asked on

Yet another Ransome ware

client got the message below.

How can I be getting this issue with Sophos installed.

is there a fix for us

Cjoego

ATTENTION!

All your documents, photos, databases and other important personal files
were encrypted using strong RSA-1024 algorithm with a unique key.
To restore your files you have to pay 0.51076 BTC (bitcoins).
Please follow this manual:

1. Create Bitcoin wallet here:

https://blockchain.info/wallet/new

2. Buy 0.51076 BTC with cash, using search here:

https://localbitcoins.com/buy_bitcoins

3. Send 0.51076 BTC to this Bitcoin address:

1CRudcpAotySaypEw3WziApYuqYR6KXrjQ

4. Open one of the following links in your browser to download decryptor:

http://blender.com.br/counter/?a=1CRudcpAotySaypEw3WziApYuqYR6KXrjQ
http://www.haixiajinrong.com/counter/?a=1CRudcpAotySaypEw3WziApYuqYR6KXrjQ
http://sictindia.org/counter/?a=1CRudcpAotySaypEw3WziApYuqYR6KXrjQ
http://www.hotelfiordaliso.it/counter/?a=1CRudcpAotySaypEw3WziApYuqYR6KXrjQ
http://moevenpickchef.mydigitallapps.com/counter/?a=1CRudcpAotySaypEw3WziApYuqYR6KXrjQ

5. Run decryptor to restore your files.

PLEASE REMEMBER:

- If you do not pay in 3 days YOU LOOSE ALL YOUR FILES.
- Nobody can help you except us.
- It`s useless to reinstall Windows, update antivirus software, etc.
- Your files can be decrypted only after you make payment.
- You can find this manual on your desktop (DECRYPT.txt).

Ogandos

If the information is encrypted like the messages specify... if that is true... the solution is restore that data from a backup. It is not feasible to fight against such strong encryption if it has been aplied.

How can it happened if Sophos was installed? Maybe a user was surfing the web and accepted a malicious code somehow, or opened an email with something malicious on it. In conclusion it usually happens with some user interaction and 'approval' of the bad process. :(

Joseph Salazar

ASKER

Just Logged into the Computer and Sophos has been completely Grayed out....

I cannot even turn it on....

running NPE and malware bytes now

Joseph Salazar

ASKER

Found C:\users\Username\AppData\Local\Envtion\a2.exe

Ogandos

Maybe for making it even easier for the malware... it is possible that Sophos was not working at the moment of the encryption. Or maybe there was something that made Sophos stop working and then the second attack was conducted.

Just some ideas.

Ogandos

It is good to quite the ransome-ware before making anything else, indeed. :). To make it less likely that it happens again. However, in my case I would prefer to backup the remaining valuable data and then just blow up anything there and refresh that system from scratch.

SOLUTION

Lee W, MVP

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

rindi

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

btan

I suspect you are in the same situation as in this and the file encrypted should be having the extension .crypted added to the filename.
http://www.bleepingcomputer.com/forums/t/608358/ransomware-infection/

Suggest you identify the ransomware in idransomware or Crypto Sheriff, if the Ransomware identified to be with a decryptor that can bypass the encryption without payibg ransom, then you may like to give it a try.
https://id-ransomware.malwarehunterteam.com
https://www.nomoreransom.org/crypto-sheriff.php

Make a clone of the files before uploading and disconnect your machine as well as advice customer to change their password to online Web and social sites esp those using the same common password.

Augment your AV with anti ransomware with application whitelisting such as Windows Applocker or Cryptoprevent or SecureAPlus. There are anti ransomware program such as Winpatrol Winantiransom and MalwareBytes anti ransomware as preventive suggested as preventive measures for consideration.

Thomas Zucker-Scharff

I agree id-ransomware is an excellent way to go. Also check Nomoreransom.org.

Without backups you're pretty much up the creek. Definitely make a backup just in case a key becomes available.

Joseph Salazar

ASKER

Thanks Everyone, We ended up formatting and re-installing Desktop

We Deployed Sophos router and Sophos on the Desktop and will be getting the Intercept X, anti-Ransom ware module when it comes out soon.

Cjoego

ASKER CERTIFIED SOLUTION

Thomas Zucker-Scharff

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

btan

There is also CryptoTrap from TrapX forbsetting decoys to allow time for detection mechanism to alert users..
https://trapx.com/trapx-combats-ransomware-attacks-with-new-cryptotrap-tool/

Joseph Salazar

ASKER

Thanks