crypto locker - how to remove?

Ransomware; A  nasty strain of Windows malware that uses advanced encryption to lock up user files before demanding a ransom. It leaves users in danger of losing important files forever unless they pay up. 

 http://blog.malwarebytes.org/intelligence/2013/10/cryptolocker-ransomware-what-you-need-to-know/

You need to try and remove the infection/restore your files in 2 main steps;

1. Remove Cryptolocker completely using the free Malwarebytes; Removal guide is here; https://forums.malwarebytes.org/index.php?showtopic=134420

2. But problem is that affected files remain encrypted; Malwarebytes cannot  undo the encryption. The only way of restoring your files is from a backup, or if you have System Restore.

Details are here; http://www.bleepingcomputer.com/forums/t/506924/cryptolocker-hijack-program/page-26#entry3165383

I am not sure that F-Secure have added detection for this malware but even if they have it can't help in recovering encrypted files post-infection. Their online scanner may be able to remove it; http://www.f-secure.com/en/web/labs_global/removal/removing-ransomware

Bleeping Computer have all the information that you need to know; http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information

Edit;  

If you have questions about ransomware, you can ask an F-Secure security expert in a special online Q&A session happening now through to the end of October. The session is being held through the F-Secure Community and is accessible via http://community.f-secure.com/t5/Stop-Ransomware/qa-p/stopransomware.

Oh **bleep**! 

Hi Rina,

Please check this:

http://community.f-secure.com/t5/Stop-Ransomware/Hello-BlackCat-nbsp-our-products/qaq-p/34367/comment-id/30#M30

"Whitehat hackers have struck back at the operators of the CryptoLocker ransom trojan that has held hundreds of thousands of hard drives hostage. Through a partnership that included researchers from FOX-IT and FireEye, researchers managed to recover the private encryption keys that CryptoLocker uses to lock victims' personal computer files until they pay a $300 ransom. They also reverse engineered the binary code at the heart of the malicious program. The result: a website that allows victims to recover the key for their individual content."

FireEye and Fox-IT have partnered to provide free keys designed to unlock systems infected by CryptoLocker; https://www.decryptcryptolocker.com/

Further info; http://arstechnica.com/security/2014/08/whitehats-recover-victims-keys-to-cryptolocker-ransomware/

Intelligence report; http://blog.fox-it.com/2014/08/06/cryptolocker-ransomware-intelligence-report/

HitmanPro.Alert offers protection against CryptoLocker and its variants, like the current CryptoWall.; https://www.youtube.com/watch?v=5M8YYnXIAlw

The second Community Technology Preview of HitmanPro.Alert 3. has also been released; (and is running stable here on my machines); http://test.hitmanpro.com/hmpalert3ctp2.zip

Awesome tips Blackcat!

Regarding your previous tip, CryptoPrevent, the link is censored and doesn't work.

http://www.fooli**bleep**.com/vb6-projects/cryptoprevent/

The domain should be foolish it  (without the space in the middle)

www.foolish it.com

Check this out,

https://www.us-cert.gov/ncas/alerts/TA13-309A

i HAVE TRIED EVERYTHINK...HELP!

Rikki,

Please go to this site:-

Hitman Pro:-

http://www.surfright.nl/en/cryptoguard

Bitdefender cryptolocker blocking tool:-

http://labs.bitdefender.com/2013/10/cryptolocker-ransomware-makes-a-bitcoin-wallet-per-victim/

Bitdefender blocking tool download link:-

http://download.bitdefender.com/removal_tools/BDAntiCryptoLocker_Release.exe

Fireeye removal:-

http://www.fireeye.com/blog/corporate/2014/08/your-locker-of-information-for-cryptolocker-decryption.html

https://www.decryptcryptolocker.com/

US-CERT:-

https://www.us-cert.gov/ncas/alerts/TA13-309A

Latest updates:- (please take note)

---------------------

Check to see if you have the new variant called cryptodefense:-

http://www.bleepingcomputer.com/forums/t/527937/cryptodefense-newest-cryptolocker-variant-details-inside/

other links:-

http://support.kaspersky.com/viruses/common/10646#block2

http://nakedsecurity.sophos.com/2013/10/18/cryptolocker-ransomware-see-how-it-works-learn-about-prevention-cleanup-and-recovery/

http://blog.emsisoft.com/2013/09/10/cryptolocker-a-new-ransomware-variant/

http://www.surfright.nl/en/cryptoguard

http://lavasoft.com/mylavasoft/company/blog/how-to-remove-cryptolocker

http://www.pandasecurity.com/mediacenter/malware/cryptolocker/

http://www.bitdefender.com/support/cryptolocker-ransomware-%E2%80%93-details-and-prevention-1204.html

http://techblog.avira.com/2013/11/07/ransomware-in-the-wild-the-cryptolocker-malware/en/

https://forums.malwarebytes.org/index.php?/topic/134420-removal-instructions-for-cryptolocker/

https://forums.malwarebytes.org/index.php?/topic/134420-removal-instructions-for-cryptolocker/

http://kb.eset.com/esetkb/index?page=content&id=SOLN3538&actp=search&viewlocale=en_US&searchid=1411294573037

http://blog.avast.com/2013/11/19/can-avast-protect-me-against-cryptolocker/

http://blog.avast.com/tag/cryptolocker/

http://www.microsoft.com/security/portal/mmpc/shared/ransomware.aspx

https://community.mcafee.com/thread/62139

http://news.drweb.com/show/?i=4052&lng=en&c=9

http://blogs.avg.com/news-threats/protecting-against-cryptolocker/

https://www.comodo.com/news/press_releases/2013/11/comodo-endpoint-security-protects-cryptoLocker-ransomware-virus.html

https://blogs.comodo.com/it-security/cryptolocker-virus-best-practices-to-ensure-100-immunity/

https://blogs.comodo.com/comodo_news/cryptolocker-2-0-are-your-ready-we-are/

http://forums.comodo.com/av-false-positivenegative-detection-reporting-b154.0/-t98913.0.html

http://about-threats.trendmicro.com/RelatedThreats.aspx?language=au&name=Ransomware+Raises+the+Stakes+With+CryptoLocker

http://www.symantec.com/security_response/writeup.jsp?docid=2013-091122-3112-99

 http://www.f-secure.com/en/web/home_global/online-scanner

http://www.trustport.com/en/products

https://www.gdatasoftware.com/onlineshop/g-data-antivirus.html

http://www.avira.com/en/download/product/avira-rescue-system

http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/kav_rescue_10.iso

http://www.freedrweb.com/cureit/?lng=en

Hey Nikk

Does this work?

https://www.fooli**bleep**.com/vb6-projects/cryptoprevent/

Note:-

**foolish it**** one word...no spacing in between... due to f-secure forum censored ...

click on the attachment picture and zoom in, in this post to view the correct URL link.

Free Download???

http://www.fooli**bleep**.com/download/cryptoprevent-installer/

Zoom in the picture to get the correct URL link.

Rikki,

Check the youtube videos here see if it works.

New Youtube Video Clips.

-----------------------------------

http://www.youtube.com/watch?v=Evy0xK1N2gc

http://www.youtube.com/watch?v=2mn-8BVZYB8

http://www.youtube.com/watch?v=-ZXv9_h08iE

http://www.youtube.com/watch?v=iiGSr-HSPb0

http://www.youtube.com/results?search_query=cryptolocker+removal

http://www.freedrweb.com/cureit/?lng=en

Hello,

These new enciphering ransomware malware are using the built-in "industrial strenght" RSA provider module in Windows OS to make the files unreadable (because a homebrew crypto algorythm or a strong crypto with amateur implementation is easy to break for experts).

Therefore some "Edward II" among the NSA ranks will need leak info on what kind of a government-mandated backdoor is hidden in Microsoft's implementation of RSA and then, suddenly all ransomed files will be easy to read again!

Best Regards: Tamas Feher, Hungary.