A new variant of the CryptoLocker virus has been released around the world and we have already seen a couple of fresh infections. This ransomware infects your PC’s, external drives, pen drives and even entire networks. Once infected, it locks any files found in these locations by encrypting them with a randomly generated key and demands a ransom to unlock your company data. Its entry point into networks is via emails appearing to be from The Office of State Revenue (or other Government Agency) indicating the user has received a fine and needs to download the form from the website.

Recovery from an infection of this variant of CryptoLocker involves downtime, while infected company files are identified and then restored from backup.

Once a file is encrypted it is impossible to get it back without paying the money or recovering from a recent backup. DON’T be tempted to connected your backup drives into an infected computer to check that the backups  are there.

What you need to do

1. If a computer is infected, please disconnect it from the network, shut it down straight away and call PC Wrangler.
2. Educate users on how to avoid infection. Never open attachments or emails from unknown or suspicious senders. Never open an attachment or email that is not expected.
3. Ensure server and data backups are monitored daily and tested regularly in case file restoration is required.
4. Ensure Antivirus software is up to date and is able to detect and remediate CryptoLocker. Some Antivirus packages are not able to detect and protect against this Cryptolocker variant.
5. Ensure your firewall is blocking and able to block peer-to-peer torrenting traffic and other unsafe web traffic as this is another potential entry point for the virus.
6. Ensure that your emails are protected by a best-practice anti-spam and anti-virus filtering service.

If you are unsure about anything, contact PC Wrangler on 02 4390 4352 right away!