Why Everyone Should disable VSSAdmin.exe Now!

Shadow Volume Copies have been a feature since Windows Vista that allows snapshots, or backups, of your files to be saved even when the files are currently in use.  These snapshots will attempt to be created every day and allows you to restore documents to previous versions or even to restore them if they were deleted.

This same technology is also used by the Windows' System Restore feature that allows you to roll back Windows to a previously working configuration in case there is a problem. Since Windows Vista, Microsoft has been bundling a utility called vssadmin.exe in Windows that allows an administrator to manage the Shadow Volume Copies that are on the computer. Unfortunately, with the rise of Crypto Ransomware, this tool has become more of a problem than a benefit and everyone should disable it.
 

System Restore is a feature that relies on Shadow Volume Copies

By default, Windows will attempt to create new Shadow Volume snapshots of your C: drive every day. Since the standard save location for Document files is on the C: drive your documents will be backed up as well.  Though this shouldn't be considered a regular backup method, it does provide an extra security blanket in the event that you need to restore a changed or deleted file. Unfortunately, the developers of Crypto Ransomware are aware of Shadow Volume Copies and design their infections so that they delete ALL Shadow Volume Copies when the ransomware infects your computer.  This is done to prevent you from using Shadow Volumes to recover encrypted files.

There are a few methods that the ransomware malware developers use to delete the Shadow Volume Copies, but the most prevalent one is to use the vssadmin.exe Delete Shadows /All /Quiet command. This command will execute the vssadmin.exe utility and have it quietly delete all of the Shadow Volume Copies on the computer. As this program requires Administrative privileges to run, some ransomware will inject themselves into processes that are running as an Administrator in order to avoid a UAC prompt from being displayed.
 

 

As vssadmin.exe is not a tool that is routinely used by an administrator, it is strongly suggested that it be disabled it by renaming it. Then if a ransomware tries to utilize the program to delete your shadow volume snapshots, it will fail and you will be able to use them to recover your files. Will this be 100% effective against all ransomware infections? No,but it will help against a good amount of them.

Creating a task that schedules automatic restore point creation

The one downside to renaming vssadmin.exe is that it has been discovered that the program is used by Windows when it performs scheduled restore points. To work around this, we can create a scheduled task that issues a WMIC command that can create the restore points for us. This WMIC method does not rely on vssadmin and can be used to create a daily task to create restore points for protected drives. Please note that this task will only create restore points for drive that you have specifically enabled protection for.

The WMIC command that can be used is:

Wmic.exe /Namespace:\\root\default Path SystemRestore Call CreateRestorePoint "%DATE%", 100, 7

When creating the new scheduled task, create it as a New Task. Then in the General tab make sure you have it set to Run whether user is logged on or not and to Run with highest privileges as shown in the image below. These settings will prompt you to store your password so that it can run when you are not logged on. For those who want to use this task via GPO and can't push out the password to store, you can set it to Run only when user is logged on instead.

Then in the Triggers tab, set it to run as often as you want. I specified to have it execute every 2 days, but you can set it for daily or even more often as necessary for your environment.

Finally, in the Actions tab, click on the New button and then enter C:\Windows\System32\wbem\WMIC.exe into the Program/Script field. In the Add arguments field you want to enter /Namespace:\\root\default Path SystemRestore Call CreateRestorePoint "%DATE%", 100, 7.  When it is done it should look like the image below.

When the action is finished, you can then save the scheduled task and it should create new restore points at the times you specified.  For those who wish to push this scheduled task via GPO, you can follow the steps in this article by Microsoft.

Now that we have a task to automatically create scheduled restore points, we can move ahead with renaming the vssadmin.exe program.

How to rename vssadmin

Unfortunately, as this file is owned by the special Windows account called TrustedInstaller, it is not a simple task to rename.  In order to rename vssadmin.exe you first have take ownership of the file, give yourself the permissions to modify it, and then rename it.  In order to make this task easier, I have put together a small batch file that does this for you. Renvbs.bat, which is shown below, will change the ownership of the vssadmin.exe file from TrustedInstaller to the Administrators group.  It will then give the Administrators the Change permission so that they can rename it. Finally the batch file will rename the file in the format vssadmin.exe-date-time.  Feel free to modify the name of the renamed file in the batch file for extra security. 

In the future if you ever need to actually use this utility, you can just rename it back to vssadmin.exe and use it as normal. When testing this method, I have not found any functionality lost within Windows and the only program that I know of that no longer operates when it is renamed is Shadow Explorer. Once again, to resolve any issues that may come up, you simply need to rename the file back to vssadmin.exe.

The Renvbs.bat batch file can also be downloaded from here: http://download.bleepingcomputer.com/bats/renvss.bat.

The RenVBS Batch file:

@echo off

REM We are redirecting the output of the commands and any errors to NUL. 
REM If you would like to see the output, then remove the  2>NUL from the end of the commands.

REM Check if vssadmin.exe exists. If not, abort the script

if NOT exist %WinDir%\system32\vssadmin.exe (
 echo.
 echo.%WinDir%\system32\vssadmin.exe does not exist!
 echo.
 echo Script Aborting!
 echo.
 PAUSE
 goto:eof
)

REM Check if the script was started with Administrator privileges.
REM Method from http://stackoverflow.com/questions/4051883/batch-script-how-to-check-for-admin-rights

net session >nul 2>&1

if %errorLevel% NEQ 0 (
 echo.
 echo You do not have the required Administrator privileges.
 echo.
 echo Please run the script again as an Administrator.
 echo.
 echo Script Aborting!
 echo.
 PAUSE
 goto:eof
)

REM We need to give the Administrators ownership before we can change permissions on the file
takeown /F %WinDir%\system32\vssadmin.exe /A >nul 2>&1

REM Give Administrators the Change permissions for the file
CACLS %WinDir%\system32\vssadmin.exe /E /G "Administrators":C >nul 2>&1

REM Generate the name we are going to use when rename vssadmin.exe
REM This filename will be based off of the date and time.
REM http://blogs.msdn.com/b/myocom/archive/2005/06/03/so-what-the-heck-just-happened-there.aspx

for /f "delims=/ tokens=1-3" %%a in ("%DATE:~4%") do (
    for /f "delims=:. tokens=1-4" %%m in ("%TIME: =0%") do (
        set RenFile=vssadmin.exe-%%c-%%b-%%a-%%m%%n%%o%%p
    )
)

REM Rename vssadmin.exe to the filename in the RenFile variable

ren %WinDir%\system32\vssadmin.exe %RenFile% >nul 2>&1

REM Check if the task was completed successfully 

if exist %WinDir%\system32\%RenFile% (
 echo.
 echo vssadmin.exe has been successfully renamed 
 echo to %WinDir%\system32\%RenFile%.
 pause
) else (
 echo.
 echo There was a problem renaming vssadmin.exe
 echo to %WinDir%\system32\%RenFile%.
 echo.
 pause
)

:END