Here's a quick back story: A user reported that McAfee endpoint alert of a Trojan detected. We inspect her machine and confirm it is CryptoLocker. We quickly unhook her machine from our network immediately. We were not sure why or how did CryptoLocker gain access to this user's machine. She has been a great user and very cautious one.
Later we booted her machine with Network cable unhooked to look at her emails and website history...nothing out of ordinary detected. The machine she used is a hand-me-down machine with at most 2 other users before her. Because it is an older machine, it does not have any backup solution implement...all her local files is lost.
Upon further inspection, we found that GPO for preventing CryptoLocker is Denied. We were confused, but quickly conclude it to GPO replication failure we experienced 2-3 days earlier. Among Denied GPOs, beside CryptoLocker, are known GPOs that failed to replicate.
Luckily for us we have backup solution on server side. We boot every active users out and shutdown Shared Path to prevent further contamination. All files were restored using its backup from noon. Overall, everything is resolved.
Lesson of the day: BACKUP BACKUP BACKUP!!!
Does anyone knows how does CryptoLocker works? How does it spread to network drives? Does it replicate its Trojan as it crypt files? Thoughts?