypted/corrupt files. Luckily we had VSS versioning on the pull-only backup location. There was a close call in that the 2 TB or so of "new" data ended up pushing VSS over quota and we almost lost our good versions of the files that way. If not for the VSS versions, we would've had to resort to cold backups which would've been a bit older. As it stood, no file recovered was more than a few hours old.
Auditing on the file share indicates which workstation was infected. Pertaining to that: it surprises me that in 2013, a default install of Windows will not log any useful information about shared folders by default. You must enable object auditing in Group Policy and specifically declare which users or groups are subject to said auditing on a share-by-share basis. In a world without logrotate, I suppose a sensible default is to just let a bunch of shit happen without recording it.
What gets me wound up most of all is the amount of engineering involved for an average home user to protect themselves. I thought a Mac with Time Machine was enough, but a similar virus would easily corrupt those backups if they were available to it over a mapped drive.
It is the goddamn 21st century, and users are still losing work by overwriting documents by accident, or opening a document as an e-mail attachment and not being able to find the actual file they edited. Should people really need an IT guy with ten years of experience to be protected from simple mistakes? Google has made progress on that front with the Chromebook, I suppose.