?
Solved

Virus / Malware that changes file extensions to .pdf.xdtorli or .*.xdtorli CryptoWall virus

Posted on 2014-12-11
7
Medium Priority
?
4,276 Views
Last Modified: 2014-12-11
I have a work station that where the "internet stopped working". When I check the work station I found many issues. I ran mbam, TDSSKiller, and ComboFix. I believe this removed the issues, but I now need to repair the damage. Question: Is there some else I should check to make sure malware / virus has been removed. Question: How should repair all the files that have been changed from #####.pdf.xdtorli, #####.xls.xdtorli, ....?
 I have the log file for scan if need. The rootkit found was Rootkit.Boot.Cidox.b

I started in the wrong place... original Q&A string.
http://www.experts-exchange.com/Community_Support/CleanUp/Q_28578918.html#a40494304
0
Comment
Question by:BrianDHoyt
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
7 Comments
 
LVL 34

Expert Comment

by:Michael-Best
ID: 40494345
Can you restore to a time before infection?
0
 

Author Comment

by:BrianDHoyt
ID: 40494354
yes I can now... I could not at first.
I'm running through this...
http://www.pcrisk.com/removal-guides/7844-cryptowall-virus#a2
0
 
LVL 29

Expert Comment

by:Thomas Zucker-Scharff
ID: 40494386
Be my guest and run through it, but to the best of my knowledge there is no "fix" for cryptowall and its' derivatives.  The only option is restoring from backup or a system restore.
0
Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

 

Author Comment

by:BrianDHoyt
ID: 40494410
well, that's pretty much what it says as well.
How about on networked drives? rename the fill is the issue I'm working on. Is that pretty much the same: Restore or Replace?
0
 
LVL 34

Accepted Solution

by:
Michael-Best earned 1500 total points
ID: 40494418
Your only solution is to restore to a time before infection.
Use a restore point or a backup.
0
 

Author Comment

by:BrianDHoyt
ID: 40494442
but that will not Un-encrypt the files. Correct?
0
 

Author Comment

by:BrianDHoyt
ID: 40494485
Okay for people who have to deal with this in the future.
1 Clean workstation.
2 Restore from system restore point
3 Restore file from "Restore previous version"
4 Search for encrypted file extension and delete
0

Featured Post

Ransomware Attacks Keeping You Up at Night?

Will your organization be ransomware's next victim?  The good news is that these attacks are predicable and therefore preventable. Learn more about how you can  stop a ransomware attacks before encryption takes place with our Ransomware Prevention Kit!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
What's worse than having your data encrypted by ransomware? Getting attacked by a so-called "wiper," which simply destroys the data and offers you no hope of ever seeing it again.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question