4

I'm IT in a small company. The network is about as ancient as most of the staff (at 30, I'm the company's youngest), and the staff also is notorious for spreading viruses around the network despite our best efforts of warning, virus prevention, and education.

And then ground zero finally hits. Our first machine is infected by Cryptolocker. Fortunately, it has no mapped drives, so only the machine was infected. But that leads me to my questions.

  1. Is there a system minimum requirement for this thing to work? Silly as this may sound, we still run Windows 2000 in the network here (Server 2000 is our main DNS server), though most of the network runs XP and Server 2003. I couldn't find any evidence of their being a system minimum but I'm not about to rule anything out quite yet. I just know our linux and IBM boxes are safe.

  2. This article on BleepingComputer has a lot of information about protecting personal computers (and linked network drives), but is there a way to protect the server itself? CryptoPrevent runs great on the client computers, but we'd like to preemptively protect our servers too. I'm not sure if there's a way to prevent server files from being encrypted from am infected client computer, but anything will help at this point.

Improve this question
6
  • 1
    CryptoLocker holds your files to ransom doesn't it? For most servers I would just wipe and restore from backups. If the backups server was infected I would wipe/re-install and trigger a new system-wide full backup.
    – Ladadadada
    Nov 5, 2013 at 23:38
  • A few supposed Client Server ERP systems out there that demand full user access to the server data tables and client installation are ripe for Darwinian Removal from the gene pool.
    – Fiasco Labs
    Nov 5, 2013 at 23:42
  • 1
    Frequent backups to locations were it can't be overwritten/deleted by malware are the most important countermeasure.
    – CodesInChaos
    Nov 6, 2013 at 11:30
  • Our most important files (we're a sales business) is stored on an IBM iSeries running OS/400 so that's safe. (and our website is run on linux) I'm curious if any of you know how it will affect RAID5 and other redundancies. The servers in question run our email, fax system, phone system, and internal DNS, among other things. They also hold a lot of documentation and reports. They're rebuildable, but I'd rather prevent them from getting affected.
    – Sammy
    Nov 6, 2013 at 17:00
  • 1
    @Sammy Why would RAID matter? RAID 1/5 is nice against broken disks, but it's not a backup.
    – CodesInChaos
    Nov 9, 2013 at 8:38

2 Answers 2

Reset to default
2

  1. This Reddit thread reports "Windows XP through 8 have all reported infections." I suppose it's possible that Win2k and earlier may not be affected - a search through the top 500 comments in that thread has no mention of Windows 2000, and only a single post on BleepingComputer alludes to a Win2k machine. (As an aside for other readers, Windows 2000 has been end of life since July 13, 2010 - so there have been no security patches for 3 years now.)

  2. Assuming you can't run a prevention tool on your servers, and you can't change the access controls, then prevention is very difficult. However, you can mitigate very easily by modifying your existing server backup policies (you do have backups, right?) Extend the backup retention period, increase backup frequency, and increase full snapshot frequency. That way, even if you do get an infection, the damage is limited to any changes made since the most recent snapshot.

Improve this answer
4
  • Unless the backups get encrypted as well
    – CodesInChaos
    Nov 6, 2013 at 11:32
  • That's what I'm worried about. Our current backup is a redundant RAID array (as our sensitive and critical data is on an IBM iSeries machine). I'm not entirely sure how a RAID would handle this, if it would mirror and copy the encrypted files or if CryptoLocker would just encrypt everything from the start. and 2. We are updating our policies on Server2003, but it's the Server2000 we haven't found a solution for yet.
    – Sammy
    Nov 6, 2013 at 17:03
  • 2
    RAID is not a backup. It protects against failed disks but not many other problems. If you delete a file, how do you get it back?
    – Ladadadada
    Nov 6, 2013 at 17:18
  • +1 for RAID is not a backup. It provides additional resilience for whatever is on the drives at the current point in time. Whatever RAID level you use offers no protection against Cryptolocker. You don't have a backup system until you have offsite, offline copies of your data.
    – scuzzy-delta
    Nov 6, 2013 at 20:40
1

From our experience with the virus in a K-12 education setting, the virus is spread primarily through infected email attachments or possibly drive-by downloads. If you are practicing safe computing and your servers are just servers, not workstations, there shouldn't be any risk of the server themselves becoming infected. Only mapped drives from infected clients are at risk. Use best practices and make sure every user has the lest privileged access to the shared folders possible (do they really need write access, or is it just informational documents or marketing material to be printed?) and only the folders necessary. Do they need to be mapped statically or can they use a shortcut in their email or document to access the document? There are BleepingComputer articles (not sure if it is the one you mentioned or not) that list group policy controls you can enable to prevent viruses from being able to run from non-standard directories (http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information#prevent).

Improve this answer
1
  • So far the only computer affected had no mapped network drives. Those who have mapped drives are security-smart but we'd still like to be careful. The servers are that and nothing more. I did read that article, but 2000 has different group policy controls. That's where we've gotten stuck.
    – Sammy
    Nov 6, 2013 at 16:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .