Original Cryptolocker Ransomware Support and Help Topic

you should never pay the virus, and instead remove it as soon as possible. to do this, first, you need to restart the PC into safe mode with networking. then open the control panel to show all the hidden files and folders. after that, search every corner of the PC to find out all the files about the virus and delete all of them. the last step is to open regedit and remove the registries that created by the virus. hope you can remove the virus successfully.

Moderator edit: Clean up Content

Roger

Edited by rotor123, 11 September 2013 - 12:24 PM.

Emily is correct.  I followed this walk through for a customer that had this infection and so far no sign of it returning.  

I think people are less concerned with removing the virus and more concerned with decrypting the files. Removing the virus does not seem difficult but repairing the damage is another thing entirely.

I think people are less concerned with removing the virus and more concerned with decrypting the files. Removing the virus does not seem difficult but repairing the damage is another thing entirely.

Agreed. Disabling and removing it is insanely easy. The difficult part is that antivirus doesn't pick it up until its already encrypted the files. We want a fix for the encryption.

Of course I cannot speak to others, but this instance had just been detected today.  After removing the registry keys and rebooting, none of the local or

company shared files were locked or encrypted.  

AS crazy as it sounds, pay it, we paid it and the darn thing actually worked.

AS crazy as it sounds, pay it, we paid it and the darn thing actually worked.

Yes, not willing to do that. Not worth the risk. Plus when you pay you are telling the attacker that you are willing to do pay and it could open you up to future attacks.

Of course I cannot speak to others, but this instance had just been detected today.  After removing the registry keys and rebooting, none of the local or

company shared files were locked or encrypted.  

Not sure how this is possible. Cant see it working for mapped network drives....

Can anyone else confirm removing the virus would change the affected files back?

 

Of course I cannot speak to others, but this instance had just been detected today.  After removing the registry keys and rebooting, none of the local or

company shared files were locked or encrypted.  

 

Not sure how this is possible. Cant see it working for mapped network drives....

 

Can anyone else confirm removing the virus would change the affected files back?

 

I can confirm that this did not help. Every local and shared file remained encrypted after repairing the virus.

Paying these pukes is the WORST thing that you can do. Any IT Admin worth a damn would have a solid backup in place, clean the suspect PC and restore the files. I would be ashamed to go to my boss and/or client and say we should pay the money and I wouldn't be shocked if the client showed me the door and told not to come back.

I can confirm as well, and this thing is spreading alarmingly.  Very surprised to not see it on the site more.

Removing the ransomware is easy, unencrypting the files is the issue.

A more far reaching issue is how to prevent infection.  This thing is nasty and has the potential to do enourmous amounts of damage worldwide!

As a precaution I have taken all my clients network shares to read-only.  I currently have 3 clients infected first thing this morning.

I can confirm as well, and this thing is spreading alarmingly.  Very surprised to not see it on the site more.

 

Removing the ransomware is easy, unencrypting the files is the issue.

 

A more far reaching issue is how to prevent infection.  This thing is nasty and has the potential to do enourmous amounts of damage worldwide!

 

As a precaution I have taken all my clients network shares to read-only.  I currently have 3 clients infected first thing this morning.

Kaspersky did not pick it up until after it had encrypted the files. Too little too late.

Paying these pukes is the WORST thing that you can do. Any IT Admin worth a damn would have a solid backup in place, clean the suspect PC and restore the files. I would be ashamed to go to my boss and/or client and say we should pay the money and I wouldn't be shocked if the client showed me the door and told not to come back.

And what about the client that has not listened to your advice in the past and implemented a good backup regimen? 

What do you suggest beyond "screw them"?  Real business does not work that way.

Got one client that may be up for this option....

 

Paying these pukes is the WORST thing that you can do. Any IT Admin worth a damn would have a solid backup in place, clean the suspect PC and restore the files. I would be ashamed to go to my boss and/or client and say we should pay the money and I wouldn't be shocked if the client showed me the door and told not to come back.

And what about the client that has not listened to your advice in the past and implemented a good backup regimen? 

 

What do you suggest beyond "screw them"?  Real business does not work that way.

 

Got one client that may be up for this option....

 

If you are the IT Admin for them and you advised them to have a backup in place and they chose not to... Then yes... Not much you can do there beyond point out that a good backup would allow them to be restoring files. Real business doesn't ignore sound advice and has a a backup.

Lets keep our personal attacks of IT Admins to a minimum...  We all agree that backups are essential.  With that said let em offer two pieces of info:

#1 in my situation i have only been on staff for less than 30 day's and although getting proper backups were at the top of our list of things to implement, there were other pressing issues that seem to have bumped themselves to the top of our to-do list..  Needless to day backups are now at the top of the list again (implementing on and off site backups as I type this).

#2 removal of this infection is very simple, BUT that still leaves all your files encrypted.  As previously mentioned we DID pay the ransom, and now that e have almost a whole work day under our belt after doing so i have NO regrets.

Kenny Rogers said it best.....  You got to know when to hole em, know when to fold em....  In this case folding was the smartest move i could have made.... especially after people are reporting that after the timer expires their files are still encrypted...  

This isn't just a virus/malware....  this is encryption.  This wasn't a threat to lock our files, the files were already locked..  It was a pure shot in the dark whether or not paying the ransom would work, but the fact is that it did.  Honestly, if i was an evil genius like the author of this virus obviously is, i would have been more ruthless and either charged more, or just taken the cash and not decrypt the files..  The fact that payment actually unlocked the files was a shock, and honestly a welcomed wake-up call...

It was a $100 learning lesson...

Aside from trying to decrypt the files, i think there needs to be some SERIOUS attention brought to the fact that this infection seems to have affected systems running TrendMicro WFBS..   the ONLY client pc on our network still running TrendMicro WFBS is the one who got infected and thus encrypted all the shared network drives.

I spent 4 hour on the char support with TrendMicro, and finally i gave up on them and just paid the ransom...  Now, i wish i would have just paid it sooner.

My advice:

If you have backups, then just format the infected PC and restore your files.  No need to pay the ransom.

If you don't have backups but don't care about your data or have lots of time to POSSIBLY decrypt some of your files (highly unlikely if they are infact using the type of encryption they state they were) then backup your files, format your pc and work on the decrypting process..

and lastly,

If you don't have proper backups, pay the ransom, let it decrypt the files, Make a proper backup, then format the infected PC.  Make sure you scan all the backed-up files for viruses (although still not sure what if any AV out there is detecting this.)

It's $100.  what is your data and time worth?  

I've NEVER paid ransomware before, but this being the first time, it's a wakeup call, and an eyeopener to a whole new kind of threat.

On a related note, since a lot of us are seeing that TrendMicro is a common thread in this, any recommendations on a different AV?  Personally I am going with MS Security Essentials until a final decision is made.