crypto locker - how to remove?
Rantapallo
Posts: 3
Accepted Answer
-
Chrissy
Posts: 438
Hi all!
Just to note, the Q&A about Ransomware is being extended by a week or two, so get your questions in while you have the chance!
And we should soon be seeing a response to the Crypto Locker question, so keep an eye out here: http://community.f-secure.com/t5/Stop-Ransomware/Hi-does-F-Secure-IS-2014-detect/qaq-p/34281
@Rantapallo, has Blackcat's advice helped with this, or are you still in need of further advice?
// Chrissy
5 Like
This discussion has been closed.
Comments
Ransomware; A nasty strain of Windows malware that uses advanced encryption to lock up user files before demanding a ransom. It leaves users in danger of losing important files forever unless they pay up.
http://blog.malwarebytes.org/intelligence/2013/10/cryptolocker-ransomware-what-you-need-to-know/
You need to try and remove the infection/restore your files in 2 main steps;
1. Remove Cryptolocker completely using the free Malwarebytes; Removal guide is here; https://forums.malwarebytes.org/index.php?showtopic=134420
2. But problem is that affected files remain encrypted; Malwarebytes cannot undo the encryption. The only way of restoring your files is from a backup, or if you have System Restore.
Details are here; http://www.bleepingcomputer.com/forums/t/506924/cryptolocker-hijack-program/page-26#entry3165383
I am not sure that F-Secure have added detection for this malware but even if they have it can't help in recovering encrypted files post-infection. Their online scanner may be able to remove it; http://www.f-secure.com/en/web/labs_global/removal/removing-ransomware
Bleeping Computer have all the information that you need to know; http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information
Edit;
If you have questions about ransomware, you can ask an F-Secure security expert in a special online Q&A session happening now through to the end of October. The session is being held through the F-Secure Community and is accessible via http://community.f-secure.com/t5/Stop-Ransomware/qa-p/stopransomware.
For future use;
a. Try CryptoPrevent is a free utility by Fooli**bleep** LLC that automatically adds the suggested Software Restriction Policy Path Rules (listed in the guide) to your computer. The added Software Restriction Policies are to prevent CryptoLocker from being executed in the first place; http://www.fooli**bleep**.com/vb6-projects/cryptoprevent/
b. This ransomware again shows the importance of backing up your data; backup, backup, backup!!! Get yourself a good backup program such as Macrium; http://www.macrium.com/reflectfree.aspx
Video here shows CryptoLocker in action; http://nakedsecurity.sophos.com/2013/10/18/cryptolocker-ransomware-see-how-it-works-learn-about-prevention-cleanup-and-recovery/
Oh **bleep**!
Hello i have cryptolocker virus on my computer what to do we tried to save our files and folders but they are not opening what to do please help us.
Hi Rina,
Please check this:
http://community.f-secure.com/t5/Stop-Ransomware/Hello-BlackCat-nbsp-our-products/qaq-p/34367/comment-id/30#M30
"v6.0 - CryptoPrevent is no longer based solely on Windows software restriction policies, and now includes a real-time filter and definitions files/updates! "
http://www.fooli**bleep**.com/vb6-projects/cryptoprevent/
http://www.majorgeeks.com/files/details/cryptoprevent.html#screenshots
"Whitehat hackers have struck back at the operators of the CryptoLocker ransom trojan that has held hundreds of thousands of hard drives hostage. Through a partnership that included researchers from FOX-IT and FireEye, researchers managed to recover the private encryption keys that CryptoLocker uses to lock victims' personal computer files until they pay a $300 ransom. They also reverse engineered the binary code at the heart of the malicious program. The result: a website that allows victims to recover the key for their individual content."
FireEye and Fox-IT have partnered to provide free keys designed to unlock systems infected by CryptoLocker; https://www.decryptcryptolocker.com/
Further info; http://arstechnica.com/security/2014/08/whitehats-recover-victims-keys-to-cryptolocker-ransomware/
Intelligence report; http://blog.fox-it.com/2014/08/06/cryptolocker-ransomware-intelligence-report/
HitmanPro.Alert offers protection against CryptoLocker and its variants, like the current CryptoWall.; https://www.youtube.com/watch?v=5M8YYnXIAlw
The second Community Technology Preview of HitmanPro.Alert 3. has also been released; (and is running stable here on my machines); http://test.hitmanpro.com/hmpalert3ctp2.zip
Awesome tips Blackcat!
Regarding your previous tip, CryptoPrevent, the link is censored and doesn't work.
http://www.fooli**bleep**.com/vb6-projects/cryptoprevent/
The domain should be foolish it (without the space in the middle)
www.foolish it.com
See this link to remove Cryptolocker!
http://www.wintips.org/how-to-remove-cryptolocker-ransomware-and-restore-your-files/
and
http://www.youtube.com/watch?v=G2sUQFME0bE
http://www.youtube.com/watch?v=nKDjSVd96_g
http://www.youtube.com/watch?v=1E8uQtVu5CE
http://www.youtube.com/watch?v=wPo03UmaRKs
Check this out,
https://www.us-cert.gov/ncas/alerts/TA13-309A
go here to decrypt cryptolocker.
https://www.decryptcryptolocker.com/
http://www.bleepingcomputer.com/forums/t/543518/decryption-keys-are-now-freely-available-for-victims-of-cryptolocker/
i HAVE TRIED EVERYTHINK...HELP!
Seriously, that might be the easiest option, but if you'd like us to try to help you avoid that situation, then we need more information, such as what is your operating system, which version of F-Secure are you running, and what exactly you have tried so far. There is a lot of information and links in this thread, kindly provided by Rusli. Have you check it all out?
Rikki,
Please go to this site:-
Hitman Pro:-
http://www.surfright.nl/en/cryptoguard
Bitdefender cryptolocker blocking tool:-
http://labs.bitdefender.com/2013/10/cryptolocker-ransomware-makes-a-bitcoin-wallet-per-victim/
Bitdefender blocking tool download link:-
http://download.bitdefender.com/removal_tools/BDAntiCryptoLocker_Release.exe
Fireeye removal:-
http://www.fireeye.com/blog/corporate/2014/08/your-locker-of-information-for-cryptolocker-decryption.html
https://www.decryptcryptolocker.com/
US-CERT:-
https://www.us-cert.gov/ncas/alerts/TA13-309A
Latest updates:- (please take note)
---------------------
Check to see if you have the new variant called cryptodefense:-
http://www.bleepingcomputer.com/forums/t/527937/cryptodefense-newest-cryptolocker-variant-details-inside/
other links:-
http://support.kaspersky.com/viruses/common/10646#block2
http://nakedsecurity.sophos.com/2013/10/18/cryptolocker-ransomware-see-how-it-works-learn-about-prevention-cleanup-and-recovery/
http://blog.emsisoft.com/2013/09/10/cryptolocker-a-new-ransomware-variant/
http://www.surfright.nl/en/cryptoguard
http://lavasoft.com/mylavasoft/company/blog/how-to-remove-cryptolocker
http://www.pandasecurity.com/mediacenter/malware/cryptolocker/
http://www.bitdefender.com/support/cryptolocker-ransomware-%E2%80%93-details-and-prevention-1204.html
http://techblog.avira.com/2013/11/07/ransomware-in-the-wild-the-cryptolocker-malware/en/
https://forums.malwarebytes.org/index.php?/topic/134420-removal-instructions-for-cryptolocker/
https://forums.malwarebytes.org/index.php?/topic/134420-removal-instructions-for-cryptolocker/
http://kb.eset.com/esetkb/index?page=content&id=SOLN3538&actp=search&viewlocale=en_US&searchid=1411294573037
http://blog.avast.com/2013/11/19/can-avast-protect-me-against-cryptolocker/
http://blog.avast.com/tag/cryptolocker/
http://www.microsoft.com/security/portal/mmpc/shared/ransomware.aspx
https://community.mcafee.com/thread/62139
http://news.drweb.com/show/?i=4052&lng=en&c=9
http://blogs.avg.com/news-threats/protecting-against-cryptolocker/
https://www.comodo.com/news/press_releases/2013/11/comodo-endpoint-security-protects-cryptoLocker-ransomware-virus.html
https://blogs.comodo.com/it-security/cryptolocker-virus-best-practices-to-ensure-100-immunity/
https://blogs.comodo.com/comodo_news/cryptolocker-2-0-are-your-ready-we-are/
http://forums.comodo.com/av-false-positivenegative-detection-reporting-b154.0/-t98913.0.html
http://about-threats.trendmicro.com/RelatedThreats.aspx?language=au&name=Ransomware+Raises+the+Stakes+With+CryptoLocker
http://www.symantec.com/security_response/writeup.jsp?docid=2013-091122-3112-99
http://www.f-secure.com/en/web/home_global/online-scanner
http://www.trustport.com/en/products
https://www.gdatasoftware.com/onlineshop/g-data-antivirus.html
http://www.avira.com/en/download/product/avira-rescue-system
http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/kav_rescue_10.iso
http://www.freedrweb.com/cureit/?lng=en
Hey Nikk
Does this work?
https://www.fooli**bleep**.com/vb6-projects/cryptoprevent/
Note:-
**foolish it**** one word...no spacing in between... due to f-secure forum censored ...
click on the attachment picture and zoom in, in this post to view the correct URL
link.
No, but try https://www.foolishXit.com/vb6-projects/cryptoprevent/ and delete the X
Free Download???
http://www.fooli**bleep**.com/download/cryptoprevent-installer/
Zoom in the picture to get the correct URL link.
This will do it, I made a tiny URL
http://tinyurl.com/VB6cryptoprevent
Rikki,
Check the youtube videos here see if it works.
New Youtube Video Clips.
-----------------------------------
http://www.youtube.com/watch?v=Evy0xK1N2gc
http://www.youtube.com/watch?v=2mn-8BVZYB8
http://www.youtube.com/watch?v=-ZXv9_h08iE
http://www.youtube.com/watch?v=iiGSr-HSPb0
http://www.youtube.com/results?search_query=cryptolocker+removal
http://www.freedrweb.com/cureit/?lng=en
CryptoWall version 2.
Please check F-Secure blog....
http://www.f-secure.com/weblog/archives/00002750.html
Hello,
These new enciphering ransomware malware are using the built-in "industrial strenght" RSA provider module in Windows OS to make the files unreadable (because a homebrew crypto algorythm or a strong crypto with amateur implementation is easy to break for experts).
Therefore some "Edward II" among the NSA ranks will need leak info on what kind of a government-mandated backdoor is hidden in Microsoft's implementation of RSA and then, suddenly all ransomed files will be easy to read again!
Best Regards: Tamas Feher, Hungary.