crypto locker - how to remove?

Blackcat · October 2013

Ransomware; A nasty strain of Windows malware that uses advanced encryption to lock up user files before demanding a ransom. It leaves users in danger of losing important files forever unless they pay up.

http://blog.malwarebytes.org/intelligence/2013/10/cryptolocker-ransomware-what-you-need-to-know/

You need to try and remove the infection/restore your files in 2 main steps;

1. Remove Cryptolocker completely using the free Malwarebytes; Removal guide is here; https://forums.malwarebytes.org/index.php?showtopic=134420

2. But problem is that affected files remain encrypted; Malwarebytes cannot undo the encryption. The only way of restoring your files is from a backup, or if you have System Restore.

Details are here; http://www.bleepingcomputer.com/forums/t/506924/cryptolocker-hijack-program/page-26#entry3165383

I am not sure that F-Secure have added detection for this malware but even if they have it can't help in recovering encrypted files post-infection. Their online scanner may be able to remove it; http://www.f-secure.com/en/web/labs_global/removal/removing-ransomware

Bleeping Computer have all the information that you need to know; http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information

Edit;

If you have questions about ransomware, you can ask an F-Secure security expert in a special online Q&A session happening now through to the end of October. The session is being held through the F-Secure Community and is accessible via http://community.f-secure.com/t5/Stop-Ransomware/qa-p/stopransomware.

Blackcat · October 2013

For future use;

a. Try CryptoPrevent is a free utility by Fooli**bleep** LLC that automatically adds the suggested Software Restriction Policy Path Rules (listed in the guide) to your computer. The added Software Restriction Policies are to prevent CryptoLocker from being executed in the first place; http://www.fooli**bleep**.com/vb6-projects/cryptoprevent/

b. This ransomware again shows the importance of backing up your data; backup, backup, backup!!! Get yourself a good backup program such as Macrium; http://www.macrium.com/reflectfree.aspx

Video here shows CryptoLocker in action; http://nakedsecurity.sophos.com/2013/10/18/cryptolocker-ransomware-see-how-it-works-learn-about-prevention-cleanup-and-recovery/

Simon · October 2013

Oh **bleep**! Smiley LOL

Chrissy · October 2013

Hi all!

Just to note, the Q&A about Ransomware is being extended by a week or two, so get your questions in while you have the chance!

And we should soon be seeing a response to the Crypto Locker question, so keep an eye out here: http://community.f-secure.com/t5/Stop-Ransomware/Hi-does-F-Secure-IS-2014-detect/qaq-p/34281

@Rantapallo, has Blackcat's advice helped with this, or are you still in need of further advice?

// Chrissy

Rina · January 2014

Hello i have cryptolocker virus on my computer what to do we tried to save our files and folders but they are not opening what to do please help us.

Jake · January 2014

Hi Rina,

Please check this:

http://community.f-secure.com/t5/Stop-Ransomware/Hello-BlackCat-nbsp-our-products/qaq-p/34367/comment-id/30#M30

Blackcat · June 2014

"v6.0 - CryptoPrevent is no longer based solely on Windows software restriction policies, and now includes a real-time filter and definitions files/updates! "

http://www.fooli**bleep**.com/vb6-projects/cryptoprevent/

http://www.majorgeeks.com/files/details/cryptoprevent.html#screenshots

Blackcat · August 2014

"Whitehat hackers have struck back at the operators of the CryptoLocker ransom trojan that has held hundreds of thousands of hard drives hostage. Through a partnership that included researchers from FOX-IT and FireEye, researchers managed to recover the private encryption keys that CryptoLocker uses to lock victims' personal computer files until they pay a $300 ransom. They also reverse engineered the binary code at the heart of the malicious program. The result: a website that allows victims to recover the key for their individual content."

FireEye and Fox-IT have partnered to provide free keys designed to unlock systems infected by CryptoLocker; https://www.decryptcryptolocker.com/

Further info; http://arstechnica.com/security/2014/08/whitehats-recover-victims-keys-to-cryptolocker-ransomware/

Intelligence report; http://blog.fox-it.com/2014/08/06/cryptolocker-ransomware-intelligence-report/

HitmanPro.Alert offers protection against CryptoLocker and its variants, like the current CryptoWall.; https://www.youtube.com/watch?v=5M8YYnXIAlw

The second Community Technology Preview of HitmanPro.Alert 3. has also been released; (and is running stable here on my machines); http://test.hitmanpro.com/hmpalert3ctp2.zip

Simon · August 2014

That's great news!

NikK · August 2014

Awesome tips Blackcat!

Regarding your previous tip, CryptoPrevent, the link is censored and doesn't work.

http://www.fooli**bleep**.com/vb6-projects/cryptoprevent/

The domain should be foolish it (without the space in the middle)

www.foolish it.com

Rusli · August 2014

See this link to remove Cryptolocker!

http://www.wintips.org/how-to-remove-cryptolocker-ransomware-and-restore-your-files/

and

http://www.youtube.com/watch?v=G2sUQFME0bE

http://www.youtube.com/watch?v=nKDjSVd96_g

http://www.youtube.com/watch?v=1E8uQtVu5CE

http://www.youtube.com/watch?v=wPo03UmaRKs

Rusli · August 2014

Check this out,

https://www.us-cert.gov/ncas/alerts/TA13-309A

Rusli · August 2014

go here to decrypt cryptolocker.

https://www.decryptcryptolocker.com/

http://www.bleepingcomputer.com/forums/t/543518/decryption-keys-are-now-freely-available-for-victims-of-cryptolocker/

RIKKI · September 2014

i HAVE TRIED EVERYTHINK...HELP!

Simon · September 2014

If you've literally tried everything, then the only option is to format your computer.

Seriously, that might be the easiest option, but if you'd like us to try to help you avoid that situation, then we need more information, such as what is your operating system, which version of F-Secure are you running, and what exactly you have tried so far. There is a lot of information and links in this thread, kindly provided by Rusli. Have you check it all out?

Rusli · September 2014

Rikki,

Please go to this site:-

Hitman Pro:-

http://www.surfright.nl/en/cryptoguard

Bitdefender cryptolocker blocking tool:-

http://labs.bitdefender.com/2013/10/cryptolocker-ransomware-makes-a-bitcoin-wallet-per-victim/

Bitdefender blocking tool download link:-

http://download.bitdefender.com/removal_tools/BDAntiCryptoLocker_Release.exe

Fireeye removal:-

http://www.fireeye.com/blog/corporate/2014/08/your-locker-of-information-for-cryptolocker-decryption.html

https://www.decryptcryptolocker.com/

US-CERT:-

https://www.us-cert.gov/ncas/alerts/TA13-309A

Latest updates:- (please take note)

---------------------

Check to see if you have the new variant called cryptodefense:-

http://www.bleepingcomputer.com/forums/t/527937/cryptodefense-newest-cryptolocker-variant-details-inside/

other links:-

http://support.kaspersky.com/viruses/common/10646#block2

http://nakedsecurity.sophos.com/2013/10/18/cryptolocker-ransomware-see-how-it-works-learn-about-prevention-cleanup-and-recovery/

http://blog.emsisoft.com/2013/09/10/cryptolocker-a-new-ransomware-variant/

http://www.surfright.nl/en/cryptoguard

http://lavasoft.com/mylavasoft/company/blog/how-to-remove-cryptolocker

http://www.pandasecurity.com/mediacenter/malware/cryptolocker/

http://www.bitdefender.com/support/cryptolocker-ransomware-%E2%80%93-details-and-prevention-1204.html

http://techblog.avira.com/2013/11/07/ransomware-in-the-wild-the-cryptolocker-malware/en/

https://forums.malwarebytes.org/index.php?/topic/134420-removal-instructions-for-cryptolocker/

http://kb.eset.com/esetkb/index?page=content&id=SOLN3538&actp=search&viewlocale=en_US&searchid=1411294573037

http://blog.avast.com/2013/11/19/can-avast-protect-me-against-cryptolocker/

http://blog.avast.com/tag/cryptolocker/

http://www.microsoft.com/security/portal/mmpc/shared/ransomware.aspx

https://community.mcafee.com/thread/62139

http://news.drweb.com/show/?i=4052&lng=en&c=9

http://blogs.avg.com/news-threats/protecting-against-cryptolocker/

https://www.comodo.com/news/press_releases/2013/11/comodo-endpoint-security-protects-cryptoLocker-ransomware-virus.html

https://blogs.comodo.com/it-security/cryptolocker-virus-best-practices-to-ensure-100-immunity/

https://blogs.comodo.com/comodo_news/cryptolocker-2-0-are-your-ready-we-are/

http://forums.comodo.com/av-false-positivenegative-detection-reporting-b154.0/-t98913.0.html

http://about-threats.trendmicro.com/RelatedThreats.aspx?language=au&name=Ransomware+Raises+the+Stakes+With+CryptoLocker

http://www.symantec.com/security_response/writeup.jsp?docid=2013-091122-3112-99

http://www.f-secure.com/en/web/home_global/online-scanner

http://www.trustport.com/en/products

https://www.gdatasoftware.com/onlineshop/g-data-antivirus.html

http://www.avira.com/en/download/product/avira-rescue-system

http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/kav_rescue_10.iso

http://www.freedrweb.com/cureit/?lng=en

nightzkung · September 2014

Very good post. I am facing a few of these issues as well. ------------------------------------ อ่านการ์ตูนออนไลน์ one piece naruto bleach fairy tail

Rusli · September 2014

Hey Nikk

Does this work?

https://www.fooli**bleep**.com/vb6-projects/cryptoprevent/

Note:-

**foolish it**** one word...no spacing in between... due to f-secure forum censored ...

click on the attachment picture and zoom in, in this post to view the correct URL link.

NikK · September 2014

No, but try https://www.foolishXit.com/vb6-projects/cryptoprevent/ and delete the X

Rusli · September 2014

Free Download???

http://www.fooli**bleep**.com/download/cryptoprevent-installer/

Zoom in the picture to get the correct URL link.

NikK · September 2014

This will do it, I made a tiny URL

http://tinyurl.com/VB6cryptoprevent

Rusli · September 2014

Rikki,

Check the youtube videos here see if it works.

New Youtube Video Clips.

-----------------------------------

http://www.youtube.com/watch?v=Evy0xK1N2gc

http://www.youtube.com/watch?v=2mn-8BVZYB8

http://www.youtube.com/watch?v=-ZXv9_h08iE

http://www.youtube.com/watch?v=iiGSr-HSPb0

http://www.youtube.com/results?search_query=cryptolocker+removal

http://www.freedrweb.com/cureit/?lng=en

Rusli · October 2014

CryptoWall version 2.

Please check F-Secure blog....

http://www.f-secure.com/weblog/archives/00002750.html

etomcat · October 2014

Hello,

These new enciphering ransomware malware are using the built-in "industrial strenght" RSA provider module in Windows OS to make the files unreadable (because a homebrew crypto algorythm or a strong crypto with amateur implementation is easy to break for experts).

Therefore some "Edward II" among the NSA ranks will need leak info on what kind of a government-mandated backdoor is hidden in Microsoft's implementation of RSA and then, suddenly all ransomed files will be easy to read again!

Best Regards: Tamas Feher, Hungary.

crypto locker - how to remove?

Comments

Categories