• Welcome to Overclockers Forums! Join us to reply in threads, receive reduced ads, and to customize your site experience!

Cerber Ransomware

Overclockers is supported by our readers. When you click a link to make a purchase, we may earn a commission. Learn More.

torin3

Member
Joined
Dec 25, 2004
A user just got hit with this at my work. Fortunately we got the system unplugged from the network before it could encrypt anything on the network mapped drives.

Looks like it infects through unpatched flash.

Just thought I'd pass this along, FYI.

Now to format and do a fresh install of the OS.
 

rbstern

Registered
Joined
Nov 3, 2015
Location
Georgia
Thanks for the heads up!

For those of you who aren't familiar, this type of attack is increasing, in some cases, with life-threatening consequences. A similar ransomware attack hit Hollywood Presbyterian Medical Center earlier this year, shutting down a variety of systems, including important treatment and life saving gear in the radiology, oncology and emergency departments. Literally, a matter of life and death because of malware. The hospital paid $17,000 in ransom.

For most of us, the stakes aren't that high, but still: Make sure your data is backed up, your systems are patched, and you are suspicious first of all things attached.
 

Vestipa

New Member
Joined
Jul 25, 2016
If your files are crypted by Cerber Ransomware, the only way to encrypt them is to get a Master Key code. If you have an automatic backup on your PC you can try to restore them. I found this information on a german antimalware virus-entferner page: http://www.virus-entferner.de/2016/05/02/cerber-ransomware-virus-entfernen/
Use the Previous Versions feature

The Windows OS provides a built-in option of recovering previous versions of files. It can also be applied to folders. Just right-click on a file or folder, select Properties and hit the tab named Previous Versions. Within the versions area, you will see the list of backed up copies of the file / folder, with the respective time and date indication. Select the latest entry and click Copy if you wish to restore the object to a new location that you can specify. If you click the Restore button, the item will be restored to its original location.