Solved

optimal method deal ransomware in files folders

Posted on 2016-11-10
9
161 Views
Last Modified: 2016-11-14
Have a drive locked that the files are inaccessible.  Our tech indicated probable RW attack.  Please adive.  Thank you in advance.
0
Comment
Question by:rayluvs
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
9 Comments
 
LVL 14

Accepted Solution

by:
Phil Phillips earned 300 total points
ID: 41882782
Optimal method is to restore from a backup. Otherwise, you're looking at purging the ransomware from the system and then attempting to decrypt (not fun! and not guaranteed to get your data back). If you have to go that route, you could start here: https://noransom.kaspersky.com/
0
 

Author Comment

by:rayluvs
ID: 41883138
Understood.  Unfortunately, the user wasn't too backup-friendly.  Besides kaspersky, any other apps or procedures based on your experience you can recommend?
0
 

Author Comment

by:rayluvs
ID: 41883224
Question, how can one know if the files are really encrypted?
0
RoboForm Secure Password Management System

RoboForm Everywhere - Superb Browser Support
Windows / Apple / IOS / Android / Linux / Chrome OS
Use different complex passwords everywhere
Best Secure Password Management by far
Synchronize all of your devices instantly
Safe, Secure & Highly Recommended!

 
LVL 14

Expert Comment

by:Phil Phillips
ID: 41884089
Sometimes the files get renamed with a different extension (it depends on the ransomware). https://id-ransomware.malwarehunterteam.com/ might be able to help you analyze a file to get more information.

Though, it's entirely possible that ransomware isn't the cause at all.. what type of error are you getting when you try to access a file?
0
 

Author Comment

by:rayluvs
ID: 41884339
Hi, Thanx!

As far a we know, it's the Locky Ransomware variant extensions *.odin

Have you heard of it?  Any observation regarding this particular?
0
 
LVL 14

Assisted Solution

by:Phil Phillips
Phil Phillips earned 300 total points
ID: 41884348
The Odin variant is pretty new, and the encryption is pretty strong - RSA 2048-bit and AES 128-bit.  So, unfortunately there aren't any readily available decrypters out there :(.

Another good site where you can test files to see if there's a known good solution: https://www.nomoreransom.org

Though, again, I don't believe there's currently a readily available tool for Odin.. so you're sort of stuck at the moment unless you can locate a backup.
0
 

Author Comment

by:rayluvs
ID: 41884645
Thanx for the response.

Last question prior closing, the attack issued 2 html ('_4_HOWDO_text.html' & '_HOWDO_text.html').  One of tech sent the files to another who ask to see the contents.  Do those files contain the actual apps the encrypts everything? (we don't know and don't want others to get infect by trying to help us)
0
 
LVL 29

Assisted Solution

by:serialband
serialband earned 200 total points
ID: 41884761
It seems that there are odin decryptors.  Here's a link with removal and decryptor information.  Apparently, they allow you to decrypt one file for free and you can use that to get the keys to decrypt the rest.  Kapersky seems to have a tool.  https://www.bugsfighter.com/remove-odin-ransomware-and-decrypt-odin-files/
0
 
LVL 26

Expert Comment

by:Thomas Zucker-Scharff
ID: 41886250
Hope this was resolved to your satisfaction.  Recommendation for the future:  force backup adherence by using simmering like Druva insync. Insync acts much like MAC time machine, but remotely. Versioning is the key, and backup not connected directly to the machine (insync versioning is like having a swapped out local HDD that always backs up). Code42's Crashplan is a similar solution)
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question