will EMET block Cryptolocker?

[thomas1004]

hello to all,

I'm running Windows 7 Professional x64, Service Pack 1
I have a third-party AV installed: Webroot SecureAnywhere v8.0.4.42
EMET is v4.0.4913.26122

I have EMET running for IE, Firefox and Microsoft Outlook.

Will EMET be able to block the Cryptolocker malware?

Thanks for your thoughts.
Regards, Tom

 

[Callender]

EMET - probably not.

EMET is an anti exploit kit. That means it protects against zero-day attacks focused on internet-facing applications that have been correctly configured in EMET by the user where a vulnerability exists but is yet to be patched by the software manufacturer or where the user has not applied the latest available patch.

EMET does not stop a user from clicking on the password protected email attachment that will run the executable.

CryptoLocker: Please Kindly Find Our New PO - F-Secure Weblog : News from the Lab

CryptoLocker in action (Video):

https://www.youtube.com/watch?v=Gz2kmmsMpMI

You'll notice that following user action (clicks on file) a random named executable file runs and can be seen in Task manager. EMET is unlikely to prevent this.

Personally I use software that will prompt a user for action (or block) if a digitally unsigned file attempts to run or when a digitally signed file attempts to run without the signature existing in the Trusted Certificate list.

 

[thomas1004]

Thanks for the response Callender. I'm already taking weekly backups with an external hard drive (which I disengage from my laptop when completed). Webroot forums claim that CryptoLocker is blocked, but I'll explore other options from your reply and from other posts on this forum. Thanks again.
Tom

 

[RickeyRose]

I do not think so, last time i heard a kapersky report said none of antivirus present can settle this virus. Only decent anti-virus could prevent this virus infection.
Another tough virus

 

[HAVOC]

hello to all,

I'm running Windows 7 Professional x64, Service Pack 1
I have a third-party AV installed: Webroot SecureAnywhere v8.0.4.42
EMET is v4.0.4913.26122

You forgot "I have cloned my HDD and have all important files backed up on separate storage media (not connected to the computer/network)."

 

[thomas1004]

Thanks Havoc, I am taking weekly data backups as well as
System image backups to an external hard drive. I disconnect
The xHD when it's finished. The ability of this malware to seek out
Attached devices and networks makes this particularly nasty.