Defending yourself from the Ransomware - Bad Rabbit

As you may be aware, a new ransomware campaign has hit a number of high profile targets in Russia and Eastern Europe.

Dubbed Bad Rabbit, the ransomware first started infecting systems on Tuesday 24 October, and the way in which organisations appear to have been hit simultaneously immediately drew comparisons to this year's WannaCry and Petya epidemics. This now seems to be the third major outbreak of the year.

Those unfortunate enough to fall victim to the attack quickly realised what had happened because the ransomware isn't subtle -- it presents victims with a ransom note telling them their files are "no longer accessible" and "no one will be able to recover them without their decryption service".

The criminals behind Bad Rabbit are tricking people into infecting themselves, by disguising the malware as an Adobe Flash installer and planting it on legitimate websites that have been compromised.

However, a security researcher at Cybereason, claims to have found a vaccine for the attack, which should completely prevent Bad Rabbit from infecting your computer. This is a simple procedure that is carried out by blocking the execution of file “c:\windows\infpub.dat” and “C:\Windows\cscc.dat”, the main files the ransomware relies on in-order to carryout its attack.

This makes sense because the ransomware needs the files, "infpub.dat" and "cscc.dat" to execute its attack, and by blocking them on your PC prior to any attack, you have prevented Bad Rabbit from carrying out its job.

Prevention they say, is better than cure.

Please follow the steps below to fully protect yourself.

First, create these two files in c:\windows:

infpub.dat
cscc.dat

You can do that really quickly by starting cmd.exe as an admin:

Then type the following commands:
echo “” > c:\windows\cscc.dat&&echo “” > c:\windows\infpub.dat

Next, remove all their permissions by right clicking each file and selecting properties:

Then select the security tab:

Now click advanced, opening the following window:

Click change permissions, opening the following window:

Then, uncheck the “Include inheritable permissions from this object’s parents” box.
After you do that, the following window will pop up. Click “remove”.

You are now done. Remember to perform this action for the two files you created.

If you are running Windows 10, repeat the same steps but instead of unchecking the inheritance box, click the “disable inheritance button”:

And then select “Remove all inherited permissions from this object":