Cryptowall Rising

[citizensmith]

Yeah after removing the flash drive from the infected computer, I formatted it 10 times to ensure that its gone.

I write zeros just to make my self comfortable that the virus is gone. I am sure a quick format is ok, but zeroing removes it all.

Can we please please move on from the formating multiple times just to make sure paranoia - Windows format is destructive overwrite 00 by default since Vista arrived. The DR guys can enlighten us if I'm wrong.
Just delete the partitions - repartition, format and your'e good to go IMHO

 

[pcmedicri]

Can we please please move on from the formating multiple times just to make sure paranoia - Windows format is destructive overwrite 00 by default since Vista arrived. The DR guys can enlighten us if I'm wrong.
Just delete the partitions - repartition, format and your'e good to go IMHO

Windows format doesnt write 0's it removes the MFT

 

[citizensmith]

Change in the behavior of the format command in Windows Vista -
"The format command behavior has changed in Windows Vista. By default in Windows Vista, the format command writes zeros to the whole disk when a full format is performed. In Windows XP and in earlier versions of the Windows operating system, the format command does not write zeros to the whole disk when a full format is performed." - https://support.microsoft.com/kb/941961

Overwriting Hard Drive Data -
"Opinions on the required or desired number of passes to correctly overwrite (wipe) a Hard Disk Drive are controversial, and have remained so even with organizations such as NIST stating that only a single drive wipe pass is needed to delete data such that it can not be recovered (that is a wipe of the data). - http://digital-forensics.sans.org/blog/2009/01/15/overwriting-hard-drive-data/

have a nice google. I did

 

[Larry Sabo]

That's true, for full format, but not quick format. I don't think he mentioned whether it was quick or full.

 

[pcmedicri]

If its cryptolocker, then yea ill do full, but anything else its quick.

 

[GreenTechTrevor]

Ok since the first occurrences I have not seen any more PC's come in with the crypto 2.0 nor have we had any issues in shop. So I suspect that the customers had just got the virus around the same time and that it was not spreading through the network. Cheers.