<p>You have probably already heard about very well known type of virus called &#8220;<strong>Cryptolocker</strong>&#8220;.<br />
Each day you can heard about new variant of Cryptolocker virus and based from my experience I can say that Antivirus vendors just can&#8217;t keep up with this kind of threat, because once downloaded Cryptolocker virus changes .exe file names and hashes so it is really hard to track it down.</p>
<p>Following recommendations will help you to protect your PC or your network from a Cryptolocker virus.</p>
<ol>
<li><span style="text-decoration: underline;">Do not use non-supported Operating System</span> like Windows XP. Although you&#8217;ll be more protected using this guide, even if you use an outdated OS like Windows XP, we strongly recommend you to move forward and upgrade to a newer operating system. Microsoft no longer provides security updates or technical support for Windows XP.</li>
<li><span style="text-decoration: underline;">Use good Anti-Virus software protection</span> and make sure your virus definitions are up to date.</li>
<li>Use a<span style="text-decoration: underline;"> third party Firewall or Windows Firewall</span>.</li>
<li>Use <span style="text-decoration: underline;">Windows User Account Control (UAC)</span> in Admin approval mode. When the system or you initiates an .exe file it will ask you for consent or for a password if you are logged on as a standard user.</li>
<li>Always work under <span style="text-decoration: underline;">Windows standard user account</span>. Let Windows ask you for administrative credentials each time you try to install something.</li>
</ol>
<p>Although above mentioned methods will help you have a better protection, it won&#8217;t necessarily protect you from one of the Cryptolocker variants.</p>
<p>In order to prevent cryptolocker virus from activating and therefore start with the encryption of your files here&#8217;s what you can do <strong>if</strong> you are using Windows Professional or Enterprise versions of Microsoft Operating System.<!--more--></p>
<p>Open local policy editor by running <strong>gpedit.msc</strong> and navigate to:</p>
<p><strong>Computer Configuration | Windows Settings | Security Settings | Software Restriction Policies</strong></p>
<p>From the action menu or using a right click select &#8220;<strong>New Software Restriction Policies</strong>&#8221;</p>
<p>Select <strong>Additional Rules</strong> and in the right pane right click and choose to create a <strong>New Path Rule</strong>.</p>
<p>Now add each of the following rules and set Security Level to &#8220;<strong>Disallowed</strong>&#8220;:</p>
<p><strong>%AppData%\*.exe</strong><br />
<strong>%AppData%\*\*.exe</strong><br />
<strong>%LocalAppData%\*.exe</strong><br />
<strong>%LocalAppData%\*\*.exe</strong><br />
<strong><span style="color: #ff0000;"><b>%USERPROFILE%\*\*.exe</b></span><br />
<span style="color: #ff0000;"><b>%USERPROFILE%\*.exe</b></span><br />
</strong></p>
<p><span style="text-decoration: underline;">Update: We had to add complete User Profile folder to this policy, because the virus was using other folders than Appdata folder.</span></p>
<p><strong>%USERPROFILE%\Appdata\*.exe</strong><br />
<strong>%USERPROFILE%\Appdata\*\*.exe</strong><br />
<strong>%USERPROFILE%\Appdata\LocalLow\*.exe</strong><br />
<strong>%USERPROFILE%\Appdata\LocalLow\*\*.exe</strong></p>
<p>Once you&#8217;re done you should get this result:</p>
<p><a href="https://www.wincert.net/wp-content/uploads/2016/02/cryptolocker.png" rel="attachment wp-att-1727"><img class="alignnone size-full wp-image-1727" src="https://www.wincert.net/wp-content/uploads/2016/02/cryptolocker.png" alt="cryptolocker" width="605" height="219" /></a></p>
<p>Close policy editor and restart your machine.</p>
<p>With this policy in place you will prevent starting of executable files from directories that Cryptolocker mostly use.</p>
<p>If you work in a corporate environment you can link above created policy to your domain and thus prevent Cryptolocker from running.</p>
<p>Configure SmartScreen protection using Group Policy. We have a tutorial on how to configure Smartscreen <a href="https://www.wincert.net/security/configure-smartscreen-via-gpo/">HERE</a>.</p>
<p>Feel free to leave your comments and suggestions.</p>

Cryptolocker virus protection
Businesswoman holding tablet pc entering password. Security concept