Expiring Today—Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Cryptovirus file retrieval

Posted on 2013-11-07
2
Medium Priority
?
534 Views
Last Modified: 2013-11-07
Hi guys,

I've just received a client's PC after they had a cryptovirus removed by another IT service company.

I don't know the name of the cryptovirus, but I'm sure I can find out.

The files are all encrypted but all remain in their original location.

Do you have suggestions of how to troubleshoot this without having to pay the 'ransomer', on the off chance that they may release the encryption codes (I wouldn't like to test this)?

Someone suggest data recover through a data recovery agent, but that doesn't sound right - that data's there and the file sizes look about right, they're just encrypted.

Look forward to hearing your thoughts on a way forward.
0
Comment
Question by:Servant-Leggie
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 15

Accepted Solution

by:
Skyler Kincaid earned 2000 total points
ID: 39632631
We have had a few computers come in like this and your only option is restoring from backups. The virus uses 2048bit encryption with a unique key that is generated from some punks server.

Paying the ransomer may allow you to restore the files but typically even that option is limited by a deadline.

We have all our clients setup with SOS backup. We have been formatting the machines, restoring the files, installing the Cryptoblocker tool, installing a better antivirus and sending it back out. Here is the link to the prevention tool but we haven't done any testing with it:

http://www.foolishit.com/vb6-projects/cryptoprevent/
0
 

Author Comment

by:Servant-Leggie
ID: 39632703
Thanks, xKincaidx, your solution was pretty much what I was thinking, only I didn't know it was 2048bit encryption (although I did know that it was apparently 'uncrackable' and is apparently the use of impressive and legitimate encryption algorithms for illegitimate purposes).
0

Featured Post

Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

AutoHotkey is an excellent, free, open source programming/scripting language for Windows. It started out as a keyboard/mouse macros product, but has expanded into a robust language. This article provides an introduction to it, with links to addition…
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question