Cryptolocker Virus Removal And Decrypt .encrypted Files Solutions

Discussion in 'Software Remove' started by securityhope, Aug 17, 2016.

  1. securityhope

    securityhope Administrator Staff Member

    Joined:
    Aug 3, 2016
    Messages:
    1,241
    Likes Received:
    0
    Trophy Points:
    36
    What is Crypt0L0cker Ransomware?

    Crypt0L0cker (or TorrentLocker) is a ransomware infection that infiltrates computers using infected email message attachments (message topics often include: “package tracking”, ”speeding tickets”, “unpaid invoice”, etc.) Note that cyber criminals localise these spam email messages to make them appear legitimate. For example, computer users located in the United Kingdom receive fake email messages claiming to be package tracking messages from Royal Mail, PC users from Australia receive messages from Australia Post, etc. After successful infiltration, this malware encrypts files on victims' computers and demands ransom payments of 2.2 Bitcoin to decrypt them. Crypt0l0cker ransomware (some newer variants use the name CryptoLocker) encrypts all files found on victims' computers except the following: .html, .inf, .manifest, .chm, .ini, .tmp, .log, .url, .lnk, .cmd, .bat, .scr, .msi, .sys, .dll, .exe, .avi, .wav, .mp3, .gif, .ico, .png, .bmp, and .txt (files needed for normal Windows operation).

    Successfully encrypted files receive a .encrypted prefix in dedicated folders containing encrypted files. Crypt0l0cker provides DECRYTP_INSTRUCTIONS.html and DECRYPT_INSTRUCTIONS.txt files with instructions on how to pay the ransom. This ransomware is targeted at computer users from Australia, Austria, Canada, Czech Republic, Italy, Ireland, France, Germany, Netherlands, Korea, Thailand, New Zealand, Spain, Turkey, and the United Kingdom. This is an updated variant of malware previously known as TorrentLocker. Cyber criminals responsible for creating Crypt0l0cker ransomware use TOR network to collect ransom payments from victims. TOR network ensures that criminals' identities and locations remain anonymous.

    Ransomware infections such as Crypt0L0cker (including CryptoWall, TeslaCrypt, and CTB-Locker) present a strong case to maintain regular backups of your stored data. Note that paying the ransom as demanded by this ransomware is equivalent to sending your money to cyber criminals - you will support their malicious business model and there is no guarantee that your files will ever be decrypted. To avoid computer infection with ransomware infections such as this, express caution when opening email messages - cyber criminals use various catchy titles to trick PC users into opening infected email attachments. At time of writing, no tools were available to decrypt files affected by Crypt0locker malware without paying the ransom.

    How Crypt0L0cker infected your PC

    Crypt0L0cker infiltrates computers using fake phishing e-mails from post service. To make it look more “real” hackers send e-mails from Royal Mail in United Kingdom or Australia Post in Australia. Those e-mails contain malicious attachments with archived documents. This documents have built-in macros, that will download core executable file of the virus. Hackers use TOR network and Bitcoin payments to prevent possibility of tracking and anonymity. In order to prevent infection with this type of threats we recommend you to use SpyHunter and HitmanPro with Cryptoguard.

    Paying the demanded amount of money will restore your access to your files, won’t it?

    As you already know, you are facing the worst of the worst when it comes to cyber threats. You cannot expect to be treated fairly by the hackers, who have created .Enc File Encryption (Crypt0l0cker Virus). Really, what reasons can you possibly have to trust them? They have infected your machine with two horrible versions of malware and now all they want is your money. It is possible that they might take your money, without unlocking your encrypted data. It is also possible that the cyber criminals will be willing to recover your control over your files. What to do is totally up to you.

    Known Crypt0L0cker Scareware Files:

    C:\ProgramData\iwymyzucasakodon\
    C:\ProgramData\iwymyzucasakodon\00000000
    C:\ProgramData\iwymyzucasakodon\01000000
    C:\ProgramData\iwymyzucasakodon\02000000
    C:\ProgramData\iwymyzucasakodon\03000000
    C:\ProgramData\iwymyzucasakodon\04000000
    C:\ProgramData\iwymyzucasakodon\05000000
    C:\ProgramData\iwymyzucasakodon\06000000
    %StartMenu%\Programs\Startup\system.pif
    %WinDir%\<random>.exe

    Known Crypt0L0cker Scareware Registry keys:

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<random> "C:\Windows\<random>.exe"

    Cryptolocker Virus Removal Instructions / Cryptolocker Removal Tool

    Remove Cryptolocker Virus STEP 1: Start Your Computer into Safe Mode with Networking
    • Make sure you do not have any floppy disks, CDs, and DVDs inserted in your computer
    • Restart the computer
    • When you see a table, start tapping the F8 key every second until you enter the Advanced Boot Options
    • in the Advanced Boot Options screen, use the arrow keys to highlight Safe Mode with Networking , and then press ENTER.
    • Once the operating system loads press simultaneously the Windows Logo Button and the R key.
    • A dialog box should open. Type iexplore
    • Internet Explorer will open and a professional scanner will prompt to be downloaded
    • Run the installer
    • Follow the instruction and use the professional malware removal tool to detect the files of the virus.
    • After performing a full scan you will be asked to register the software. You can do that or perform a manual removal.
    Remove Crypt0L0cker Manually
    • Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
    • Locate the process of teslacrypt. Have in mind that this is usually a random generated file.
    • Before you kill the process, type the name on a text document for later reference.
    • Open your Windows Registry Editor and navigate to: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winxdd
    • delete the key.
    • Navigate to your %appdata% folder and delete the executable.
    • You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might change, that’s why you run the professional scanner to identify the files.
    Recover the encrypted by Crypt0L0cker files

    Use the built in feature of Windows called System Restore. By default the system restore feature is automatically turned on. Windows creates shadow copy snapshots that contain older copies since the system restore was performed. These snapshots will let us to recover any previous version of your file, although it will not be the latest one, still you can recover some important information. Please note, that Shadow Volume Copies are only available with Windows XP SP2, Vista, Windows 7 and Windows 8.

    It is always a good idea to use a reputable anti-malware program after manual removal, to prevent this from happening again.

     

Share This Page

Share