Solved

Crypto Locker

Posted on 2014-01-23
4
486 Views
Last Modified: 2014-04-07
We've successfully removed the crypto locker virus. We however have a clone of the drive infected before the removal. We would like to know if anyone has anyway to beat the encryption of the virus on the personal files? Any help would be greatly appreciated.

Thanks!
0
Comment
Question by:itneedshelp
  • 2
4 Comments
 
LVL 29

Expert Comment

by:Sudeep Sharma
ID: 39803666
Unfortunately there is no decrypting tool yet for crypto locker. Either you need to pay them to get the files or need to restore them from the backups.

If you don't have the backups you may try to get the original files from the Shadow Copies.

Please go through the link below for further information and how to get the files from Shadow Copies.

http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information

Sudeep
0
 
LVL 26

Expert Comment

by:Thomas Zucker-Scharff
ID: 39803835
Sudeep pretty much said it all.  Cryptolocker is nasty and the only options I have either used successfully or seen used successfully are:

1. Reimage/Reinstall the system completely

2. Restore system from Backup (before the infection)

3. Pay for the decryption key (so far they have been providing the key when you pay - but it seems they only accept bitcoin)

0
 
LVL 53

Expert Comment

by:McKnife
ID: 39806387
Hi.

Please describe what you are trying to achieve. I guess, you wonder if you can restore the files from the infected drive. Of course you can. That virus is no file-infector.
The only way to become infected from that drive is by executing the virus executable - this will not happen when you restore documents.
0
 
LVL 26

Accepted Solution

by:
Thomas Zucker-Scharff earned 500 total points
ID: 39806676
AFAIK, this is true BUT the files have been encrypted by cryptolocker and therefore are useless unless you have a backup previous to the infection.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
Encryption for Business Encryption (https://en.wikipedia.org/wiki/Encryption) ensures the safety of our data when sending emails. In most cases, to read an encrypted email you must enter a secret key that will enable you to decrypt the email. T…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now