CryptoLocker Ransomware

[Joe C]

This is a very nasty one, if you get hit with this encryption type of ransomware your screwed from getting any data back
https://www.us-cert.gov/ncas/alerts/TA13-309A
CryptoLocker ransomware – see how it works, learn about prevention, cleanup and recovery | Naked Security

 

[carnageX]

Yep, quite a few of those. I remember a couple years back the first big one hit with like 2048-bit encryption lol.

 

[Joe C]

I remember a while back when some of the ransomware first came out that the warning did state your files are locked, but they really were not and you could clean up the system with combofix or one of those programs and everything went back to normal. This is supposed to be a new one that actually does encrypt your personal files with RSA 2048 encryption, the key is on the criminals server and without it....your personal stuff is useless

 

[carnageX]

I remember a while back when some of the ransomware first came out that the warning did state your files are locked, but they really were not and you could clean up the system with combofix or one of those programs and everything went back to normal. This is supposed to be a new one that actually does encrypt your personal files with RSA 2048 encryption, the key is on the criminals server and without it....your personal stuff is useless

Yeah, that's the one I heard about. Not a new idea at all though because like I said, I heard of this a couple years ago; probably just a new strain going around.

 

[luke127]

Problem is with encryption the data then becomes very hard to recover. I myself use a 768 bit encryption key on my hard drive and even then it's hard so imagine would 2048 would be like....

 

[carnageX]

Problem is with encryption the data then becomes very hard to recover. I myself use a 768 bit encryption key on my hard drive and even then it's hard so imagine would 2048 would be like....

That's the whole point of the malware... It becomes impossible to crack, and the only way to recover the data is with the encryption key.

 

[Lexluethar]

Do we know if combofix will fix this new one?

 

[Yevrag35]

Do we know if combofix will fix this new one?

From what I've seen, it's not too difficult to remove. The real problem is that it *actually* encrypts your data, which no anti-virus can undo.

 

[luke127]

I mean you could always attempt to get the key from where ever it's stored using some rather unorthodox methods.....

 

[carnageX]

I mean you could always attempt to get the key from where ever it's stored using some rather unorthodox methods.....

The key is stored on the person's computer that infected you in the first place. The only way they give it to you is if you pay the ransom (even then, there's been reports of them not giving you the key).