WannaCry vs Deep Freeze.

[WinXPert]

Here are my observations while testing some ransomwares specifically WannaCry2 running inside Deep Freeze 7.51.020.4170

• First. I have two partitions C: and E: with Windows (7 Starter 32 bit) at drive C:
• Both drives are frozen
• WannaCry bleeds in Deep Freeze after switching to Thaw Mode and rebooting
  
• Drive E: is infected while C: is not

This thing happens when you change Deep Freeze's Status and rebooting right away.

How to avoid/prevent bleeding?

• While still in Frozen Status, turn off your PC using the power switch. Don't change status and restart while WannaCry is active or have infected your files.
  
• Boot your PC again, you'll still be in Frozen Status. Observe if there are leftover encrypted files. If none, change to Thaw Mode and reboot. Your files are safe.

Always stay safe while testing

 

[mekelek]

why isn't Deep Freeze reverting everything Wannacry did when you go from Frozen to Thawed??
this is not supposed to happen...

 

[WinXPert]

why isn't Deep Freeze reverting everything Wannacry did when you go from Frozen to Thawed??
this is not supposed to happen...

That's the million dollar question.

 

[mekelek]

That's the million dollar question.

after that little incident Deep Freeze did on my PC, I'm glad i switched to Shadow Defender, has no issues so far. Could you maybe try if this happens with other rollback software like SD or Rollback's product?

 

[Winter Soldier]

Deep Freeze bypass is already happened in the past.

New Chinese Worm Allegedly Bypasses System Rollback Software

 

[JHomes]

Could be for any number of reasons. Deep Freeze works within the OS, so like WSR it's vulnerable to attacks. There's also the whole update debacle of the program being disabled while updating. Did you update anything while Deep Freeze was installed?

Either way, I'm not surprised program acts this way. I have clients who used to use Deep Freeze, then they had corruptions of the frozen state. Many of them went over to Deep Freeze/Reboot Restore Rx Pro, others just re-image the machines, some use Shadow Defender, etc.

Deep Freeze ain't what it used to be that's for sure lol

 

[jamescv7]

after that little incident Deep Freeze did on my PC, I'm glad i switched to Shadow Defender, has no issues so far. Could you maybe try if this happens with other rollback software like SD or Rollback's product?

I guess that can be a typical issue for Deep Freeze, so far Rollback is a good alternative and no issues upon the virtualization process.

Still the best way is to have system image on hand.

 

[Winter Soldier]

The best option for malware testing is using a VM.
Many malware samples are VM aware and can invalidate the test, but safety first!

 

[Danielx64]

Here are my observations while testing some ransomwares specifically WannaCry2 running inside Deep Freeze 7.51.020.4170

• First. I have two partitions C: and E: with Windows (7 Starter 32 bit) at drive C:
• Both drives are frozen
• WannaCry bleeds in Deep Freeze after switching to Thaw Mode and rebooting
  
• Drive E: is infected while C: is not

This thing happens when you change Deep Freeze's Status and rebooting right away.

How to avoid/prevent bleeding?

• While still in Frozen Status, turn off your PC using the power switch. Don't change status and restart while WannaCry is active or have infected your files.
  
• Boot your PC again, you'll still be in Frozen Status. Observe if there are leftover encrypted files. If none, change to Thaw Mode and reboot. Your files are safe.

Always stay safe while testing

Question, at work we have 2 public computers with deepfreeze installed. If someone was to download this bad malware and run it will the machine still be ok after we restart it?

So it like machine infected -> go to start and click restart -> wait for computer to reboot.

Will the bleed happen in this manner?

 

[frogboy]

It is as always best to backup your system with a system image. Just a friendly reminder.

 

[Winter Soldier]

It is as always best to backup your system with a system image. Just a friendly reminder.

Agree 100%, backup is your second life

 

[JHomes]

I guess that can be a typical issue for Deep Freeze, so far Rollback is a good alternative and no issues upon the virtualization process.

Still the best way is to have system image on hand.

Agreed. Rollback added a cool new feature in recent build, you can disable the Subconsole (although the program calls it 'Disable Protection') and you can run disk imager while it's disabled. Works really well, only downside is that it wipes your snapshots but still better than having to un/reinstall.

Don't have to do this if you're running a full backup with Drive Cloner Rx.

 

[shmu26]

Agreed. Rollback added a cool new feature in recent build, you can disable the Subconsole (although the program calls it 'Disable Protection') and you can run disk imager while it's disabled. Works really well, only downside is that it wipes your snapshots but still better than having to un/reinstall.

When you say, "you can run disk imager while it's disabled", do you mean that you can do a system image restore?
Is this feature also in free version?

 

[Deleted member 178]

Agreed. Rollback added a cool new feature in recent build, you can disable the Subconsole (although the program calls it 'Disable Protection') and you can run disk imager while it's disabled. Works really well, only downside is that it wipes your snapshots but still better than having to un/reinstall.

oh didn't noticed that , very nice. Did you tried it?

 

[JHomes]

When you say, "you can run disk imager while it's disabled", do you mean that you can do a system image restore?
Is this feature also in free version?

From what I can gather, it's primarily for running a disk imager to capture an image. For as good as Rollback is, it's always played poorly with 3rd part disk imagers so this seems like devs response to it. I use the Pro Edition so I'm not sure if it's in free version, but I'm going to guess not.

If you don't have the Pro, I think every year they do a Memorial Day sale, so you might be able to nab a license then for a bit cheaper than normal.

oh didn't noticed that , very nice. Did you tried it?

I did! I use Drive Cloner with Rollback so I wouldn't have to use it normally, but I also have a license for Acronis True Image, and I tested the feature with both it and Macrium Reflect. Both worked fine.

Only thing is, it deletes your snapshots when you disable the protection. I think this is why I'll continue to use Drive Cloner, but still if you don't have the option to do so it's nice to know you don't have to uninstall/reinstall. Also, I have to wonder how many times you would need to disable it.

 

[Deleted member 178]

@JHomes i don't mind about my snapshots, they are just for testing stuff. So it is a good news for me.

 

[shmu26]

For as good as Rollback is, it's always played poorly with 3rd part disk imagers

I have used Macrium Reflect with Rollback, and I never had problem making a system image. Of course, when your restore the image, it trashes Rollback.

I think this is why I'll continue to use Drive Cloner

How would you compare it to Macrium Reflect?

 

[WinXPert]

after that little incident Deep Freeze did on my PC, I'm glad i switched to Shadow Defender, has no issues so far. Could you maybe try if this happens with other rollback software like SD or Rollback's product?

Will try to test SD with WannaCry for bleeding

 

[JHomes]

I have used Macrium Reflect with Rollback, and I never had problem making a system image. Of course, when your restore the image, it trashes Rollback.

How would you compare it to Macrium Reflect?

Yeah it trashes Rollback because the disk imager isn't reading the subconsole portion of Rollback, this is why I use Drive Cloner because obviously the devs kno they they need to be able to read it to be competitive.

It's pretty on par with Macrium features wise, I mean Macrium is free and this isn't but it's only like $40 for a license which is not bad at all. I was using Macrium for a long time before, uninstalling Rollback to take a disk image, so I figure the $40 saves me the hassle of having to do that lol.

 

[WinXPert]

Could be for any number of reasons. Deep Freeze works within the OS, so like WSR it's vulnerable to attacks. There's also the whole update debacle of the program being disabled while updating. Did you update anything while Deep Freeze was installed?

Either way, I'm not surprised program acts this way. I have clients who used to use Deep Freeze, then they had corruptions of the frozen state. Many of them went over to Deep Freeze/Reboot Restore Rx Pro, others just re-image the machines, some use Shadow Defender, etc.

Deep Freeze ain't what it used to be that's for sure lol

No updates, I just tested WannaCry2 and nothing else.