CryptoPrevent is a tiny utility to lock down any Windows OS to prevent infection by the Cryptolocker malware or ‘ransomware’, which encrypts personal files and then offers decryption for a paid ransom.
(https://www.foolishit.com/wp-content/uploads/2013/10/cryptoprevent41.png)
CryptoPrevent artificially implants group policy objects into the registry in order to block certain executables in certain locations from running. Note that because the group policy objects are artificially created, they will not display in the Group Policy Editor on a Professional version of Windows — but rest assured they are still there!
Freeware
Whats new: >>
added ability to block syskey.exe from execution, which is being exploited by some new malware.
http://www.foolishit.com/vb6-projects/cryptoprevent/
Changelog
Added Proxy support for updates and email
added command line parameters to configure proxy support
added automatic file trigger to configure proxy using “CryptoPreventProxy.ini” in application directory
Performance increase for removing whitelisted software restriction policies
Additional debug information when running /debug
for sending email
for updates
Added additional Honey Pot detection for more ransomware detection
We STILL have several more improvements already in development and testing, so there should be additional updates in the coming days.
You can subscribe to this category of our blog to stay current on any new additions or changes!
http://www.foolishit.com/vb6-projects/cryptoprevent/
Changelog
Performance increase for HoneyPot Detection and alert notification from QuickAccess Tray icon
Added command line option to add unique identifier for individual client
/clientemailid=[UniqueClientID]
Run this CLI option to create a unique identifier for that specific client’s email subject line
Additional debug information when running /debug
Added additional Honey Pot detection for more ransomware detection
Added ability for HoneyPot definitions to be updated during definition updates
HoneyPot definitions will update during manual or auto-update processes
If HoneyPot definition file is not available on the system, hard-coded definitions of the current CryptoPrevent version will be used
We STILL have several more improvements already in development and testing, so there should be additional updates in the coming days.
You can subscribe to this category of our blog to stay current on any new additions or changes!
http://www.foolishit.com/vb6-projects/cryptoprevent/
Changelog
Rolled back HoneyPot Definition update feature
received a number of strange false positives
Will refine more and bring back at a later date
We STILL have several more improvements already in development and testing, so there should be additional updates in the coming days.
http://www.foolishit.com/vb6-projects/cryptoprevent/
Changelog
Major performance increase when apply protections
from the command line and from the GUI
Corrected issues with Windows 8-10 Scaling
DPI changes could still cause problems if defined manually and not with the scaling in Windows
Windows XP-7 will still get warning
Corrected minor interface issue
Issue resulted in some changes in 8.0.3.8
Unable to read tabs, but still clickable
GUI subtabs looked step sided/pushed to the right some
Applied to the Protection Settings sub tabs
Applied to the Policy Editor sub tabs
We STILL have several more improvements already in development and testing, so there should be additional updates in the coming days.
You can subscribe to this category of our blog to stay current on any new additions or changes!
http://www.foolishit.com/vb6-projects/cryptoprevent/
Changelog
Fixed graphical issue with policy numbers applied being shown in the policy editor
Added additional email settings CLI
/emailusername=”user@addy.com”
/emailsamesendtofromaddy
or use the following together:
/emailfromaddy=”user@addy.com”
/emailsendtoaddy=”user@addy.com”
/emailpassword=”password”
/emailserver=”serverAddress”
/emailport=”portNumber”
/emailauthenable
(Add =0 to disable)
/emailstarttlsenable
(Add =0 to disable)
/emailsslenable
(Add =0 to disable)
/clientemailid=”Client ID to be added to Email Subject”
/emaillocksettings
(Add =0 to disable)
Only applies to Bulk or White-Label Editions
d7x Rule Variables now add environment variable as well as expanded paths
https://www.foolishit.com/d7x/killemall/rule-variables/
Revised how SRP protection locations are handled
Corrects issue where counts may have been off
Corrects issue where same policy may have been added more than once from CLI options
Added Debugging ability to the QuickAccess Notification Tray
Currently debugging information is fairly limited but this will improve over new revisions if additional debugging information is required
/debug when run from a command prompt with or without admin rights depending on the testing needed
Improved Multi-User support for QuickAccess Notification Tray
Bulk & White-Label Edition Installers Updated
Waits for installation to complete prior to showing finished button on non-silent installations
Silent installations wait on installers completion if being scripted now as well
Fixed possible issues with systems not restarting after install when selected to do so from the Bulk-Creator
Debug mode will be enabled by default on all Bulk Edition installs for the installation portion only
This can be used to check for problems if something doesn’t work correctly in the Bulk Edition installation on a particular system
Fixed possible issue with HoneyPot Detection triggering on changing of protections
We STILL have several more improvements already in development and testing, so there should be additional updates in the coming days.
You can subscribe to this category of our blog to stay current on any new additions or changes!
http://www.foolishit.com/vb6-projects/cryptoprevent/
Changelog
Fixed graphical issue where verifying settings might not disappear on first run of application
Added additional HoneyPot Detection Rules
Added changes to HoneyPot Detection rules that may cause false positives
Added fix for possible issue with HoneyPot Detection not being able to verify current HoneyPot files
Possible fix for issues with CLI options possibly not starting services as expected
Fixed QuickAccess Notification Tray to update on the fly with protection changes
Added Restore Previous Protections option to Main GUI, QuickAccess Tray, and CLI option of /revertsettings
Possible fix for Monitor Service consuming large amounts of RAM
Minor performance improvements when handling SRP protections from GUI and CLI options
http://www.foolishit.com/vb6-projects/cryptoprevent/
Changelog
Major improvements in Memory usage across all executables (CryptoPrevent.exe, CryptoPreventMonSvc.exe, CryptoPreventNotification.exe), memory usage will decrease over time for the real-time as well as less usage on initial launches.
Corrected an issue where White-Label Creator was not updating the CryptoPrevent.exe launcher file in the includes folder which is used to create installers (you can delete this file and then re-open the WL Creator to force an update now)
SRP Whitelist is now sorted on initial loading and when updated
FolderWatch Custom Folders list is now sorted on initial loading and when updated
Fixed issue where services may not start via CLI options
Fixed issue where HoneyPot files might not be removed when FolderWatch has been disabled
Fixed issue where HoneyPot files might not be removed when Custom Folder is removed
Add/Removing Custom Folders to FolderWatch will no apply instantly
Fixed issue where services may be removed but not re-installed when changing various definition files or email settings
We STILL have several more improvements already in development and testing, so there should be additional updates in the coming days.
You can subscribe to this category of our blog to stay current on any new additions or changes!
http://www.foolishit.com/vb6-projects/cryptoprevent/
Changelog
Performance increases for save/load of Bulk/White-Label configurations
Performance increases in the application of Bulk/White-Label settings at time of install
Performance increases on application startup
Several other minor performance improvements
Corrected issue where blacklist command line option may have whitelisted in some cases
Bulk registration data is now handled entirely via HTTPS (Note registration data was always encrypted prior to being sent, this mainly eliminated a fallback v7 Bulk communication method)
Several other minor bug fixes
New FolderWatch/HoneyPot options (see more here)
HoneyPot Detection Message shows details about detected event and file detected
HoneyPot Detection Message gives the option to go back into windows explorer (instead of just shutdown or reboot)
Subscription Information shown in a tab in the interface
Debug submission available under subscription tab (so this is a premium only option to email support with debug info attached)
Additional HoneyPot Detections for new ransomware variants
Management Console ready (A management console is in the works and being up to date with this version should prepare the clients for this ability on its release)
http://www.foolishit.com/vb6-projects/cryptoprevent/
Changelog
User Interface Updated-adds additional explanation on features and functionality as well as streamlines options
Maintenance options have been added which are powered by d7x technology (manually running maintenance is available under the Free and Premium versions, scheduling automated maintenance is a premium feature only)
FolderWatch HoneyPot and the Quick Access tray are now available for usage under the free license; this makes all the protections CryptoPrevent provides free for personal usages
Program Filter has been updated to work with additional file execution situations
Corrected an issue where subscriptions keys may show as expired or invalid prior to subscription running out
Updates have been completely re-written for performance and lower bandwidth usage
Update feature has been added where CryptoPrevent will automatically apply any critical updates when opened (applies to the Free and Premium versions)
Several performance improvements for CryptoPrevent and the Monitor service
Several bug fixes for CryptoPrevent and the Monitor service
We STILL have several more improvements already in development and testing, so there should be additional updates in the coming days.
You can subscribe to this category of our blog to stay current on any new additions or changes!
http://www.foolishit.com/vb6-projects/cryptoprevent/