crypto locker - how to remove?

Rantapallo

Blackcat

Ransomware; A  nasty strain of Windows malware that uses advanced encryption to lock up user files before demanding a ransom. It leaves users in danger of losing important files forever unless they pay up. 

 http://blog.malwarebytes.org/intelligence/2013/10/cryptolocker-ransomware-what-you-need-to-know/

 

You need to try and remove the infection/restore your files in 2 main steps;

 

1. Remove Cryptolocker completely using the free Malwarebytes; Removal guide is here; https://forums.malwarebytes.org/index.php?showtopic=134420

 

2. But problem is that affected files remain encrypted; Malwarebytes cannot  undo the encryption. The only way of restoring your files is from a backup, or if you have System Restore.

 

Details are here; http://www.bleepingcomputer.com/forums/t/506924/cryptolocker-hijack-program/page-26#entry3165383

 

I am not sure that F-Secure have added detection for this malware but even if they have it can't help in recovering encrypted files post-infection. Their online scanner may be able to remove it; http://www.f-secure.com/en/web/labs_global/removal/removing-ransomware

 

Bleeping Computer have all the information that you need to know; http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information

 

Edit;  

 

If you have questions about ransomware, you can ask an F-Secure security expert in a special online Q&A session happening now through to the end of October. The session is being held through the F-Secure Community and is accessible via http://community.f-secure.com/t5/Stop-Ransomware/qa-p/stopransomware.

Blackcat

For future use; 

 

a. Try CryptoPrevent is a free utility by Fooli**bleep** LLC that automatically adds the suggested Software Restriction Policy Path Rules (listed in the guide) to your computer. The added Software Restriction Policies are to prevent CryptoLocker from being executed in the first place; http://www.fooli**bleep**.com/vb6-projects/cryptoprevent/

 

b. This ransomware again shows the importance of backing up your data; backup, backup, backup!!! Get yourself a good backup program such as Macrium; http://www.macrium.com/reflectfree.aspx

 

 

Video here shows CryptoLocker in action; http://nakedsecurity.sophos.com/2013/10/18/cryptolocker-ransomware-see-how-it-works-learn-about-prevention-cleanup-and-recovery/

Simon

Oh **bleep**! 

[Deleted User]

Hi all!

 

Just to note, the Q&A about Ransomware is being extended by a week or two, so get your questions in while you have the chance!

 

And we should soon be seeing a response to the Crypto Locker question, so keep an eye out here: http://community.f-secure.com/t5/Stop-Ransomware/Hi-does-F-Secure-IS-2014-detect/qaq-p/34281

 

@Rantapallo, has Blackcat's advice helped with this, or are you still in need of further advice?

 

// Chrissy

Rina

Hello i have cryptolocker virus on my computer what to do we tried to save our files and folders but they are not opening what to do please help us.

[Deleted User]

Hi Rina,

Please check this:

http://community.f-secure.com/t5/Stop-Ransomware/Hello-BlackCat-nbsp-our-products/qaq-p/34367/comment-id/30#M30

Blackcat

"v6.0 - CryptoPrevent is no longer based solely on Windows software restriction policies, and now includes a real-time filter and definitions files/updates! "

 

http://www.fooli**bleep**.com/vb6-projects/cryptoprevent/

 

http://www.majorgeeks.com/files/details/cryptoprevent.html#screenshots

 

Blackcat

"Whitehat hackers have struck back at the operators of the CryptoLocker ransom trojan that has held hundreds of thousands of hard drives hostage. Through a partnership that included researchers from FOX-IT and FireEye, researchers managed to recover the private encryption keys that CryptoLocker uses to lock victims' personal computer files until they pay a $300 ransom. They also reverse engineered the binary code at the heart of the malicious program. The result: a website that allows victims to recover the key for their individual content."

 

FireEye and Fox-IT have partnered to provide free keys designed to unlock systems infected by CryptoLocker; https://www.decryptcryptolocker.com/

 

Further info; http://arstechnica.com/security/2014/08/whitehats-recover-victims-keys-to-cryptolocker-ransomware/

 

Intelligence report; http://blog.fox-it.com/2014/08/06/cryptolocker-ransomware-intelligence-report/

 

HitmanPro.Alert offers protection against CryptoLocker and its variants, like the current CryptoWall.; https://www.youtube.com/watch?v=5M8YYnXIAlw

 

The second Community Technology Preview of HitmanPro.Alert 3. has also been released; (and is running stable here on my machines); http://test.hitmanpro.com/hmpalert3ctp2.zip

Simon

That's great news!

NikK

Awesome tips Blackcat!

 

Regarding your previous tip, CryptoPrevent, the link is censored and doesn't work.

http://www.fooli**bleep**.com/vb6-projects/cryptoprevent/

 

The domain should be foolish it  (without the space in the middle)

www.foolish it.com

Rusli

See this link to remove Cryptolocker!

 

http://www.wintips.org/how-to-remove-cryptolocker-ransomware-and-restore-your-files/

 

and

 

http://www.youtube.com/watch?v=G2sUQFME0bE

 

http://www.youtube.com/watch?v=nKDjSVd96_g

 

http://www.youtube.com/watch?v=1E8uQtVu5CE

 

http://www.youtube.com/watch?v=wPo03UmaRKs

Rusli

Check this out,

 

https://www.us-cert.gov/ncas/alerts/TA13-309A

Rusli

go here to decrypt cryptolocker.

 

https://www.decryptcryptolocker.com/

 

http://www.bleepingcomputer.com/forums/t/543518/decryption-keys-are-now-freely-available-for-victims-of-cryptolocker/

RIKKI

i HAVE TRIED EVERYTHINK...HELP!

Simon

If you've literally tried everything, then the only option is to format your computer.

Seriously, that might be the easiest option, but if you'd like us to try to help you avoid that situation, then we need more information, such as what is your operating system, which version of F-Secure are you running, and what exactly you have tried so far. There is a lot of information and links in this thread, kindly provided by Rusli. Have you check it all out?

Rusli

Rikki,

 

Please go to this site:-

 

Hitman Pro:-

 

http://www.surfright.nl/en/cryptoguard

 

 

Bitdefender cryptolocker blocking tool:-

 

http://labs.bitdefender.com/2013/10/cryptolocker-ransomware-makes-a-bitcoin-wallet-per-victim/

 

Bitdefender blocking tool download link:-

 

http://download.bitdefender.com/removal_tools/BDAntiCryptoLocker_Release.exe

 

 

Fireeye removal:-

 

http://www.fireeye.com/blog/corporate/2014/08/your-locker-of-information-for-cryptolocker-decryption.html

 

https://www.decryptcryptolocker.com/

 

 

US-CERT:-

 

https://www.us-cert.gov/ncas/alerts/TA13-309A

 

 

Latest updates:- (please take note)

---------------------

Check to see if you have the new variant called cryptodefense:-

 

http://www.bleepingcomputer.com/forums/t/527937/cryptodefense-newest-cryptolocker-variant-details-inside/

 

 

 

other links:-

 

http://support.kaspersky.com/viruses/common/10646#block2

 

http://nakedsecurity.sophos.com/2013/10/18/cryptolocker-ransomware-see-how-it-works-learn-about-prevention-cleanup-and-recovery/

 

http://blog.emsisoft.com/2013/09/10/cryptolocker-a-new-ransomware-variant/

 

http://www.surfright.nl/en/cryptoguard

 

http://lavasoft.com/mylavasoft/company/blog/how-to-remove-cryptolocker

 

http://www.pandasecurity.com/mediacenter/malware/cryptolocker/

 

http://www.bitdefender.com/support/cryptolocker-ransomware-%E2%80%93-details-and-prevention-1204.html

 

http://techblog.avira.com/2013/11/07/ransomware-in-the-wild-the-cryptolocker-malware/en/

 

https://forums.malwarebytes.org/index.php?/topic/134420-removal-instructions-for-cryptolocker/

 

https://forums.malwarebytes.org/index.php?/topic/134420-removal-instructions-for-cryptolocker/

 

http://kb.eset.com/esetkb/index?page=content&id=SOLN3538&actp=search&viewlocale=en_US&searchid=1411294573037

 

http://blog.avast.com/2013/11/19/can-avast-protect-me-against-cryptolocker/

 

http://blog.avast.com/tag/cryptolocker/

 

http://www.microsoft.com/security/portal/mmpc/shared/ransomware.aspx

 

https://community.mcafee.com/thread/62139

 

http://news.drweb.com/show/?i=4052&lng=en&c=9

 

http://blogs.avg.com/news-threats/protecting-against-cryptolocker/

 

https://www.comodo.com/news/press_releases/2013/11/comodo-endpoint-security-protects-cryptoLocker-ransomware-virus.html

 

https://blogs.comodo.com/it-security/cryptolocker-virus-best-practices-to-ensure-100-immunity/

 

https://blogs.comodo.com/comodo_news/cryptolocker-2-0-are-your-ready-we-are/

 

http://forums.comodo.com/av-false-positivenegative-detection-reporting-b154.0/-t98913.0.html

 

http://about-threats.trendmicro.com/RelatedThreats.aspx?language=au&name=Ransomware+Raises+the+Stakes+With+CryptoLocker

 

http://www.symantec.com/security_response/writeup.jsp?docid=2013-091122-3112-99

 

 http://www.f-secure.com/en/web/home_global/online-scanner

 

http://www.trustport.com/en/products

 

https://www.gdatasoftware.com/onlineshop/g-data-antivirus.html

 

 

http://www.avira.com/en/download/product/avira-rescue-system

 

http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/kav_rescue_10.iso

 

http://www.freedrweb.com/cureit/?lng=en

 

nightzkung

Very good post. I am facing a few of these issues as well. ------------------------------------ อ่านการ์ตูนออนไลน์ one piece naruto bleach fairy tail

Rusli

 

 

Hey Nikk

 

Does this work?

 

https://www.fooli**bleep**.com/vb6-projects/cryptoprevent/

 

Note:-

**foolish it**** one word...no spacing in between... due to f-secure forum censored ...

 

click on the attachment picture and zoom in, in this post to view the correct URL link.

NikK

No, but try https://www.foolishXit.com/vb6-projects/cryptoprevent/ and delete the X

Rusli

Free Download???

 

http://www.fooli**bleep**.com/download/cryptoprevent-installer/

 

Zoom in the picture to get the correct URL link.

 

NikK

This will do it, I made a tiny URL

 

http://tinyurl.com/VB6cryptoprevent

Rusli

Rikki,

 

Check the youtube videos here see if it works.

 

 

New Youtube Video Clips.

-----------------------------------

 

http://www.youtube.com/watch?v=Evy0xK1N2gc

 

http://www.youtube.com/watch?v=2mn-8BVZYB8

 

http://www.youtube.com/watch?v=-ZXv9_h08iE

 

http://www.youtube.com/watch?v=iiGSr-HSPb0

 

http://www.youtube.com/results?search_query=cryptolocker+removal

 

 

 

http://www.freedrweb.com/cureit/?lng=en

 

Rusli

CryptoWall version 2.

 

Please check F-Secure blog....

 

http://www.f-secure.com/weblog/archives/00002750.html

etomcat

Hello,

 

These new enciphering ransomware malware are using the built-in "industrial strenght" RSA provider module in Windows OS to make the files unreadable (because a homebrew crypto algorythm or a strong crypto with amateur implementation is easy to break for experts).

 

Therefore some "Edward II" among the NSA ranks will need leak info on what kind of a government-mandated backdoor is hidden in Microsoft's implementation of RSA and then, suddenly all ransomed files will be easy to read again!

 

Best Regards: Tamas Feher, Hungary.