Solved

optimal method deal ransomware in files folders

Posted on 2016-11-10
9
172 Views
Last Modified: 2016-11-14
Have a drive locked that the files are inaccessible.  Our tech indicated probable RW attack.  Please adive.  Thank you in advance.
0
Comment
Question by:rayluvs
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
9 Comments
 
LVL 14

Accepted Solution

by:
Phil Phillips earned 300 total points
ID: 41882782
Optimal method is to restore from a backup. Otherwise, you're looking at purging the ransomware from the system and then attempting to decrypt (not fun! and not guaranteed to get your data back). If you have to go that route, you could start here: https://noransom.kaspersky.com/
0
 

Author Comment

by:rayluvs
ID: 41883138
Understood.  Unfortunately, the user wasn't too backup-friendly.  Besides kaspersky, any other apps or procedures based on your experience you can recommend?
0
 

Author Comment

by:rayluvs
ID: 41883224
Question, how can one know if the files are really encrypted?
0
Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as the high-speed power of the cloud.

 
LVL 14

Expert Comment

by:Phil Phillips
ID: 41884089
Sometimes the files get renamed with a different extension (it depends on the ransomware). https://id-ransomware.malwarehunterteam.com/ might be able to help you analyze a file to get more information.

Though, it's entirely possible that ransomware isn't the cause at all.. what type of error are you getting when you try to access a file?
0
 

Author Comment

by:rayluvs
ID: 41884339
Hi, Thanx!

As far a we know, it's the Locky Ransomware variant extensions *.odin

Have you heard of it?  Any observation regarding this particular?
0
 
LVL 14

Assisted Solution

by:Phil Phillips
Phil Phillips earned 300 total points
ID: 41884348
The Odin variant is pretty new, and the encryption is pretty strong - RSA 2048-bit and AES 128-bit.  So, unfortunately there aren't any readily available decrypters out there :(.

Another good site where you can test files to see if there's a known good solution: https://www.nomoreransom.org

Though, again, I don't believe there's currently a readily available tool for Odin.. so you're sort of stuck at the moment unless you can locate a backup.
0
 

Author Comment

by:rayluvs
ID: 41884645
Thanx for the response.

Last question prior closing, the attack issued 2 html ('_4_HOWDO_text.html' & '_HOWDO_text.html').  One of tech sent the files to another who ask to see the contents.  Do those files contain the actual apps the encrypts everything? (we don't know and don't want others to get infect by trying to help us)
0
 
LVL 30

Assisted Solution

by:serialband
serialband earned 200 total points
ID: 41884761
It seems that there are odin decryptors.  Here's a link with removal and decryptor information.  Apparently, they allow you to decrypt one file for free and you can use that to get the keys to decrypt the rest.  Kapersky seems to have a tool.  https://www.bugsfighter.com/remove-odin-ransomware-and-decrypt-odin-files/
0
 
LVL 29

Expert Comment

by:Thomas Zucker-Scharff
ID: 41886250
Hope this was resolved to your satisfaction.  Recommendation for the future:  force backup adherence by using simmering like Druva insync. Insync acts much like MAC time machine, but remotely. Versioning is the key, and backup not connected directly to the machine (insync versioning is like having a swapped out local HDD that always backs up). Code42's Crashplan is a similar solution)
0

Featured Post

IoT Devices - Fast, Cheap or Secure…Pick Two

The IoT market is growing at a rapid pace and manufacturers are under pressure to quickly provide new products. Can you be sure that your devices do what they're supposed to do, while still being secure?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The conference as a whole was very interesting, although if one has to make a choice between this one and some others, you may want to check out the others.  This conference is aimed mainly at government agencies.  So it addresses the various compli…
Part One of the two-part Q&A series with MalwareTech.
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question