Cerber Ransomware

[torin3]

A user just got hit with this at my work. Fortunately we got the system unplugged from the network before it could encrypt anything on the network mapped drives.

Looks like it infects through unpatched flash.

Just thought I'd pass this along, FYI.

Now to format and do a fresh install of the OS.

 

[rbstern]

Thanks for the heads up!

For those of you who aren't familiar, this type of attack is increasing, in some cases, with life-threatening consequences. A similar ransomware attack hit Hollywood Presbyterian Medical Center earlier this year, shutting down a variety of systems, including important treatment and life saving gear in the radiology, oncology and emergency departments. Literally, a matter of life and death because of malware. The hospital paid $17,000 in ransom.

For most of us, the stakes aren't that high, but still: Make sure your data is backed up, your systems are patched, and you are suspicious first of all things attached.

 

[Vestipa]

If your files are crypted by Cerber Ransomware, the only way to encrypt them is to get a Master Key code. If you have an automatic backup on your PC you can try to restore them. I found this information on a german antimalware virus-entferner page: http://www.virus-entferner.de/2016/05/02/cerber-ransomware-virus-entfernen/
Use the Previous Versions feature

The Windows OS provides a built-in option of recovering previous versions of files. It can also be applied to folders. Just right-click on a file or folder, select Properties and hit the tab named Previous Versions. Within the versions area, you will see the list of backed up copies of the file / folder, with the respective time and date indication. Select the latest entry and click Copy if you wish to restore the object to a new location that you can specify. If you click the Restore button, the item will be restored to its original location.