[KB3433] Best practices to protect against ransomware

• You want to use the best practices to configure your system to protect against ransomware malware
• General ESET product anti-ransomware best practices
• General anti-ransomware practices
• Recovering encrypted files

The current versions of ESET products use multiple layers of technologies to protect computers from ransomware.

Examples of these technologies include Advanced Memory Scanner, ESET LiveGrid® Reputation System, and Exploit Blocker.

Additionally, the latest ESET products provide an enhanced Botnet Protection module that blocks communication between ransomware and Command and Control (C&C) servers. 

General ESET product anti-ransomware best practices

• Keep Advanced Memory Scanner and Exploit Blocker enabled

  These two features are enabled by default in ESET products version 5 and later. These newly designed ESET algorithms strengthen protection against malware that has been designed to evade detection by anti-malware products through the use of obfuscation and/or encryption.

  Advanced Memory Scanner looks for suspicious behavior after malware decloaks in the memory, and Exploit Blocker strengthens protection against targeted attacks and previously unseen vulnerabilities, also known as zero-day vulnerabilities.

  For maximum protection, we recommend that you upgrade your ESET products to the latest version:

  •  Home users: Which ESET product do I have and is it the latest version? (Home Users)

  •  Business users: Do I have the latest version of ESET business products?

• Keep ESET LiveGrid enabled

  The ESET Cloud Malware Protection System is based on ESET LiveGrid. It monitors for unknown and potentially malicious applications and subjects samples to automatic sandboxing and behavioral analysis.

  Make sure that ESET LiveGrid® reputation and ESET LiveGrid® feedback system is enabled and working in your ESET product.

• Keep ESET updated

  New variants of existing ransomware are released frequently, so it is important that you are receiving regular virus database updates (your ESET product will check for updates every hour provided that you have a valid license and a working internet connection).

  •  Home users: Update ESET Products—check for latest product modules

  •  Business users: Update ESET endpoint products on individual client workstations—check for latest product modules

• Virtual Machine users

  For the best protection against ransomware malware, we recommend the use of ESET Endpoint Security in virtual environments.

• Make sure you have Ransomware Shield enabled

  Ransomware Shield as a part of a Self-Defense technology is another layer of protection that works as a part of the HIPS feature. For more information, see Ransomware Shield in ESET Glossary and how to configure it in ESET products.

• Configure additional settings to protect against ransomware in ESET business products manually or using ESET PROTECT On-Prem/ESET PROTECT Policy

  • Configure HIPS rules for ESET business products

  • Configure Firewall rules for ESET Endpoint Security

  • Configure ESET Mail Security

• Notifications

  • Detected threats

General anti-ransomware best practices — Minimize your risk from encryption-based malware (ransomware)

• Keep backups of your system

  Plan to take backups of your system regularly, and keep at least one such backup in offline storage to protect your most recent work from an attack.

• User permissions and restriction of rights

  There are many types of restrictions, such as the restriction from accessing application data and even some that are prebuilt as a Group Policy Object (GPO).

  • Disable files running from the AppData and LocalAppData folders.

  • Block execution from the Temp subdirectory (part of the AppData tree by default).

  • Block executable files running from the working directories of various decompression utilities (for example, WinZip or 7-Zip).

    Additionally, in ESET Endpoint Security/Antivirus, ESET Mail Security and ESET File Security, you can create HIPS rules to allow only certain applications to run on the computer and block all others by default: Create a HIPS rule and enforce it on a client workstation using ESET PROTECT On-Prem.

• Do not disable User Account Control (UAC)

  Do not open attachments claiming to be a fax, invoice, or receipt if they have a suspicious name or you did not expect to receive them.

  What can I do to minimize the risk of a malware attack?

• Use two-factor authentication (2FA)

  We recommend ESET Secure Authentication.

• Threat Defense

  We recommend ESET LiveGuard Advanced.

• Disable Macros in Microsoft Office via Group Policy

  Office 2013/2016 (the following link is for 2013 but are the same settings for 2016): Plan security settings for VBA macros for Office

• Keep your system up-to-date

  To ensure you have the best protection available, keep your operating system and applications updated. Install the latest high-priority updates offered in the Windows Update tool, and check regularly or enable the Automatic Updates feature. New security updates patch the system vulnerabilities and reduce the risk of malware attack.

  Microsoft has released patches for current Windows operating systems as well as Windows XP to mitigate a critical vulnerability. See Microsoft Security Bulletin MS17-010 - Critical for instructions to apply these updates.

• Potential ports/service that could be exploited if left open

  To prevent an unknown IP address from performing successful Brute Force attacks, we strongly recommend locking down SMB, SQL, and RDP.

  1. SMB

     Close file sharing ports 135-139 and 445. SMB ports should not be exposed to the internet.

  2. SQL

     Whitelist trusted IP addresses that are allowed to connect to SQL

  3. RDP

     • Stop outside RDP Brute Force attacks by closing RDP to external connections. Use a VPN with Two Factor Authentication to connect to the internal network.

     • Set automatic account lockouts after a certain number of failed attempts. Include a waiting period for automatic unlock after an account is locked out.

     • Enforce strong passwords

     • Disable common unused and default accounts, for example, administrator, admin, or root

     • Whitelist specific users and groups to allow login using RDP

     • Whitelist specific IP addresses to allow an RDP connection

• Remote Desktop Protocol best practices against attacks

  Encryption-based malware often accesses target machines using the Remote Desktop Protocol (RDP) tool integrated in Windows. RDP allows others to connect to your system remotely, so the attacker can misuse RDP to remove the protection and then deploy the malware.

  We recommend you to disable or change Remote Desktop Protocol. If you do not require the use of RDP, you can change the default port (3389) or disable RDP to protect your machine from ransomware and other RDP exploits. For instructions on how to disable RDP, visit the appropriate Microsoft Knowledge Base article below:

  • Windows 7
  • Windows 8
  • Windows 10 and 11

  For more information about RDP, see the following WeLiveSecurity article: Remote Desktop (RDP) Hacking 101: I can see your desktop from here!

• Password-protect your ESET product settings

  If you are a business user, we recommend using a password to protect the ESET product from being altered by an attacker. This prevents unauthenticated settings modification, disabling the protection, or even uninstalling the ESET product. If you are using RDP, we recommend using a different password from the one used for the RDP login credentials.

  On how to protect your ESET product with a password, visit KB7915

Can encrypted files be recovered?

Modern ransomware encrypts data using asymmetric methods and multiple types of encryption ciphers. In short, files are encrypted with a public key and cannot be decrypted without the associated private key. With current ransomware, the private key is never located on the affected workstation or environment. This means that data will need to be restored from a good backup made prior to the infection.

If no backups are available, you can attempt to recover files from Shadow Copies. You can use Shadow Explorer, which you can download from the following web page: http://www.shadowexplorer.com/downloads.html

However, it is not uncommon for ransomware infections to delete Shadow Copies to prevent recovery of files.

What steps should you take if infected with ransomware?

1. Disconnect the computer from the network.

2. Locate the TXT or HTML file with the payment instructions, for example, "How to decrypt" shared folders/drives encrypted. This may be used by our malware researchers for further analysis.

3. Contact your local ESET partner for support