IT Thread

[theholycow]

More stuff to block with software restriction policies to prevent CryptoLocker:
http://www.computerworld.com/s/artic...5&pageNumber=2

XP clients:
Path Security Level Suggested Description
%AppData%\*.exe Disallowed Prevent Cryptolocker executable from running in AppData*
%AppData%\*\*.exe Disallowed Prevent virus payloads from executing in subfolders of AppData
%UserProfile%\Local Settings\Temp\Rar*\*.exe Disallowed Prevent un-WinRARed executables in email attachments from running in the user space
%UserProfile%\Local Settings\Temp\7z*\*.exe Disallowed Prevent un-7Ziped executables in email attachments from running in the user space
%UserProfile%\Local Settings\Temp\wz*\*.exe Disallowed Prevent un-WinZIPed executables in email attachments from running in the user space
%UserProfile%\Local Settings\Temp\*.zip\*.exe Disallowed Prevent unarchived executables in email attachments from running in the user space

Vista and newer clients:
Path Security Level Suggested Description
%AppData%\*.exe Disallowed Prevent Cryptolocker executable from running in AppData*
%AppData%\*\*.exe Disallowed Prevent virus payloads from executing in subfolders of AppData
%LocalAppData%\Temp\Rar*\*.exe Disallowed Prevent un-WinRARed executables in email attachments from running in the user space
%LocalAppData%\Temp\7z*\*.exe Disallowed Prevent un-7Ziped executables in email attachments from running in the user space
%LocalAppData%\Temp\wz*\*.exe Disallowed Prevent un-WinZIPed executables in email attachments from running in the user space
%LocalAppData%\Temp\*.zip\*.exe

---------- Post added at 02:41 PM ---------- Previous post was at 02:32 PM ----------

While we're at it, how about software restriction policies for other stuff? Years ago I put a bunch into an identical function in Sophos Enterprise Console. Conduit, for example...

[JayBo]

What are y'all doing about XP being end of life come April?

[stonehenge]

I'm not doing shit since I'm a server guy but the techs have already made lists of machines in their various departments. Then they work with the departments to decide which to retire, which to replace, which are worth upgrading.

Is a mess lol

[theholycow]

More CryptoLocker SRPs:
http://www.bleepingcomputer.com/viru...re-information

I'm not worried about XP EOL. XP machines aren't going to suddenly quit. Threats will still need to get past the same defenses we already have before they get a chance to take advantage of a new flaw that remains unpatched.

[stonehenge]

Well the main IT peeps here block them on the network a little while after EOL since they will no longer be patched (unless you pay MS I think lol fts)

[stonehenge]

rofl: http://en.community.dell.com/support...?pi239031352=1

[theholycow]

[JayBo]

I think we're going to pay the yearly subscription fee to MS that allows us to upgrade any box to W7 or 8, and also any new Server OS's that come out.
I think its 1500/yr or so for W7/8, Server, Office, Microsoft Forefront and for addt'l $$$ can have Exchange.

[theholycow]

So, my software restriction policies may be insufficient. This just ran:
AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9S91UFMI\JavaSetup7u45[1].exe

It wasn't unexpected that it would try to run; I told IE to download and run it. I did expect it to fail, but I see the folder is deeper than the path wildcards I used. Has CryptoLocker been run from a browser like that, or from any other deeper path in AppData?

[stonehenge]

Not sure, I thought the appdataa\*\* would cover allthepaths. I guess not

[theholycow]

That particular path would need AppData\*\*\*\*\*\*\*\*.exe, and there'd need to be a different level for Firefox, another for Chrome...not worried aboot Opera, I'm probably the only Opera user here.

[stonehenge]

put -r in there so it's recursive

like opening cmd and typing ls

[theholycow]

ls works fine for me when I open a cmd prompt. My path includes CygWin.

[stonehenge]

i haz cygwin at home

but when I go to a random person's machine and open cmd to do something I end up typing ls or the wrong \ at least once

[theholycow]

For some years I was network-pushing CygWin in the default domain policy so we could ssh in.

So, just now I had to leave my lunch on my desk and go fix a problem. Problem I expected was projector not set to computer input. Problem I found was some jerk unplugged the VGA cable from the computer.

[stonehenge]

[stonehenge]

http://www.reddit.com/r/talesfromtec..._cryptolocker/

[theholycow]

[theholycow]

[M.B Co]

Ugh. People at work using Google Docs on IE.

[theholycow]

Could be worse.

I just got emailed some screenshots. Were they pasted in the email? No. Were they attached to the email? No. They were pasted in a spreadsheet file that was attached to the email.

[stonehenge]

I get that all the time... they always paste them into an excel or Word file. It's ratard.

[theholycow]

I get Word all the time. I've become numb to that. Excel, though....not so much.

[stonehenge]

rofl yeah the excel ones are definitely more rare (and annoying)

[Cez★]

Who the fuck thinks of pasting pics in excel