{"id":150,"date":"2022-11-15T11:56:45","date_gmt":"2022-11-15T11:56:45","guid":{"rendered":"https:\/\/data-recovery.gr\/?page_id=150"},"modified":"2024-04-02T11:57:32","modified_gmt":"2024-04-02T11:57:32","slug":"ransomware","status":"publish","type":"page","link":"https:\/\/data-recovery.gr\/en\/ransomware\/","title":{"rendered":"Ransomware"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

What is Ransomware?<\/h2><\/div>
Let's start from the basics. In the following article we give you 13 answers about what is Ransomware and how to deal with it.<\/b><\/div>
\u00a0<\/div>
Ransomware are malicious software which attack and encrypt their victims' data. Then the victim is being asked to pay ransom in Bitcoin, in order to have their data decrypted.<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Ransomware is getting smarter over the years, and even advanced users can become their victims.<\/div>
\u00a0<\/div>
\u03a7<\/span>\u03c1\u03b7\u03c3\u03b9\u03bc\u03bf\u03c0\u03bf\u03b9\u03bf\u03cd\u03bc\u03b5 \u03cc\u03bb\u03b5\u03c2 \u03c4\u03b9\u03c2 \u03b4\u03b9\u03b1\u03b8\u03ad\u03c3\u03b9\u03bc\u03b5\u03c2 \u03c4\u03b5\u03c7\u03bd\u03b9\u03ba\u03ad\u03c2 \u03b3\u03b9\u03b1 \u03bd\u03b1 \u03bc\u03c0\u03bf\u03c1\u03ad\u03c3\u03bf\u03c5\u03bc\u03b5 \u03bd\u03b1 \u03b1\u03c0\u03bf\u03ba\u03c1\u03c5\u03c0\u03c4\u03bf\u03b3\u03c1\u03b1\u03c6\u03ae\u03c3\u03bf\u03c5\u03bc\u03b5 \u03c4\u03b1 \u03b4\u03b5\u03b4\u03bf\u03bc\u03ad\u03bd\u03b1 \u03c0\u03bf\u03c5 \u03ad\u03c7\u03bf\u03c5\u03bd \u03b5\u03c0\u03b9\u03bc\u03bf\u03bb\u03c5\u03bd\u03b8\u03b5\u03af, \u03cc\u03bc\u03c9\u03c2 \u03ba\u03ac\u03c0\u03bf\u03b9\u03b5\u03c2 \u03c6\u03bf\u03c1\u03ad\u03c2 \u03b5\u03c1\u03c7\u03cc\u03bc\u03b1\u03c3\u03c4\u03b5 \u03c3\u03c4\u03b7 \u03b4\u03c5\u03c3\u03ac\u03c1\u03b5\u03c3\u03c4\u03b7 \u03b8\u03ad\u03c3\u03b7 \u03bd\u03b1 \u03b5\u03bd\u03b7\u03bc\u03b5\u03c1\u03ce\u03c3\u03bf\u03c5\u03bc\u03b5 \u03c4\u03bf\u03c5\u03c2 \u03c0\u03b5\u03bb\u03ac\u03c4\u03b5\u03c2 \u03bc\u03b1\u03c2 \u03cc\u03c4\u03b9 \u03bf\u03cd\u03c4\u03b5 \u03ba\u03b9 \u03b5\u03bc\u03b5\u03af\u03c2 \u03c0\u03bb\u03ad\u03bf\u03bd \u03bc\u03c0\u03bf\u03c1\u03bf\u03cd\u03bc\u03b5 \u03bd\u03b1 \u03ba\u03ac\u03bd\u03bf\u03c5\u03bc\u03b5 \u03ba\u03ac\u03c4\u03b9 \u03b3\u03b9\u03b1 \u03bd\u03b1 \u03c4\u03bf\u03c5\u03c2 \u03b2\u03bf\u03b7\u03b8\u03ae\u03c3\u03bf\u03c5\u03bc\u03b5.<\/span><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

How does a Ransomware work?<\/h2>
We've prepared a guide in order to help anyone who's interested understand some simple rules they need to follow to avoid getting infected by Ransomware.<\/div><\/div>

<\/span>Following these steps, you will be able to protect your computer from infections and protect your self, your data, your work and your beloved ones from sad events.<\/span><\/div>
We suggest you to follow this guide. If it seems too complicated for you, ask help from someone who is more tech savvy than you.<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

How does a Ransomware work? See the video!<\/h2>
In the following video you can see Petya Ransomware in action. You have a chance to see what you must NOT do if you see something similar happening in front of your eyes.<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In the following steps you can read advices about what to do to protect your home or office compiters from being encrypted.<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

How does a computer get infected by Ransomware?\u00a0<\/h2>
Here are 13 simple answers that will help you keep infections away.<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Rule #1: Do you have a Backup?<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Not much to say here, this is the most basic rule that you need to follow regardless if there's a chance to be targeted by Ransomware or not. In case you have a recent backup and get attacked by Ransomware, the only thing you have to do is to remove the infection and restore your files from the backup.<\/p>

Unfortunately, adding a hard drive to your computer and keeping your backups there is not a solid backup plan. The reason is that in case of a Ransomware infection, all local storage means will get targeted and all network devices will get infected too (sometimes even network drives that are not mapped). This means that your local or remote backup storage devices will get encrypted too.
Aurora Ransomware \u03bb\u03cd\u03c3\u03b7 back Up<\/p>

There are two ways to overcome this:\na) Keep your backups to the Cloud, whatever that means (cost, confidentiality issues, slow access)\nb) Keep your backups to a device that you disconnect after the backup procedure is done.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Rule #2: Do you have a proper antivirus?\n<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Make sure your computer is being protect by a decent antivirus program. We suggest using antivirus, anti-ransomware and anti-exploit software that can analyze your computers behavior and protect you if something starts to behave erratically, even if the infection is from a new strain (zero day tolerance).<\/p>

\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Rule #3: Do you update your operating system?\n<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t Most Ransomware are installed through scripts called exploit kits. These kits target weaknesses and security holes of the operating system (eg. Windows). If you get notified about new updates of your operating system, install them. More often than not, these updates patch critical security holes.\nMicrosoft publishes updates on Patch Tuesday, which is every second Tuesday of the month, so you should be prepared to install these updates and restart your computer that day.\nThe rest operating systems, such as Linux distros or Apple OS, publish their updates whenever there's a need for them. Make sure to install them.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Rule #4: Do you keep your installed software up-to-date?<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
It's the same as with the operating system: The exploit kits target security holes in installed software like Java, Adobe Flash Player, Adobe Reader etc.<\/div>
\u00a0<\/div>
Therefore, it is absolutely critical to have these application updated.<\/u><\/i><\/span><\/div>
\u00a0<\/div>
For Windows machines, we suggest Flexera Personal Software Inspector, which will check your installed software and inform you of any updates.\nUPDATE: Since Flexera is no longer available, we suggest FileHippo App Manager which is also free of charge to use.<\/div>
For Mac machines, we suggest Macupdate Desktop, however it is not free of charge.<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Rule #5: Are your SPAM filters active?\n\n<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The most common means of Ransomware distribution is through SPAM email which pretend to come from a valid source. <\/p>

Spam email trigger you to download infected files or click on links.<\/p>

If you're using webmail services like Gmail, Yahoo or Hotmail\/Outlook, then most of these email messages are being filtered and won't reach your inbox.<\/p>

However, if you're using your own domain and your SPAM filtering is not working well or it's not being set up properly, then most of these emails will reach your inbox.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Rule #6: Did you activate file extension display?\n\n\n\n<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

By default, Windows and MacOS do not show the extension of the files when you're browsing a folder. This helps an attacker to trick a user to think an executable file is a common PDF or Word file. The user will click on the file thinking it will open with some text content, however all it does is execute the ransomware shell.<\/p>The picture on the left shows an example where a malicious executable file (.exe) pretends to be a .pdf file. By enabling the extension display, we see its real identity (.pdf.exe)\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Rule #7: Did you open attachments that you do not recognize their sender?\n<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The Ransomware infection is in the attachment.<\/p>

If you receive an email that contains an attachment and you don't know why someone has sent it to you, do not open it.<\/span><\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In the picture above you can see an email with an attachment that contains Locky Ransomware. As you can see, it has an .xls attachment, it all looks good, and there's is a prompt to open it to check an invoice someone has sent us.
If you make the mistake and open the attachment, you might see another prompt that asks you to enable macros or content (\"Enable Macros\" or \"Enable Content\"). Do not do this, it will download Ransomware in your
computer and begin infection and encryption.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Rule #8: Careful with your downloads.\n\n\n\n<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t Free torrent downloads and P2P connections sound sweet because they're free, however they usually hide some nasty ransomware surprises. Always double check the websites that you download from and be extremely careful when you click on OK.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Rule #9: Did you rename vssadmin in Windows?\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Unfortunately Ransomware developers have good knowledge of this operation, therefore, one of the first thing that a Ransomware will do when infection begins, is to delete all shadow copies by running vssadmin.exe.<\/div>
\u0394\u03c5\u03c3\u03c4\u03c5\u03c7\u03ce\u03c2 \u03bf\u03b9 \u03b4\u03b7\u03bc\u03b9\u03bf\u03c5\u03c1\u03b3\u03bf\u03af \u03c4\u03c9\u03bd\u00a0<\/span>Ransomware\u00a0<\/span>\u03b5\u03af\u03bd\u03b1\u03b9 \u03b1\u03c1\u03ba\u03b5\u03c4\u03ac \u03ba\u03b1\u03bb\u03bf\u03af \u03b3\u03bd\u03ce\u03c3\u03c4\u03b5\u03c2 \u03b1\u03c5\u03c4\u03ae\u03c2 \u03c4\u03b7\u03c2 \u03bb\u03b5\u03b9\u03c4\u03bf\u03c5\u03c1\u03b3\u03af\u03b1\u03c2, \u03bc\u03b5 \u03b1\u03c0\u03bf\u03c4\u03ad\u03bb\u03b5\u03c3\u03bc\u03b1 \u03bc\u03af\u03b1 \u03b1\u03c0\u03cc \u03c4\u03b9\u03c2 \u03c0\u03c1\u03ce\u03c4\u03b5\u03c2 \u03b5\u03bd\u03ad\u03c1\u03b3\u03b5\u03b9\u03b5\u03c2 \u03c0\u03bf\u03c5 \u03ba\u03ac\u03bd\u03bf\u03c5\u03bd \u03bc\u03cc\u03bb\u03b9\u03c2 \u03be\u03b5\u03ba\u03b9\u03bd\u03ae\u03c3\u03b5\u03b9 \u03b7 \u03b5\u03c0\u03b9\u03bc\u03cc\u03bb\u03c5\u03bd\u03c3\u03b7 \u03b5\u03af\u03bd\u03b1\u03b9 \u03b7 \u03b4\u03b9\u03b1\u03b3\u03c1\u03b1\u03c6\u03ae \u03cc\u03bb\u03c9\u03bd \u03b5\u03ba\u03b4\u03cc\u03c3\u03b5\u03c9\u03bd \u03c4\u03c9\u03bd\u00a0<\/span>shadow copies\u00a0<\/span>\u03b5\u03ba\u03c4\u03b5\u03bb\u03ce\u03bd\u03c4\u03b1\u03c2 \u03c4\u03b7\u03bd \u03b5\u03bd\u03c4\u03bf\u03bb\u03ae\u00a0<\/span>vssadmin.exe.<\/span><\/div>
\u00a0<\/span><\/div>
If you're not using software that rely on vssadmin, we suggest you to disable it.<\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
@echo off<\/span><\/div>
REM We are redirecting the output of the commands and any errors to NUL.<\/div>
REM If you would like to see the output, then remove the 2>NUL from the end of the commands.<\/div>


<\/div>
REM Check if vssadmin.exe exists. If not, abort the script<\/div>


<\/div>
if NOT exist %WinDir%\\system32\\vssadmin.exe (<\/div>
echo.<\/div>
echo.%WinDir%\\system32\\vssadmin.exe does not exist!<\/div>
echo.<\/div>
echo Script Aborting!<\/div>
echo.<\/div>
PAUSE<\/div>
goto:eof<\/div>
)<\/div>


<\/div>
REM Check if the script was started with Administrator privileges.<\/div>
REM Method from http:\/\/stackoverflow.com\/questions\/4051883\/batch-script-how-to-check-for-admin-rights<\/div>


<\/div>
net session >nul 2>&1<\/div>


<\/div>
if %errorLevel% NEQ 0 (<\/div>
echo.<\/div>
echo You do not have the required Administrator privileges.<\/div>
echo.<\/div>
echo Please run the script again as an Administrator.<\/div>
echo.<\/div>
echo Script Aborting!<\/div>
echo.<\/div>
PAUSE<\/div>
goto:eof<\/div>
)<\/div>


<\/div>
REM We need to give the Administrators ownership before we can change permissions on the file<\/div>
takeown \/F %WinDir%\\system32\\vssadmin.exe \/A >nul 2>&1<\/div>


<\/div>
REM Give Administrators the Change permissions for the file<\/div>
CACLS %WinDir%\\system32\\vssadmin.exe \/E \/G “Administrators”:C >nul 2>&1<\/div>


<\/div>
REM Generate the name we are going to use when rename vssadmin.exe<\/div>
REM This filename will be based off of the date and time.<\/div>
REM http:\/\/blogs.msdn.com\/b\/myocom\/archive\/2005\/06\/03\/so-what-the-heck-just-happened-there.aspx<\/div>


<\/div>
for \/f “delims=\/ tokens=1-3” %%a in (“%DATE:~4%”) do (<\/div>
for \/f “delims=:. tokens=1-4” %%m in (“%TIME: =0%”) do (<\/div>
set RenFile=vssadmin.exe-%%c-%%b-%%a-%%m%%n%%o%%p<\/div>
)<\/div>
)<\/div>


<\/div>
REM Rename vssadmin.exe to the filename in the RenFile variable<\/div>


<\/div>
ren %WinDir%\\system32\\vssadmin.exe %RenFile% >nul 2>&1<\/div>


<\/div>
REM Check if the task was completed successfully<\/div>


<\/div>
if exist %WinDir%\\system32\\%RenFile% (<\/div>
echo.<\/div>
echo vssadmin.exe has been successfully renamed<\/div>
echo to %WinDir%\\system32\\%RenFile%.<\/div>
pause<\/div>
) else (<\/div>
echo.<\/div>
echo There was a problem renaming vssadmin.exe<\/div>
echo to %WinDir%\\system32\\%RenFile%.<\/div>
echo.<\/div>
pause<\/div>
)<\/div>


<\/div>
:END<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Rule #10: Did you disable Windows Script Host?\n\n<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Many Ransomware infections are installed via scripts written in JS or VBS.<\/div>
\u00a0<\/div>