• SONAR
  • WARNING VIRUS CRYPTOLOCKER!! I LOS ALL MY SONAR PROJECTS (p.3)
2016/12/29 08:35:37
Atsuko
liberty
The virus encrypted the files in only an hour while I was editing a project that I uploaded from a pendrive


Juan,
this year I had a very bad virus problem in my laptop and I was luck to find this site: http://www.suggest-a-fix.com/ 
The moderator named Broni stayed with me until my machine was cleaned.  Maybe you can find some help there.
Good luck!
2016/12/29 08:41:58
pwalpwal
chuckebaby
However there are ways to decrease your chances of an attack.
-Don't open attachments you are not sure about.
-Don't click on links sent you in emails (unless you know exactly who they are) Some links, using prefixes and familiar name beginnings. Example: FaceBooks com. Attackers are getting smarter by the minute.
-Don't ever download something you are not sure about.



this ^^^^
plus, use browser add-ins such as ad-block and no-script
2016/12/29 08:44:52
bitflipper
That really sucks, man. I've had a couple of my customers hit by it, and at least at the time I last investigated it (~3 years ago) there was no cure. Needless to say, those customers now do backups religiously!
 
I'd definitely explore microapp's suggestion above, though. Here's some information about how the virus was reverse-engineered, which led to the arrest of the original instigator. Unfortunately, the script kiddies got hold of it and decided they wanted to be millionaires, too. 
 
Be warned that these viruses attack every drive they can detect, including external drives and mapped network shares. Backups are therefore only a preventative if you make your backup and then disconnect the drive. Note that it only checks for mapped drives (that have been assigned a drive letter). Because my day-job software depends on a shared folder, I've since abandoned my previous habit of mapping it to a drive letter and now reference it via a UNC path (e.g. \\server\share_name). But mostly I encourage my users to make frequent backups.
2016/12/29 12:13:26
markyzno
I infected a machine with a variant of this the other day under Lab conditions (I work in Information Security). Unfortunately where Sonar defaults its files is normally where Crypto starts to encrypt the files.
 
Very sorry to hear of your woes and there has been some sound advice here, namely "Backup". Do a weekly or daily if you can and then keep that backup offline. Even better, do a backup of a backup also.
 
I *never" put USB drives into my machine without checking them out first - I have a "dirty" laptop that has multiple VMs to infect which I will try these things on first.
2016/12/30 23:09:40
Blades
Here's an option that I think should work for you guys to be able to create automatic backups to ttached drives (internal or external) or even another computer on your network if you have one, but will also protect those backups from being mowed down by a virus such as this (actually a malicious encryption program if you want to be literal).
 
In business we use Crashplan (Pro) for a number of clients for offsite backups.  Well, Crashplan also makes a personal version that is free if you are only using your own storage (i.e. not CP Cloud copies).  What's different about this from something like FreeFileSync or a Robocopy or something is that the local copy that is made is encrypted so that it is not readable outside of the Crashplan environment.  When you backup or restore, you use the Crashplan application to do it, which uses an ID/Password and the signature derived from the computer itself to encrypt the files.  From Windows Explorer, they are just a bunch of unreadable files - ironically, kind of like what you are trying to protect them from! but YOU are controlling the process instead of some criminal.
 
Here's some info about the Archives and why: https://support.code42.com/CrashPlan/4/Backup/CrashPlan_Archives
Here's where you can get the free copy for download: https://www.crashplan.com/en-us/download/
 
This is a legitimate backup company, not some Shareware/Freeware thing.  Check it out.  Interested in your feedback if you have any.
 
I have been slack here at the house for some time and this kicked me into gear to do this for myself as well - I harp on it many times a week to people at the office and I'd be pretty sad if I lost all my work.  Drive space is cheap.  The program is free.  What's the downside?
2016/12/30 23:22:16
Blades
Here's an option that I think should work for you guys to be able to create automatic backups to attached drives (internal or external) or even another computer on your network if you have one, but will also protect those backups from being mowed down by a virus such as this (actually a malicious encryption program if you want to be literal).
 
In business we use Crashplan (Pro) for a number of clients for offsite backups.  Well, Crashplan also makes a personal version that is free if you are only using your own storage (i.e. not CP Cloud copies).  What's different about this from something like FreeFileSync or a Robocopy or something is that the local copy that is made is encrypted so that it is not readable outside of the Crashplan environment.  When you backup or restore, you use the Crashplan application to do it, which uses an ID/Password and the signature derived from the computer itself to encrypt the files.  From Windows Explorer, they are just a bunch of unreadable files - ironically, kind of like what you are trying to protect them from! but YOU are controlling the process instead of some criminal.
 
Here's some info about the Archives and why: Explanation
Here's where you can get the free copy for download: Download
 
I have been slack here at the house for some time and this kicked me into gear to do this for myself as well - I harp on it many times a week to people at the office and I'd be pretty sad if I lost all my work.  Drive space is cheap.  The program is free.  What's the downside?
 
This is a legitimate backup company, not some Shareware/Freeware thing.  Check it out.  Interested in your feedback if you have any.
2016/12/30 23:31:28
Blades
I have tried to post to this thread a few times, but I am not able to - I have a useful piece of info that could help here.  This post is to test if it's my content or this thread that is preventing me.
2016/12/30 23:31:56
Blades
Here's an option that I think should work for you guys to be able to create automatic backups to attached drives (internal or external) or even another computer on your network if you have one, but will also protect those backups from being mowed down by a virus such as this (actually a malicious encryption program if you want to be literal).
 
In business we use Crashplan (Pro) for a number of clients for offsite backups.  Well, Crashplan also makes a personal version that is free if you are only using your own storage (i.e. not CP Cloud copies).  What's different about this from something like FreeFileSync or a Robocopy or something is that the local copy that is made is encrypted so that it is not readable outside of the Crashplan environment.  When you backup or restore, you use the Crashplan application to do it, which uses an ID/Password and the signature derived from the computer itself to encrypt the files.  From Windows Explorer, they are just a bunch of unreadable files - ironically, kind of like what you are trying to protect them from! but YOU are controlling the process instead of some criminal.
 
I have been slack here at the house for some time and this kicked me into gear to do this for myself as well - I harp on it many times a week to people at the office and I'd be pretty sad if I lost all my work.  Drive space is cheap.  The program is free.  What's the downside?
 
This is a legitimate backup company, not some Shareware/Freeware thing.  Check it out.  Interested in your feedback if you have any.
2016/12/30 23:39:40
Blades
I guess the links are what it isn't allowing me to post for some reason.  
 
Since it won't let me post the links, here is the download one spelled out (ugh):
http : // www DOT crashplan DOT com / en-us / download
 
Here's info about the reason for the archive type:
http : // support DOT code42 DOT com / CrashPlan / 4 / Backup / CrashPlan_Archives
2016/12/31 00:49:11
John
Blades I restored your first post. Let me know which ones you would like me to restore. Sorry you were blocked by the software. 
© 2026 APG vNext Commercial Version 5.1

Use My Existing Forum Account

Use My Social Media Account