I admit that getting a whitelist working can take a bit of work, but as long as you don't slap your entire domain with it right away, it's not hard and should not cause many issues going forward.Īntivirus has its role, as does everything else - it's all about layers. Don't fall in to the common trap of blocking AppData, because a blacklist will never be enough. That alone would have stopped this from happening - it doesn't need admin rights, and I've heard of it coming from otherwise legitimate sources, but if it can't execute it can't encrypt. You'll not regret it.īryan Doe has a really nice how-to about this: Software Restriction Policy and whitelisting. I take this very seriously, but it escaped the net simply because of webmail access. We use Trustwave for Mailmarshal & Webmarshal. I had everything back running for start of business the next day. We still ended up basically being unavailable for business for the afternoon. Once I figured out the infected machines, and verified the replications weren't infected I could breathe again. about 18 minutes after our replication of the aboves servers was successfulyl completed by Veeam. ESET began cleaning up when it was too late. I saw the HELP_DECRYPT files.ĮSET missed it. It infected 3 servers a client Terminal Server, and a SQL and F&P server (the latter two being mapped drives from the client TS). A management decision as such - good for morale. The time of infection coincides with a user accessing a particular webmail company. We got infected last Thursday with what seems to be CryptoWall 3.0.

Crypto locker regex