.encrypt Virus

[Kalani]

Hey guys,

I've been working at a computer store and a lot of people have been coming in with .encrypt ransom ware. Anyone got any ideas on how to get rid of it? I've done the usual virus check/removal, boot time scan etc.

 

[carnageX]

You need to find out specifically which variant of ransomware it is - there's different techniques for different versions. Some can be easily fixed, others...you're SOL unless you have a backup (usually a good idea to check Shadow Copies).

 

[Kalani]

It's a thing called "CryptoVirus" we tried rolling back the PC and it didn't work. So I'm assuming just a reinstall.

 

[carnageX]

Are you sure that's the name?

Variants include (but not limited to): VaultCrypt, TeslaCrypt, CTB-Locker, CryptoWall, KEYHolder, CryptoLocker, Petya, etc.

Rolling back won't work - the files are encrypted. You need to find out which variant it is so that you can try to decrypt the files if possible (as well as remove the malware in the first place).

 

[Kalani]

Just ask him, It's CryptoLocker

 

[carnageX]

CryptoLocker Ransomware Information Guide and FAQ

 

[1etherer]

CryptoLocker Ransomware Information Guide and FAQ

They shutdown the sites awhile ago that you could get the decrypt key from (annoying)... until they raid more premises that house the decrypt servers wont be any way around it.

If you have a backup, just reinstall and restore, there is NO OTHER WAY to fix this or remove it, only a decrypt key would work.

 

[carnageX]

I'm sure if you do some Googling, you can still find a copy of the database somewhere. Remember, once you put something on the internet, it'll never truly be able to be taken off .

Sent from my HTC One

 

[Access2000]

How you find out what type of virus it is?
I got hit but one but only infected one driver on my server which i thought it was kind of weird. I deleted the whole drive and i just used a back up from a day before. But I have still haven't find out where it did originate from. anyone have any thought?

 

[carnageX]

Usually they come from fake email attachments.