Announcement

Collapse
No announcement yet.

Software Restriction - %appdata% - cryptolocker

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Software Restriction - %appdata% - cryptolocker

    Hi all,
    If you haven't heard of cryptolocker - look it up - very nasty ransomware that encrypts your files - and if you don't pay - files are gone forever (unless you have good backups).

    Ok - I found some info to block this by denying .exe from running in the %appdata% folder. I made software restriction policies denying both %AppData%\*.exe
    %AppData%\*\*.exe

    And this appears to work for the main folder and one subfolder - but if you go down two subfolders, .exe continues to work.

    Is there any way to stop .exe from running in the entire %appdata% folder?

    Thanks,
    Rob

  • #2
    Re: Software Restriction - %appdata% - cryptolocker

    Use FSRM to block executables from being saved in the relevant folder tree. Read up about file screens:

    http://technet.microsoft.com/en-us/l...(v=ws.10).aspx
    A recent poll suggests that 6 out of 7 dwarfs are not happy

    Comment

    Working...
    X