Preventing Cryptolocker – Foolish IT’s fix, Group Policies and Chris

You have to thank Foolish IT for coming up with policies and a fix you can run that helps to prevent Cryptolocker.  Here’s the link to his file – version 2.6.  It allows you to whitelist items in your system that need to run.

Foolish IT – Fix


Do you have encrypted files ? You may be able to use Shadow Explorer or previous files (right click) and get files back.

Many of our ideas at our location, local businesses and entities have came from Chris G., a student who researched many of the Group Policy settings you can apply .  Here’s a few gpedit settings and modifications of other authors’ code that we are using and it appears to work.  We will continue to research and up date this blog as we get data.  You will have to make a determination on how you want to prevent the virus from infecting you.

Block CryptoLocker executable in %AppData%

Path: %AppData%\*.exe 
Security Level: Disallowed
Description: No executables %AppData%.

Block CryptoLocker executable in %LocalAppData%

Path if using Windows XP: %UserProfile%\Local Settings\*.exe
Path if using Windows Vista, 7 or8: %LocalAppData%\*.exe
Security Level: Disallowed
Description: No executables from %AppData%.

Very detailed description and handling zipped files can be found here (Bleeping Computer)

More Information from Bleeping Computer

Remember, if you don’t have backups and you don’t have previous files enabled, your files may be unrecoverable.


About TCAT Shelbyville IT Department

The Tennessee College of Applied Technology - is one of 46 institutions in the Tennessee Board of Regents System, the seventh largest system of higher education in the nation. This system comprises six universities, fourteen community colleges, and twenty-six Applied Technology Colleges.
This entry was posted in Business, Computer Security, Computers, Information Technology, network, Networking and tagged , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s