We help IT Professionals succeed at work.

Virus has locked my files on my laptop

AshfaqFiji
AshfaqFiji asked
on
My computer files are locked or cannot be opened. It has changed its extension to .xls.lunqwgl and the files cannot be opened even after i delete the extension. Please urgently help. Also i am attaching sample files.
Comment
Watch Question

System Engineer
Commented:
Hi,

you need to shutdown you computer, download something like ESET SysRescue Live  (http://www.eset.com/int/support/sysrescue/), boot pc with it and clean it..or some tool like it.

You have Cryptolocker or some other locker, most likely. There is no cure for locked files :|

If you have CBT-Locker, then there is no decrypting system for it. There is a site http://www.shadowexplorer.com/ that will allow you to see data created by Shadow Copy in Windows, if you have set that up. This may save you some data. Other then that, there is no known system.

For older Cryptolocker, there is a website https://www.decryptcryptolocker.com/  which may decrypt some data.

Good luck,
Most Valuable Expert 2015
Commented:
If you have already gotten the ransom note, it is too late and you will first have to clear the Virus, then restore your data from your backups.

If the ransom note hasn't yet been presented, first make sure you remove the virus (and disconnect the PC from the LAN). You may then still be able to right click the files and select a previous version, or you can search your PC for a temporary directory where the original files may have been copied to. But again, if you already received the note to pay the ransom, it is too late.

One further thing I suggest you do, is to get in touch with your local law enforcement authorities. They may want to check the PC before you clean it, so it might help them to trace the crooks. Also, whatever you do, never even consider paying the ransom.

Author

Commented:
Thanks, I have already cleaned the computer using Kaspersky Anti-Virus and the files are still locked. Can you look at the files and let me know if that can be de-crypted as all my files are locked.

Author

Commented:
I have already used the mentioned site but the site says that that file is not recognized or de-crypted.
Most Valuable Expert 2015

Commented:
You can't unlock them. Delete them and restore from your backups.

Author

Commented:
What is lunqwgl extension
It means your files are moat likely encrypted and it sounds like CTB Locker. Unless you have a backup (not attached to your computer)there is nothing much to do.  Once you clean the files they cannot even be decrypted by paying the ransom.

Author

Commented:
So basically nothing can be done to get my files back from the computer. I don't have any backup done for the files, which simply means I have lost the files and no recovery process on our Planet will work to get my files back ?
It isn't likely,  sorry.  Ransomware is very effective because most people don't have versionning backups.  In the future I suggest something along the lines of Crashplan  (I have the family plan which allows me to backup up to 10 services top the cloud service) work unlimited storage - my plan is currently 145/year but you can always look for deals.

Crashplan, Spideroak, comodo, and several others have be versionning, which allows you to go back as many versions as exist.  My setup backs up my files (changed files only) every 15 minutes.

Disclaimer: I am not in any way affiliated with any company mentioned here, just a happy, satisfied customer.

Author

Commented:
Thank you for the clarification and response.
No problem.  Sorry it isn't very helpful for the current situation.
Robert RComputer Service Technician

Commented:
Shadow explorer as previously mentioned can extract files from a shadow copy, but many of the cryptolocker viruses can either delete the shadow copies or encrypt them as well. So if the shadow explorer application is not able to extract some of your files, and you do not have a backup of your files else where then you are definitely out of luck, as there is no possible way to recover your files.