Crypto-Locker Virus

deafbykhorns

Well, this is how my day started....
Some idiot in our office disabled his AVG (an admin guy mind you) last week because his computer was running slow.
Clicked on a suspicious email at 8:20 yesterday morning which encrypted 30% of our office files. Luckily we had some group policy settings that didnt allow my department files to be destroyed.
This virus holds your files ransom starting at $500 for a key to unlock. Second option is to restore a backup which I had up on a cloud.
28 hours later, I'm just about done cleaning files.
Should I fire this employee???

westmassguy

Yes!

obieone

If the employee willfully disregarded security protocols, then yes. It's like when morons place copper piping in place of fuses, or tape breakers closed.

WilliamM2

Tough question, does he actually work in IT? On my network any other users can't disable, or install anything.

oldmodman

What kind of **** was he looking at?

polkfarmboy

Dont fire , give him a warning.

nooshinjohn

use some steel-toed boots as you boot him through the door...

Devlon

I think it depends on how he has been doing as an employee overall. If he has been a problem in other areas then let him go. If this is an isolated incident, and he is a good employee in general, then just give him a warning. Even brilliant people sometimes make mistakes.

westmassguy

To paraphrase Ron white, "You can cure ignorance, but you can't fix stupid"
Windows, unfortunately, defaults to Administrator when a single account is setup on a PC. I would setup limited user accounts for those who are common sense challenged. If you don't already use centrally managed Antivirus, such as Symantec Endpoint, you might want to look into it. You can lock it down.

JerryR1verz

When stuff like this happens don't you just think about how productive you could have been not dealing with something that was so avoidable??? Did the crypto virus come in an email that included a dropbox link? We saw this one late last week and inevitably someone clicked the link! Our proxy appliance blocked access to the website... thank goodness.

Crypto virus' are all the rage now - high risk!

Msabot1

BS...anti virus software has nothing to do with network speed....and this person is being paid well to be an IT admin?? Enough said!

pitdogg2

Msabot1 wrote: »

BS...anti virus software has nothing to do with network speed....and this person is being paid well to be an IT admin?? Enough said!

well not network speed but they can really slow down your PC. McAfee was the one we needed to get rid of after their "upgrade" it slowed our once fast machine down to a trickle. It tried to do so much (checking pages or whatever) that we went to another well known AVS that alone was the difference took us almost 6mo to figure out. Once McAfee was uninstalled made a world of a difference.

Msabot1

pitdogg2 wrote: »

well not network speed but they can really slow down your PC. McAfee was the one we needed to get rid of after their "upgrade" it slowed our once fast machine down to a trickle. It tried to do so much (checking pages or whatever) that we went to another well known AVS that alone was the difference took us almost 6mo to figure out. Once McAfee was uninstalled made a world of a difference.

Yea...I get that...that McAfee wasn't worth squat since it was introduced....

deafbykhorns

JerryR1verz wrote: »

When stuff like this happens don't you just think about how productive you could have been not dealing with something that was so avoidable??? Did the crypto virus come in an email that included a dropbox link? We saw this one late last week and inevitably someone clicked the link! Our proxy appliance blocked access to the website... thank goodness.

Crypto virus' are all the rage now - high risk!

Came in an email disguised as a PDF file but was an executable script file
Don't those proxy appliances require a lot of management? We only have 15 PCs in our organization...
I had group policies set up so it didn't hit all of our departments. Thank god for the "Cloud"!!

deafbykhorns

westmassguy wrote: »

To paraphrase Ron white, "You can cure ignorance, but you can't fix stupid"
Windows, unfortunately, defaults to Administrator when a single account is setup on a PC. I would setup limited user accounts for those who are common sense challenged. If you don't already use centrally managed Antivirus, such as Symantec Endpoint, you might want to look into it. You can lock it down.

Windows 7 defaults to Standard user when setup in the server properly(just for new users) unless an old profile is copied. I did have a couple old XP machines that were set as admin users and were changed today. I do use a centrally managed AV but the "you cant fix stupid" took over when he disabled the program. Everyone now is on lock down and cant change or delete programs now without a password. Our managed AV has a setup to block emails out of country so I wonder if that would be another safety feature or do most these come in by proxy. I had one come in last week as well with a dropbox link.

westmassguy

deafbykhorns wrote: »

Windows 7 defaults to Standard user when setup in the server properly(just for new users) unless an old profile is copied. I did have a couple old XP machines that were set as admin users and were changed today. I do use a centrally managed AV but the "you cant fix stupid" took over when he disabled the program. Everyone now is on lock down and cant change or delete programs now without a password. Our managed AV has a setup to block emails out of country so I wonder if that would be another safety feature or do most these come in by proxy. I had one come in last week as well with a dropbox link.

I use a VPN for my machine, and a proxy for other activities. These scum will do anything to hide where they're from, so I doubt that blocking feature would help. Your managed AV should have a feature that alerts you via email when someone turns it off.

JerryR1verz

The proxy appliance can be expensive, not really hard to manage. It filters out the obvious stuff you don't want employees to go to while they're supposed to be working. For us it helps give more access to some and limit access to others... also allows certain folks to get to predefined channels on youtube for work purposes and not get to everything else.

I was at a conference and heard a presenter from Symantec say that anti virus is only 30% effective. Security is a multi-layer approach including a/v, internet filter, patch management, AD security, malware detection, security awareness training, and on and on and on.

pitdogg2

JerryR1verz wrote: »

I was at a conference and heard a presenter from Symantec say that anti virus is only 30% effective. Security is a multi-layer approach including a/v, internet filter, patch management, AD security, malware detection, security awareness training, and on and on and on.

you forgot the most important one..COMMON SENSE. this mostly escapes most folks out there today....

JerryR1verz

Point taken. Many times we find ourselves trying to protect the users from themselves... their lack of common sense is at the core of it.

fossy

deafbykhorns wrote: »

28 hours later, I'm just about done cleaning files.
Should I fire this employee???

shoot first and ask questions later !!!!!! Y does this employee have access to disable anything ? oo ok an admin .....wow