Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Cryptovirus file retrieval

Posted on 2013-11-07
2
Medium Priority
?
537 Views
Last Modified: 2013-11-07
Hi guys,

I've just received a client's PC after they had a cryptovirus removed by another IT service company.

I don't know the name of the cryptovirus, but I'm sure I can find out.

The files are all encrypted but all remain in their original location.

Do you have suggestions of how to troubleshoot this without having to pay the 'ransomer', on the off chance that they may release the encryption codes (I wouldn't like to test this)?

Someone suggest data recover through a data recovery agent, but that doesn't sound right - that data's there and the file sizes look about right, they're just encrypted.

Look forward to hearing your thoughts on a way forward.
0
Comment
Question by:Servant-Leggie
2 Comments
 
LVL 15

Accepted Solution

by:
Skyler Kincaid earned 2000 total points
ID: 39632631
We have had a few computers come in like this and your only option is restoring from backups. The virus uses 2048bit encryption with a unique key that is generated from some punks server.

Paying the ransomer may allow you to restore the files but typically even that option is limited by a deadline.

We have all our clients setup with SOS backup. We have been formatting the machines, restoring the files, installing the Cryptoblocker tool, installing a better antivirus and sending it back out. Here is the link to the prevention tool but we haven't done any testing with it:

http://www.foolishit.com/vb6-projects/cryptoprevent/
0
 

Author Comment

by:Servant-Leggie
ID: 39632703
Thanks, xKincaidx, your solution was pretty much what I was thinking, only I didn't know it was 2048bit encryption (although I did know that it was apparently 'uncrackable' and is apparently the use of impressive and legitimate encryption algorithms for illegitimate purposes).
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

With the recent demise of Windows XP support, you may be a new convert to Windows 7 or Windows 8. Or perhaps you've been on W7 or W8 for a while, but just recently acquired your first scanner for the new OS. In either case, you are likely to be very…
The default behavior of the User Account Control (UAC) dialog is to disable (gray-out) the rest of the desktop when prompting for elevation. This is known as secure desktop. There are reasons that you may want to disable this secure desktop behavior…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
The goal of this Micro Tutorial is to help navigate beginning users with the app store on Windows 8. It will explain exciting features how to maximize your PC through these apps. This will be demonstrated using Windows 8 operating system.

971 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question