Cerber paid a visit

On December 23rd the latest version of Cerber paid a visit to one of my customers. Strangely enough, all it managed to do was post the ransom note (red background to text) on the desktop. Nothing was encrypted.

 

A Windows 10 professional machine, on domain

 

The defenses in place where:

Windows Defender

Flash disabled on all installed browsers

windows scripting host disabled

execute disabled in temp folders by group policy

 

When I first looked at the machine, Windows Defender was disabled. In the Windows notification pane I can see that Defender tried to remove the malware 17 times immediately after the infection occurred.

 

The defenses used where real easy to implement. Hope this info helps someone.

There is an ongoing discussion in this topic where you can post comments, ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

• Cerber Ransomware Support Topic - #DECRYPT MY FILES#.vbs, .txt, .html

Rather than have everyone with individual topics, it would be best (and more manageable for staff) if you posted any more questions, comments or requests for assistance in the above support topic discussion...it includes experiences by experts, a variety of IT consultants, end users and company reps who have been affected by ransomware infections. To avoid unnecessary confusion, this topic is closed.

Thanks
The BC Staff