Security → Re: U R infected ........, pay us $300 in Bitcoins

It seems that between Malwarbytes Pro and adjustments to Group Policy, as defined in the Bleeping Computer post, I should be able to thwart this menace. My problem is that I have no experience with Gpedit. Would someone like to post, or IM me, a quick and easy how-to enter those Path Rules in the Bleeping Computer post?

Thanks

Joe P

UPDATE: I may have the answer to my request in that I stumbled upon a program called CrypoPrevent. It makes the following statement:

CryptoPrevent is based on the excellent prevention information from Grinler found here: »www.bleepingcomputer.com ··· ormation and will block the infection from executing

It can be found here:

»www.foolishit.com/vb6-pr ··· prevent/

Has anyone seen this or tried this yet??

joepwpb, thanks for posting this tool. I imaged my sys drive and installed it this morning.

Question to anyone- does running MBAM Pro realtime component conflict with AV such as Avira, Eset or NAV?

No, it shoudln't conflict, as it's an antimalware program, not an antivirus program. Some security programs install routine will detect it and not install unless MBAM is first removed, but simply reinstalling MBAM after the other security software is installed will fix the problem.

Thanks for the info TheJoker!

Yes, I implemented Software Policy Restrictions on my home box, which has Windows 7 Pro and therefore allows secpol.msc to be run. Click Start, Run, type "secpol.msc" and press [Enter] to start this process. Add new path restrictions under "Software Restriction Policies" -> "Additional Rules" by right-clicking "Additional Rules" and choosing "New Path Rule".

I blocked %AppData%\*.exe, %AppData%\*\*.exe, and four %Temp%\XXX\*.exe where XXX was *.zip, 7z*, Rar*, and wz*. When I rebooted, this immediately broke Cubby, Dropbox, and LogMeIn's Firefox module, so I had to explicitly allow those .exes.

For most home users this won't work - home versions of Vista and Windows 7 don't support SRPs.

Yes and no -- there's no GUI, but most of the plumbing is there on other SKUs. The aforementioned CryptoPrevent appears to be generating the SAFER entries in the Registry on Win7 Starter and the system appears to be generating what looks like SRP alert to me when I exercise one of them.