SOLVED IE11 is Ad-Infested

[c627627]

I downloaded & ran Malwarebytes & it found 24 items that MSE missed.

It will probably take me until I get some serious problem. I tend to keep something as long as it works.

 

[papadan]

I know but that was 24 entries since the system came on line back in July of this year. Over half were registry entries that weren't removed. I don't feel that it is too bad.

 

[RGone]

http://www.today.com/money/nasty-new-malware-locks-your-files-forever-unless-you-pay-8C11511655

Nasty new malware locks your files forever, unless you pay ransom
Herb Weisbaum NBC News contributor
Nov. 6, 2013 at 10:29 AM ET

If you get this sumbeech you will quit depending on software AV and wish you had been a full time backup expert on a disconnected location. I have followed the reports from all over and over at Bleeping Computer and so far no AV has worked against the Trojan.

 

[c627627]

So... what happens when you connect the drive elsewhere, are all the files zipped and password protected?

 

[papadan]

http://www.today.com/money/nasty-new-malware-locks-your-files-forever-unless-you-pay-8C11511655

Nasty new malware locks your files forever, unless you pay ransom
Herb Weisbaum NBC News contributor
Nov. 6, 2013 at 10:29 AM ET

If you get this sumbeech you will quit depending on software AV and wish you had been a full time backup expert on a disconnected location. I have followed the reports from all over and over at Bleeping Computer and so far no AV has worked against the Trojan.

That's a good reason to know what you are looking at & opening. Do they know where it came from?

 

[RGone]

So... what happens when you connect the drive elsewhere, are all the files zipped and password protected?

Yes...

 

[RGone]

That's a good reason to know what you are looking at & opening. Do they know where it came from?

I have been tracking the results and headaches for a while and it appears that ransomware has been around for a good while. BUT there was a big upswing in late Sept 2013 and really was getting newswrothy in Oct 2013. There was mention of the FBI having taken notice but I have heard nothing about who/what/where. Of course if who/what/where were known, a case would have to be built that would hold up in court so they might know and be still building a case.

The point I tried to make with my own family that has one member that cannot resist opening every email that hits his in-box, that those old days should be over with.

It also seems the methods of infection have branched out. I had family member out of town for awhile and he joined Linkedin and wanted me to do so as well. I did and over the last 7 weeks I have received a very suspicious email that I refuse to open. DELETE with "washing". I mention Linkedin only as I never had such unwanted emails until I joined it.

256Bit encryption on the files the ransomware encrypts and it is estimated brute force with a 'farm' might take 1,000 years to break the encryption.

The bad part is that something similar was around about a decade ago and it became so profitable that instead of $300.00 to unlock the price escalated to at least $2500.00. That warrants execution in my mind. Forcing me to do a business transaction for a service I do not want.

Anyway it was just a head-up. Such stuff never gets talked about until after the fact usually and after the fact is too too late if you sail into this sumbeech.
Gone...Again.

 

[c627627]

Are there multiple zipped files?

Did you try to recover the original files which were deleted after they were zipped?


Just to get an idea, does anyone know what the length of time is to run all 6-8 character password combinations for a single file, using a modern 4GHz+ Intel system, if they were just regular-zipped with WinRAR?

 

[c627627]

RGone, was there any Antivirus software installed on the attacked machines and if so which one?

I tell my family to attach a large external drive to a power strip with an ON/OFF switch and press ON only while making/recovering backups of all personal files to the external drive. I am waiting for malware to get through my Avira Freeware defenses so I can quarantine it and do tests on every Anti-virus software I can get my hands on just to see which one would detect it. That is how I discovered that Avira has one of the best definitions, but I would abandon it if anything ever gets through. Nothing ever did on mine or family's computers. It intercepts stuff on family's computers all the time though. Sorry for your loss. Do not pay them - you will not get the password, you will loose your money.

 

[RGone]

http://www.theregister.co.uk/2013/12/06/cryptolocker_takedown_fizzles/
Fiendish CryptoLocker ransomware survives hacktivists' takedown.
CryptoLocker which encrypts files on infected machines before demanding a ransom of up to 2 BTC (worth just over $2,000 at the time of writing)

That is much later info than I linked previously. It is now suggested just as I previously speculated, the price has gone up.

 

[RGone]

From Bleeping computer forum section for CryptoLocker.

Copied:
Posted 27 November 2013 - 10:51 AM

Just had the crypto (random.pdf.exe) try get delivered through Skype (file transfer). The sender was a senior staff member (remote to us) and his machine is now riddled.

It also emailed users in his address book (which got caught by our filters). Skype could be an open door (along with other IM products).. Busy days ahead
End Copy.

EDIT:
http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information
CryptoLocker Ransomware Information Guide and FAQ
By Lawrence Abrams on October 14, 2013 @ 03:09 PM | Last Updated: November 21, 2013 | Read 318,741 times.
END EDIT.

 

[papadan]

Very interesting, Thanks for the info. RGone

 

[neo668]

Yes. Thanks RGone. Didn't know about CryptoLocker until now. That's one bad malware/virus. And it just started in Sept/Oct 2013. I better be careful.

 

[c627627]

Its signature should be in the data bases of even the products slow to get new threats into their definitions. So unless there is a zero day variant, this is really about using your computer with vs. without any protection which really no one should do.

In threads we've had on the issue in the past, there was always one or two poster who had the approach of "if you're careful where you go, nothing will happen, therefore I don't need a good anti-virus program." Then they find out the hard way what modern life's about.

 

[Jford]

Does anyone else understand how to over ride default cookie handling in IE any version? Internet options, privacy tab, advanced, enable custom cookie handling, accept first party cookies, bock third party, and allow session cookies, changing this setting literally denies all the advertising based cookies access, I never experience pop ups, not irregular browser functions, all; my personal web page setting cookies are preserved in temp internet folder, have set up others computers using this setting for years and never had a single problem, of course Microsoft doesn't publish this, lets face it, everyone want to target marketing to we consumers, I am currently running win 7 pro and IE10, I installed IE 11 last week, but had some issues and uninstalled it for now, I also use google chrome when I need speed and quick searches, but I don't make it the default, I will post additional information in the setting up of windows and the security, in future posts, I just joined tonight while looking for idea's to repair an Nvidia 560TI that recently failed in post, but will get back with that soon, its Battlefield 3 play time with my clanmate, hope this was helpful to someone, thanks and talk to you soon

 

[c627627]

Yes, and here is where you do that in Firefox. Welcome to the forums:

 

[papadan]

Thanks Jford, I just set up my computer this way & will see how it works.
Can't wait for more ideas.