Overclock.net › Forums › Software, Programming and Coding › Other Software › Cryptolocker Virus
New Posts  All Forums:Forum Nav:

Cryptolocker Virus

post #1 of 7
Thread Starter 
A client of mine got this nasty little bug on his system, telling him that all of his work files had been encrypted and to send money to yada yada etc you get the idea. Well I was able to recover his files, but sure enough, all of his word, excel and pdf files now open up with a bunch of jibberish instead of his actual data.

Any ideas of what I can do to restore these files?
The Water Ninja
(26 items)
 
Pepto Pony
(12 items)
 
MrDVR
(15 items)
 
CPUMotherboardGraphicsRAM
AMD FX-8350 @ 4.8Ghz CROSSHAIR V FORMULA-Z MSI GTX 980 Gaming 4g 16Gb G. Skill Ripjaws 4x4 @ 1600 
Hard DriveHard DriveHard DriveOptical Drive
Samsung 840 PRO 128Gb SSD Intel 160 Gb SSD Intel 250 Gb SSD Generic DVD-RW 
CoolingCoolingCoolingCooling
2 x Noctua (NF-P12-1300 )1300rpm Premium Silent... 2 x Corsair Air Series SP120   COUGAR CF-V12H Vortex Hydro-Dynamic-Bearing  Monsoon 90° Rotary Angle Fitting - 5/8" - Red 
CoolingCoolingCoolingCooling
Bitspower Dual / Single D5 Top Upgrade Kit 100 ... ModMyToys DreamFlex Premium 3/8" ID Tubing Reta... Coolance Liquid Coolant Bottle, 700mL Fluoresce... Coolance PMP 450 Variable Speed D5 Pump 
CoolingCoolingCoolingCooling
Bitspower D5 Mod Top V2 Pom version Alphacool NexXxos UT60 Full Copper Radiator 240 Noctua NF-A6X25 FLX Quiet Computer Cooling Fan ... NZXT Sentry Mesh Fan Controller w/ Five 30 watt... 
OSMonitorKeyboardPower
Microsoft Windows 7 Ultimate Toshiba Regza 52" 1920 x 1080 @ 120Hz  Microsoft Wireless Comfort 5000 Keyboard and Mouse SeaSonic M12II 750 
CaseAudio
My TV Stand Cabinet Creative Sound Blaster X-Fi Titanium 
CPUMotherboardGraphicsRAM
FX-4300 Gigabyte GA-78LMT-USB3 EVGA Geforce GTX 260 G.Skill Ripjaws X 
Hard DriveHard DriveOptical DriveCooling
Corsair SSD Samsung 7200 Laptop drive Some DVD Burner I took out of a dead Dell. Noctua NH-C12P SE14 
MonitorKeyboardPowerCase
Dell 19" 16:9 Logitec wireless Enermax 650w Apevia X-Cruiser3 Pink 
CPUMotherboardGraphicsRAM
A6-6400K Dual Core MSI A78M-E35 Onboard 4Gb G.Skill Ripjaws 1600Mhz (2 x 2) 
Hard DriveHard DriveOptical DriveCooling
Intel 320 SSD Western Digital 2.5" 1Tb 7200rpm  LG External Blue-ray Combo Drive Noctual NH-L9a 92mm SS02 
OSMonitorKeyboardPower
Windows 7 Ultimate 64bit Toshiba Regza 52" 1080p Logitech K400 Antec EarthWatts Green EA-380D 
CaseAudioOther
A piece of plywood and some zip ties. Onboard Hauppauge WinTV HVR-2250 dual tuner card. 
  hide details  
Reply
The Water Ninja
(26 items)
 
Pepto Pony
(12 items)
 
MrDVR
(15 items)
 
CPUMotherboardGraphicsRAM
AMD FX-8350 @ 4.8Ghz CROSSHAIR V FORMULA-Z MSI GTX 980 Gaming 4g 16Gb G. Skill Ripjaws 4x4 @ 1600 
Hard DriveHard DriveHard DriveOptical Drive
Samsung 840 PRO 128Gb SSD Intel 160 Gb SSD Intel 250 Gb SSD Generic DVD-RW 
CoolingCoolingCoolingCooling
2 x Noctua (NF-P12-1300 )1300rpm Premium Silent... 2 x Corsair Air Series SP120   COUGAR CF-V12H Vortex Hydro-Dynamic-Bearing  Monsoon 90° Rotary Angle Fitting - 5/8" - Red 
CoolingCoolingCoolingCooling
Bitspower Dual / Single D5 Top Upgrade Kit 100 ... ModMyToys DreamFlex Premium 3/8" ID Tubing Reta... Coolance Liquid Coolant Bottle, 700mL Fluoresce... Coolance PMP 450 Variable Speed D5 Pump 
CoolingCoolingCoolingCooling
Bitspower D5 Mod Top V2 Pom version Alphacool NexXxos UT60 Full Copper Radiator 240 Noctua NF-A6X25 FLX Quiet Computer Cooling Fan ... NZXT Sentry Mesh Fan Controller w/ Five 30 watt... 
OSMonitorKeyboardPower
Microsoft Windows 7 Ultimate Toshiba Regza 52" 1920 x 1080 @ 120Hz  Microsoft Wireless Comfort 5000 Keyboard and Mouse SeaSonic M12II 750 
CaseAudio
My TV Stand Cabinet Creative Sound Blaster X-Fi Titanium 
CPUMotherboardGraphicsRAM
FX-4300 Gigabyte GA-78LMT-USB3 EVGA Geforce GTX 260 G.Skill Ripjaws X 
Hard DriveHard DriveOptical DriveCooling
Corsair SSD Samsung 7200 Laptop drive Some DVD Burner I took out of a dead Dell. Noctua NH-C12P SE14 
MonitorKeyboardPowerCase
Dell 19" 16:9 Logitec wireless Enermax 650w Apevia X-Cruiser3 Pink 
CPUMotherboardGraphicsRAM
A6-6400K Dual Core MSI A78M-E35 Onboard 4Gb G.Skill Ripjaws 1600Mhz (2 x 2) 
Hard DriveHard DriveOptical DriveCooling
Intel 320 SSD Western Digital 2.5" 1Tb 7200rpm  LG External Blue-ray Combo Drive Noctual NH-L9a 92mm SS02 
OSMonitorKeyboardPower
Windows 7 Ultimate 64bit Toshiba Regza 52" 1080p Logitech K400 Antec EarthWatts Green EA-380D 
CaseAudioOther
A piece of plywood and some zip ties. Onboard Hauppauge WinTV HVR-2250 dual tuner card. 
  hide details  
Reply
post #2 of 7
heard of this before, never seen it resolved. sub'd to see an answer
post #3 of 7
You can't without having the key to decrypt them. Really sucks for your client that they got that virus.
post #4 of 7
The only way he can get all his stuff back is by paying the ransom. I hope he has a backup somewhere.
:D
(15 items)
 
  
CPUMotherboardGraphicsRAM
Intel i5 3570K [4.5ghz] Asus P8Z77 V-Pro Asus GTX 760 2X4gb Corsair XMS3 1600mhz 
Hard DriveHard DriveCoolingOS
WD Blue 1TB EZEX X 2 [RAID 0] [WD Black 640GB][2 X WD Blue 1TB EZEX] Corsair H80i Windows 7 64bit 
MonitorPowerCase
Dell Ultrasharp 23" Corsair CX430W v2 Corsair Graphite 600T 
  hide details  
Reply
:D
(15 items)
 
  
CPUMotherboardGraphicsRAM
Intel i5 3570K [4.5ghz] Asus P8Z77 V-Pro Asus GTX 760 2X4gb Corsair XMS3 1600mhz 
Hard DriveHard DriveCoolingOS
WD Blue 1TB EZEX X 2 [RAID 0] [WD Black 640GB][2 X WD Blue 1TB EZEX] Corsair H80i Windows 7 64bit 
MonitorPowerCase
Dell Ultrasharp 23" Corsair CX430W v2 Corsair Graphite 600T 
  hide details  
Reply
post #5 of 7
Thread Starter 
Quote:
Originally Posted by chip94 View Post

The only way he can get all his stuff back is by paying the ransom. I hope he has a backup somewhere.

I read an article that says people are reporting that paying the ransom, just loses them the ransom money. No one has reported paying actually works.
The Water Ninja
(26 items)
 
Pepto Pony
(12 items)
 
MrDVR
(15 items)
 
CPUMotherboardGraphicsRAM
AMD FX-8350 @ 4.8Ghz CROSSHAIR V FORMULA-Z MSI GTX 980 Gaming 4g 16Gb G. Skill Ripjaws 4x4 @ 1600 
Hard DriveHard DriveHard DriveOptical Drive
Samsung 840 PRO 128Gb SSD Intel 160 Gb SSD Intel 250 Gb SSD Generic DVD-RW 
CoolingCoolingCoolingCooling
2 x Noctua (NF-P12-1300 )1300rpm Premium Silent... 2 x Corsair Air Series SP120   COUGAR CF-V12H Vortex Hydro-Dynamic-Bearing  Monsoon 90° Rotary Angle Fitting - 5/8" - Red 
CoolingCoolingCoolingCooling
Bitspower Dual / Single D5 Top Upgrade Kit 100 ... ModMyToys DreamFlex Premium 3/8" ID Tubing Reta... Coolance Liquid Coolant Bottle, 700mL Fluoresce... Coolance PMP 450 Variable Speed D5 Pump 
CoolingCoolingCoolingCooling
Bitspower D5 Mod Top V2 Pom version Alphacool NexXxos UT60 Full Copper Radiator 240 Noctua NF-A6X25 FLX Quiet Computer Cooling Fan ... NZXT Sentry Mesh Fan Controller w/ Five 30 watt... 
OSMonitorKeyboardPower
Microsoft Windows 7 Ultimate Toshiba Regza 52" 1920 x 1080 @ 120Hz  Microsoft Wireless Comfort 5000 Keyboard and Mouse SeaSonic M12II 750 
CaseAudio
My TV Stand Cabinet Creative Sound Blaster X-Fi Titanium 
CPUMotherboardGraphicsRAM
FX-4300 Gigabyte GA-78LMT-USB3 EVGA Geforce GTX 260 G.Skill Ripjaws X 
Hard DriveHard DriveOptical DriveCooling
Corsair SSD Samsung 7200 Laptop drive Some DVD Burner I took out of a dead Dell. Noctua NH-C12P SE14 
MonitorKeyboardPowerCase
Dell 19" 16:9 Logitec wireless Enermax 650w Apevia X-Cruiser3 Pink 
CPUMotherboardGraphicsRAM
A6-6400K Dual Core MSI A78M-E35 Onboard 4Gb G.Skill Ripjaws 1600Mhz (2 x 2) 
Hard DriveHard DriveOptical DriveCooling
Intel 320 SSD Western Digital 2.5" 1Tb 7200rpm  LG External Blue-ray Combo Drive Noctual NH-L9a 92mm SS02 
OSMonitorKeyboardPower
Windows 7 Ultimate 64bit Toshiba Regza 52" 1080p Logitech K400 Antec EarthWatts Green EA-380D 
CaseAudioOther
A piece of plywood and some zip ties. Onboard Hauppauge WinTV HVR-2250 dual tuner card. 
  hide details  
Reply
The Water Ninja
(26 items)
 
Pepto Pony
(12 items)
 
MrDVR
(15 items)
 
CPUMotherboardGraphicsRAM
AMD FX-8350 @ 4.8Ghz CROSSHAIR V FORMULA-Z MSI GTX 980 Gaming 4g 16Gb G. Skill Ripjaws 4x4 @ 1600 
Hard DriveHard DriveHard DriveOptical Drive
Samsung 840 PRO 128Gb SSD Intel 160 Gb SSD Intel 250 Gb SSD Generic DVD-RW 
CoolingCoolingCoolingCooling
2 x Noctua (NF-P12-1300 )1300rpm Premium Silent... 2 x Corsair Air Series SP120   COUGAR CF-V12H Vortex Hydro-Dynamic-Bearing  Monsoon 90° Rotary Angle Fitting - 5/8" - Red 
CoolingCoolingCoolingCooling
Bitspower Dual / Single D5 Top Upgrade Kit 100 ... ModMyToys DreamFlex Premium 3/8" ID Tubing Reta... Coolance Liquid Coolant Bottle, 700mL Fluoresce... Coolance PMP 450 Variable Speed D5 Pump 
CoolingCoolingCoolingCooling
Bitspower D5 Mod Top V2 Pom version Alphacool NexXxos UT60 Full Copper Radiator 240 Noctua NF-A6X25 FLX Quiet Computer Cooling Fan ... NZXT Sentry Mesh Fan Controller w/ Five 30 watt... 
OSMonitorKeyboardPower
Microsoft Windows 7 Ultimate Toshiba Regza 52" 1920 x 1080 @ 120Hz  Microsoft Wireless Comfort 5000 Keyboard and Mouse SeaSonic M12II 750 
CaseAudio
My TV Stand Cabinet Creative Sound Blaster X-Fi Titanium 
CPUMotherboardGraphicsRAM
FX-4300 Gigabyte GA-78LMT-USB3 EVGA Geforce GTX 260 G.Skill Ripjaws X 
Hard DriveHard DriveOptical DriveCooling
Corsair SSD Samsung 7200 Laptop drive Some DVD Burner I took out of a dead Dell. Noctua NH-C12P SE14 
MonitorKeyboardPowerCase
Dell 19" 16:9 Logitec wireless Enermax 650w Apevia X-Cruiser3 Pink 
CPUMotherboardGraphicsRAM
A6-6400K Dual Core MSI A78M-E35 Onboard 4Gb G.Skill Ripjaws 1600Mhz (2 x 2) 
Hard DriveHard DriveOptical DriveCooling
Intel 320 SSD Western Digital 2.5" 1Tb 7200rpm  LG External Blue-ray Combo Drive Noctual NH-L9a 92mm SS02 
OSMonitorKeyboardPower
Windows 7 Ultimate 64bit Toshiba Regza 52" 1080p Logitech K400 Antec EarthWatts Green EA-380D 
CaseAudioOther
A piece of plywood and some zip ties. Onboard Hauppauge WinTV HVR-2250 dual tuner card. 
  hide details  
Reply
post #6 of 7
Quote:
Originally Posted by wizardonthejob View Post

I read an article that says people are reporting that paying the ransom, just loses them the ransom money. No one has reported paying actually works.
That is the way they do things, they only need a small portion of the infected machines to have the owner pay the ransom to come out with a significant profit. Most likely, your client is out of luck if they didn't have a recent backup that wasn't connected to their machine at the time of infection.
post #7 of 7
Quote:
Originally Posted by wizardonthejob View Post

I read an article that says people are reporting that paying the ransom, just loses them the ransom money. No one has reported paying actually works.

Here's an example of where paying ransom worked: http://arstechnica.com/security/2013/10/youre-infected-if-you-want-to-see-your-data-again-pay-us-300-in-bitcoins/

It's in the best interest of the malware owners to decrypt. If they didn't, no one would have incentive to pay the ransom in the first place.


There's no way you can recover the files from the encrypted files. (Unless you happen to access to a few supercomputers and the budget to run them for a few years). Either pay... or go to backups/archives.... he's has backups/archives... right? smile.gif
Once again...
(13 items)
 
  
CPUMotherboardGraphicsRAM
i7 920 [4.28GHz, HT] Asus P6T + Broadcom NetXtreme II VisionTek HD5850 [900/1200] + Galaxy GT240 2x4GB G.Skill Ripjaw X [1632 MHz] 
Hard DriveOSMonitorKeyboard
Intel X25-M 160GB + 3xRAID0 500GB 7200.12 Window 7 Pro 64 Acer H243H + Samsung 226BW XARMOR-U9BL  
PowerCaseMouseMouse Pad
Antec Truepower New 750W Li Lian PC-V2100 [10x120mm fans] Logitech G9 X-Trac Pro 
  hide details  
Reply
Once again...
(13 items)
 
  
CPUMotherboardGraphicsRAM
i7 920 [4.28GHz, HT] Asus P6T + Broadcom NetXtreme II VisionTek HD5850 [900/1200] + Galaxy GT240 2x4GB G.Skill Ripjaw X [1632 MHz] 
Hard DriveOSMonitorKeyboard
Intel X25-M 160GB + 3xRAID0 500GB 7200.12 Window 7 Pro 64 Acer H243H + Samsung 226BW XARMOR-U9BL  
PowerCaseMouseMouse Pad
Antec Truepower New 750W Li Lian PC-V2100 [10x120mm fans] Logitech G9 X-Trac Pro 
  hide details  
Reply
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Other Software
Overclock.net › Forums › Software, Programming and Coding › Other Software › Cryptolocker Virus