Virus / Malware that changes file extensions to .pdf.xdtorli or .*.xdtorli CryptoWall virus

I have a work station that where the "internet stopped working". When I check the work station I found many issues. I ran mbam, TDSSKiller, and ComboFix. I believe this removed the issues, but I now need to repair the damage. Question: Is there some else I should check to make sure malware / virus has been removed. Question: How should repair all the files that have been changed from #####.pdf.xdtorli, #####.xls.xdtorli, ....?
 I have the log file for scan if need. The rootkit found was Rootkit.Boot.Cidox.b

I started in the wrong place... original Q&A string.
Who is Participating?
Michael-BestConnect With a Mentor Commented:
Your only solution is to restore to a time before infection.
Use a restore point or a backup.
Can you restore to a time before infection?
BrianDHoytAuthor Commented:
yes I can now... I could not at first.
I'm running through this...
SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

Thomas Zucker-ScharffSystems AnalystCommented:
Be my guest and run through it, but to the best of my knowledge there is no "fix" for cryptowall and its' derivatives.  The only option is restoring from backup or a system restore.
BrianDHoytAuthor Commented:
well, that's pretty much what it says as well.
How about on networked drives? rename the fill is the issue I'm working on. Is that pretty much the same: Restore or Replace?
BrianDHoytAuthor Commented:
but that will not Un-encrypt the files. Correct?
BrianDHoytAuthor Commented:
Okay for people who have to deal with this in the future.
1 Clean workstation.
2 Restore from system restore point
3 Restore file from "Restore previous version"
4 Search for encrypted file extension and delete
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.