asked on

Cryptolocker Virus attack

Hi

A friend's computer has the cryptolocker virus and a message that files have been encrypted. 72 hours to pay €300 to get the files decrypted.

There is NO backup of the files.

What is the best course of action? Is paying the money a possiblily?

Thanks for any help and advice,

Thomas

Giovanni

See http://blog.malwarebytes.org/intelligence/2013/10/cryptolocker-ransomware-what-you-need-to-know/

and

http://www.bleepingcomputer.com/forums/t/506924/cryptolocker-hijack-program/page-26#entry3165383

It's possible some files may be recovered via system recovery or shadow copies.

To protect your friend in the future, see my post here.

aadih

I am sorry. Your friend is out of luck. :-(

Thomas Zucker-Scharff

Thrre have been a number of similar questions regarding cryptolocker. Search in experts exchange and you will find a few links to decrypters.

Whatever you do, don't let anyone pay b by credit card.

ASKER CERTIFIED SOLUTION

Giovanni

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

tamakiwo

Decrypters do not work, at least not in this case. Paying the ransom may help, at least some users reported that after the payment activation decryption began and files were recovered. However, paying the ransom does not guarantee the safe recovery of encrypted files, as stated here: Remove CryptoLocker virus and restore encrypted files

Your friend could try Shadow Explorer to recover some of the files but since they were not backed up I don't know if he still has this option.