Undetected cerber3 in ammyy setup

[SHvFl]

for the future: put your user account control on highest setting. then cerber (and most other malware) won't be able to run unless you specifically allow it.

This is totally wrong info. Ransomware don't need to elevate to encrypt files and those that need elevation do it for other reasons. Take a look here if you are not convinced.

 

[_CyberGhosT_]

Here the problem is that the site has always been like that. Perhaps a new user would think it suspect, but someone accustomed to it (which is my case) wouldn't have any suspicion. And even so, it is a tool that we ask our customers to install when we want to do remote support, and they usually have no clue about computers and will run the exe anyway. "Fortunately" I was infected before we could ask another customer to install it. I can't imagine the consequences of a customer losing all its data because of us.
I hope this post and the submissions I made to the antivirus companies will prevent this kind of propagation.

Sure, understood. And in the name of providing the best service you can to customers, have you considered moving away from the free solutions and maybe to a more secure Paid software.
TeamViewer is a good one and they offer custom paid plans for small businesses ?
Thats just one, there are quite a few that could suit your needs.

 

[_CyberGhosT_]

This is totally wrong info. Ransomware don't need to elevate to encrypt files and those that need elevation do it for other reasons. Take a look here if you are not convinced.

Thanks for this, Shamu and I have had this discussion before, UAC is crap and can be bypassed, VoodooShield is my surrogate UAC
its far more reliable than UAC. While UAC does afford some level of protection, advanced users are smart to be weary of it and
bolster it, I do this with VS.

 

[Evjl's Rain]

Thanks for this, Shamu and I have had this discussion before, UAC is crap and can be bypassed, VoodooShield is my surrogate UAC
its far more reliable than UAC. While UAC does afford some level of protection, advanced users are smart to be weary of it and
bolster it, I do this with VS.

@_CyberGhosT_, do you completely disable UAC (everything is elevated -> risky) or just set it to "do not dim..." or you still have enableLUA = 1 with UAC at lowest level?

 

[SHvFl]

Thanks for this, Shamu and I have had this discussion before, UAC is crap and can be bypassed, VoodooShield is my surrogate UAC
its far more reliable than UAC. While UAC does afford some level of protection, advanced users are smart to be weary of it and
bolster it, I do this with VS.

UAC main point of protection is securing Program files and Windows folders. That's the only use i have for it and it's doing a pretty good job at it.

 

[_CyberGhosT_]

@_CyberGhosT_, do you completely disable UAC (everything is elevated -> risky) or just set it to "do not dim..." or you still have enableLUA = 1 with UAC at lowest level?

I can run with it completely disabled with VS on guard and often do. If I am on a website I think looks a bit untrustworthy I will set it to "do not dim"
Thanks for asking.

 

[Sumit Verma]

paid them, the link opened, downloaded decryptor.exe

doesnt run, now the link is also not opening for the support

 

[LabZero]

paid them, the link opened, downloaded decryptor.exe

doesnt run, now the link is also not opening for the support

Bad situation...for the future the best protection, outside your security level, is prevention with a good data backup plan on external and offline support.

Our expert maybe can help you.

Malware Removal Assistance

 

[shmu26]

@SHvFl thanks for clarification.
cerber is in fact one of those nasty ransomwares that will encrypt even before connecting to C & C.
so according to what you saying, the UAC prompt will come after the encryption already took place?

 

[Sumit Verma]

Please do not pay, you will get nothing

 

[SHvFl]

@SHvFl thanks for clarification.
cerber is in fact one of those nasty ransomwares that will encrypt even before connecting to C & C.
so according to what you saying, the UAC prompt will come after the encryption already took place?

Don't know exactly how cerber works and if it's so bad coded that it needs uac to do anything but i doubt it. Encryption doesn't need elevation if you stay out of protected locations so a ransomware doesn't need to prompt uac. Now if cerber does and if you block it doesn't encrypt then it's bad design by the developer but don't hope all devs will do the same mistakes.

 

[shmu26]

Please do not pay, you will get nothing

but don't give up yet,
do try the MT malware recovery expert:
Malware Removal Assistance

 

[shmu26]

Don't know exactly how cerber works and if it's so bad coded that it needs uac to do anything but i doubt it. Encryption doesn't need elevation if you stay out of protected locations so a ransomware doesn't need to prompt uac. Now if cerber does and if you block it doesn't encrypt then it's bad design by the developer but don't hope all devs will do the same mistakes.

so what does ransomware need, in order to get to the stage of encrypting?
does it need powershell, or script interpreters?

 

[LabZero]

UAC with administrator user doesn't stop the ransomware.
Something more you can get with UAC enabled and standard user but a lot of recoded variants around.

 

[shmu26]

so what does ransomware need, in order to get to the stage of encrypting?
does it need powershell, or script interpreters?

okay, I think I get it now.
ransomware can be delivered in various ways. it can be delivered by powershell or script, but that is not the only way to deliver it.

 

[Sumit Verma]

firefox downloaded corrupt file

downloaded from chrome and same happened

now downloaded from Edge and ITS WORKING, files are being decrypted... finally

 

[shmu26]

firefox downloaded corrupt file

downloaded from chrome and same happened

now downloaded from Edge and ITS WORKING, files are being decrypted... finally

thanks for sharing the good news
what a saga

 

[Sumit Verma]

hell they know how to make money by hanging sword on someone's neck

 

[shmu26]

hell they know how to make money by hanging sword on someone's neck

if you make good backups, their sword turns into a wet noodle.

 

[SHvFl]

okay, I think I get it now.
ransomware can be delivered in various ways. it can be delivered by powershell or script, but that is not the only way to deliver it.

Correct. They can use what you mentioned to do various stuff but it doesn't mean they have to use them.