Cyrptolocker ransomware has encrypted my clients files

[Twotone]

My client got a new ransomware called Cryptolocker today. It has encrypted most of his files on his mapped network drive. I don't want to run anything that would prevent me from getting these back. What would you guys suggest I do first?

 

Thanks in advance

[MrCharlie]

The complete encryption tutorial is here:

http://www.bleepingcomputer.com/forums/t/449398/new-ransomware-called-anti-child-porn-spam-protection-or-accdfisa/

Specific suggestions:

http://www.bleepingcomputer.com/forums/t/449398/new-ransomware-called-anti-child-porn-spam-protection-or-accdfisa/?p=3001838

http://www.bleepingcomputer.com/forums/t/449398/new-ransomware-called-anti-child-porn-spam-protection-or-accdfisa/?p=3054615

http://www.bleepingcomputer.com/forums/t/449398/new-ransomware-called-anti-child-porn-spam-protection-or-accdfisa/?p=3056441

MrC

[Twotone]

Thank you MrC. It seems like they're talking about a different variant though. I'll read through the posts and try some things.

[David H. Lipman]

This is a case of what is called cryptovirolgy and of the worst kind.  Actual personal data file encryption held for ransom by a malicious actor.

While a "virus" is possible with cryptovirolgy, more often than not the payload is that of a trojan and not a virus.

With the release of the Microsoft Crypto Application Programming Interface (aka; Crypto API) this concept was made much easier.

Decryption of data files is not an easy task.  Often a malware crypto analyst may work on a given problem for very long periods and not come up with a key for decryption.  Sometimes it is possible for a limited family of trojans but is short lived.  Often that work requires that particular trojan that was used to encrypt your data.

You need to understand that the expectation for a positive outcome is EXTREMELY low.  Even if you paid a security company it may be costly and still not have a positive outcome.

You should not even consider paying any ransom.  That can actually lead to you being the target of further malicious activity as you will branded a willing "mark".

I think the best course of action would be to consider the situation as a total loss as if your hard disk had a catastrophic failure requiring tou to obtain a hard disk replacement.

With that in mind, extract the data that has not been encrypted and wipe the hard disk and reinstall the OS of choice or by using a manufacturer's Recovery Disk.

** IF and only IF you have the actual malware that caused this please upload it at UploadMalware.Com

[Twotone]

Hey David

 

I would love to help out and I have not done anything with the computer as of yet. The malware and anything else that caused it should still be on the computer. Would you know the easiest way to find it? I Have teamviewer on my computer if you want to log into it. I am logged into the infected computer from here. Malwarebytes did pick some Trojans up but I just looked at the log. I did not clean them off yet.

 

 

This is a case of what is called cryptovirolgy and of the worst kind.  Actual personal data file encryption held for ransom by a malicious actor.

While a "virus" is possible with cryptovirolgy, more often than not the payload is that of a trojan and not a virus.

With the release of the Microsoft Crypto Application Programming Interface (aka; Crypto API) this concept was made much easier.

Decryption of data files is not an easy task.  Often a malware crypto analyst may work on a given problem for very long periods and not come up with a key for decryption.  Sometimes it is possible for a limited family of trojans but is short lived.  Often that work requires that particular trojan that was used to encrypt your data.

You need to understand that the expectation for a positive outcome is EXTREMELY low.  Even if you paid a security company it may be costly and still not have a positive outcome.

You should not even consider paying any ransom.  That can actually lead to you being the target of further malicious activity as you will branded a willing "mark".

I think the best course of action would be to consider the situation as a total loss as if your hard disk had a catastrophic failure requiring tou to obtain a hard disk replacement.

With that in mind, extract the data that has not been encrypted and wipe the hard disk and reinstall the OS of choice or by using a manufacturer's Recovery Disk.

** IF and only IF you have the actual malware that caused this please upload it at UploadMalware.Com

[David H. Lipman]

The only hope is to capture the trojan and reverse engineer the encryption.  This has been done with some crypto malware but not often enough.  Hopefully your client has data on backups.  That is the best course of action.
 
I don't even know of a good organization where the PC's hard disk can be taken to.

Kroll may be able to handle this but I have only worked with them on a basis of data recovery. 

[David H. Lipman]

I got the file from UploadMalware.Com.  Thank you.

 

It was submitted to Malwarebytes for detection and to the anti malware community to see if a decryption key is possible.

[AdvancedSetup]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.