Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

ransomware - Unable to open encrypted files

Posted on 2013-01-25
6
Medium Priority
?
1,460 Views
Last Modified: 2013-11-22
The manager has a virus on an external hd

It’s basically locked all his office files and changed the name to locked.filename.doc.random4letters

 
I need to get these documents back so he can open the file. The virus is one where if you have the virus and try and open the locked document you get a police popup saying ‘pay some money and open then’ I don’t know exactly, as the virus was on the laptop he had, which he no longer has, he just had the external hd with the locked files.

 

Anyway I found Kaspersky have a bit of software that can unlock these encrypted files, but you need one original file and he doesn’t have any originals.

 

http://support.kaspersky.com/us/viruses/solutions?qid=208286527

Does anybody have any ideas , I've attatched a screenshot showing the new file extensions attatched to the document.
locked-.bmp
0
Comment
Question by:phitusers
  • 3
  • 2
6 Comments
 
LVL 33

Expert Comment

by:Dave Howe
ID: 38818325
Sadly, you need the original - what happened to the infected laptop? usually least some of the easily recovered standard files are encrypted (eg from the MS Office dir) and the same key will work for both.
0
 

Author Comment

by:phitusers
ID: 38818339
The user had an issue with a laptop. These files were then transfered across and I believe the laptop has been rebuilt since, Which obviously means I have no access to the original files.

Thanks
0
 
LVL 33

Expert Comment

by:Dave Howe
ID: 38818388
I think you are going to have to resort to searching the external for "locked.*" then and hope there is at least one other file with the issue.

Decryption without a sample would be very difficult indeed - see the analysis here

http://malware.lu/Pro/RAP001_malware_rannoh_matsnu_1.1.pdf

for what is actually going on with these files.
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
LVL 14

Expert Comment

by:BlueCompute
ID: 38818521
Do you mean that the files were copied to external drive when they had already been encrypted, and you then blew away the original OS and data?

As DaveHowe says, you need to find an encrypted file with known unencrypted content, eg normal.dotx to run the Kaspersky tool.
0
 

Author Comment

by:phitusers
ID: 38818699
Yes that is correct, Is there any other workaround if we don't have an unencrypted original?
0
 
LVL 33

Accepted Solution

by:
Dave Howe earned 1500 total points
ID: 38818763
Possibly, but it would be a great deal of work. You would need to cut custom code to reverse-engineer the RC4 key from the encrypted docx files you have, using the fact that the DOCX files are by necessity actually zipfiles containing xml files, and hence have a known structure (they start with the letters PK and contain the default filenames - for example [Content_Types].xml, word/document.xml and word/fontTable.xml - which are stored in plain text in zip format)

Google doesn't show me anyone else having attempted this, so you would be on your own.
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Petya-like ransomware attack served a big blow to hundreds of banks, corporations and government offices The Acronis blog takes a closer look at this damaging worm to see what’s behind it – and offers up tips on how you can safeguard your…
This article covers the basics of data encryption, what it is, how it works, and why it's important. If you've ever wondered what goes on when you "encrypt" data, you can look here to build a good foundation for your personal learning.
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
Suggested Courses

571 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question