Catch Cryptolocker in the act
We have created a script for LabTech that you can schedule against any system to scan for possible Cryptolocker Decrypt Files, a sure sign that you been infected.
The script can be scheduled against all agents and if an agent is a Mac or Linux it will skip it, The probe will scan each drive letter found and then review that scan to see if it has found any files. Once it finds a file it will email an address but you can easily have it create a ticket or even set an alarm state.
When executing probe against a system you can monitor the Scripts Tab for the progress of the probe.
As the image above shows, a scan takes just a minute to complete. The C drive scan started at 1:08:34 and ended at 1:09:51, the scan took 1 minute and 17 seconds to scan 80GB hard drive.
Version 1.0.1 download
Enjoy Cubert