Ken Dwight's blog

Way back in February, I was a participant in a project by seven vendors whose clients are IT Support organizations.  Our goal was to create a document that would help your clients prepare for the necessary changes in the way they do business if the Coronavirus escalated into a major concern.  Since then, of course, COVID-19 has been declared a global pandemic.  This declaration has had a dramatic impact on our daily operations and those of our clients.

As an IT Professional, you know all about the rise of encrypting ransomware over the past 6 years.  Ever since the original CryptoLocker was released, in 2013, this has been one of the most widespread, and most damaging, forms of malware.  It has also become, by far, the most profitable type of attack for the criminals who produce and distribute it.

In October of last year I wrote about what was then the newest and most widespread malware infecting computers worldwide, known as CryptoLocker.  At the time I referred to it as “Game-Changing Malware.”  You may read that blog post here: http://www.thevirusdoc.com/blog/cryptolocker-game-changing-malware.

One of the most widespread pieces of malware making the rounds these days is an updated version of a payload that first appeared quite a few years ago.  This malware, known as CryptoLocker, is a form of "ransomware," a program that holds the user's data files hostage until that user pays to have those files released.  I wrote about this type of malware in my book, Bug-Free Computing:  Stop Viruses, Squash Worms, and Smash Trojan Horses, original Copyright 2005.  But CryptoLocker is a much more sophisticated variant of this attack.

All of the major anti-virus software vendors are aware of CryptoLocker, and many have written about it.  There has also been a lot of misinformation and bad advice on the subject from various sources, even some that would normally be considered reputable.  Rather than attempt to reinvent this wheel here, I will offer my general observations and recommendations, followed by a link to a blog post that I believe does an excellent job of presenting the facts about CryptoLocker.

The latest variant of the widespread FBI Moneypak virus has become one of the most difficult malware challenges facing the IT support tech in recent years.  The main source of this difficulty is the fact that the malware disables the boot options on the infected computer.  Thus the tech is unable to boot into Safe Mode or Safe Mode with Command Prompt.

Following extensive research and communications with some of the leading anti-virus vendors in the world, The Virus Doctor™ has developed a simple, mostly automated procedure that cleans these infections in about 10 minutes.  This procedure and the tools necessary to carry it out are now included in the Virus Remediation Training workshops.

In the absence of a procedure such as this, most technicians have been dealing with this malware in one of three ways: