10 ways to prevent ransomware headaches [infographic]

1. Andrew August 11, 2016 at 3:15 pm

   GFI ME does not check all archieve types for contents, only some of them.
   i.e. ransomware and other prohibited mail extentions passes through when packed by rar v.5 – this format still cannot be checked by ME. The same about formats like ,gz – seems to be “exotic” but still can be unpacked on the client (but not on the Mai gateway)

   1. Vladimir Ceric August 12, 2016 at 3:29 pm

      Hi Andrew. Scanning capabilities of GFI MailEssentials when it comes to archived attachements can also depend on the settings of the Decompression Engine (http://manuals.gfi.com/en/mailessentials/content/administrator/content_filtering/decompression_engine.htm), and you can also always add new file types and malicious file name patterns in the Attachment Filtering settings (http://manuals.gfi.com/en/mailessentials/content/administrator/content_filtering/attachment_filtering.htm).

      1. Andrew August 12, 2016 at 3:32 pm

         Hi Vladimir.
         Okay, just advice me =- how to force ME check files within .gz archive

         1. Andrew August 12, 2016 at 3:41 pm

            Vladimir, just to explain a bit more – there is no problems with scanning some archive types – .arj, .zip or even .rar version 4. But I had a real case, when malicious .js file, packed to .gz archive was passed by ME to end-user, though all the checkboxes on decompression engine settings are on and .js is in prohibited extentions. If needed I can just send the archive to you for analysys.

            1. Vladimir Ceric August 12, 2016 at 4:19 pm

               Hi Andrew. I understand now, but my knowledge of that type of technical details is not that good as of our engineers, so I will have to check this with them and get back to you. Thanks in advance for your patience and your input. Have a great weekend!
2. Robin Roberts August 11, 2016 at 7:12 pm

   I would like to print this – do you have a higher quality version of the infographic? I want to print it pretty big if possible. Thank you!!!
3. Tony August 11, 2016 at 7:43 pm

   Great article. Can you recommend any antimalware tool to erradicate hijacking malware called crypt? Once inside the computer, it changes all existing image file extensions to .crypt.

   1. Vladimir Ceric August 12, 2016 at 3:42 pm

      Thanks Tony, we’re glad you liked it.
      As for the anti-crypt-malware tool, our colleagues and partners at Kaspersky Lab have created a tool that would help you get out of that trouble. You’ll be able to read more about it here https://blog.kaspersky.com/cryptxxx-ransomware/11939/

      1. Tony August 12, 2016 at 4:21 pm

         Hello Vladimir. Thanks for your reply. I know of the tool, and so of a couple of others. They need at least one (more is better) backed up or an exact copy of the encrypted file. Sadly for this particular laptop’s drive there is none so, I’ve had to come to terms and format the HDD. In the same line of thought, I’ve read that this kind of encrypting malware actually deletes the original file for good and creates a fake “encrypted” simile of its victim. So, actually the kidnapped file is truly gone. That is one of the reasons you need the original in order to recover your file. Also, it is said that the decrypted image files once recovered, may show signs of deterioration (lines, pixelated, missing color, etc.) . Nevertheless, and again thanks for your reply. I am a user of one of GFI’s products. Keep up the good work.

         1. Vladimir Ceric August 12, 2016 at 4:38 pm

            Thanks Tony for these kind words, and I’m always glad to see a satisfied user of a GFI Software product. But I’m also sorry to hear about your experience and that you had to format the HDD, but it seems that with ransomware you’re safe only if you have some sort of backup 🙁 One man’s lesson can be someone else’s solution, that’s the way how life goes. Stay safe and have a great weekend!
4. Robin Roberts August 11, 2016 at 11:21 pm

   This is great! I would like to print it fairly large. Would it be possible to get a graphic that is higher quality?? It would be much appreciated!!!

   1. Vladimir Ceric August 12, 2016 at 3:31 pm

      Hi Robin. We’ll prepare a print-ready version of this infographic, and will let you know when it’s ready for download.
   2. Vladimir Ceric August 16, 2016 at 2:44 am

      Hi Robin. The print-ready version of our Ransomware infographic is now ready for download from this link: https://www.dropbox.com/s/qgybq2r37tfw1pw/GFI_Ransomware_Infographic_webandprint.zip?dl=0
      Thank you for your support, and we hope it would help you protect your company and users from the terrors of ransomware. Best regards, GFI Marketing team

Comments are closed.