Real Computer Guru HELP wanted!

[TopCatGr58]

Hey folks,

I'm almost afraid/ashamed to post this, but I'm desparate so here it is. It's a bit lengthy and will be for the more advanced computer guys on here.

Well, I've gotten hit by a variant of the Cryptolocker type virus! But it hasn't given me the full screen warning message about being infected and such. But ALL of my picture(JPG) files, MPG files, PDF, Doc, and a few other types have gotten encrypted, they now have the *filetype.enc.rtf suffixes. Only when I try to open or view a file, it only opens up in Wordpad and tells me about the file encryptions, and instructions about what to do to get them un-encrypted....ie. unzip a zipped file, and then turn off my A-V and firewall, have internet access, and run the *.exe file that was in the ZIP archive, and it's supposed to THEN instruct me about where to send a RANSOM/payment using Ukash, Safepaycard, or such that is used in Europe.

This nasty bastard has also denied my ability to access and run the Task Manager, or Regedit. I WAS running a proper A-V program, but was stupid in downloading and unzipping a file that had *.scr type files....I thought they were ScreenSaver type files....and I just tried using the "TEST" feature....not actually installing them.....but apparently they were SCRIPT type files instead!


I've read that the type of encryption that these virii use are like 1024 or 2048 bit which are essentially infeasable to try to crack!? I found a simple originally *.rtf file I had made that had been changed/encrypted, and I changed it's filename to *.txt to open it in notepad, and aside from the RTF encryption warning message, the rest of the body of the file is truly ENCRYPTED, can't make out any of it!!!

I hadn't done a recent backup of my photos and such for a while, so I'm rather pissed both at myself as well as this friggin virus/trojan!

I felt I had nothing else to loose since ALL of my photos were already encrypted both on my main C drive as well as my extra D drive....a total of over 3000 files. I had first run an AVG recovery disc and it flagged all of them, but I didn't proceed with deletion. I then tried the above instructions...BUT nothing else happened, no window opened with any type of instructions about where and how much RANSOM I would have to pay??? SO....I'm wondering if this was an ORPHAN trojan, and that perhaps interpol or such had already found and shut down the culprits and their SERVER that is normally used/accessed by the unzipped *.exe file, and so that's why I can't get any instructions, but this also means that I won't be able to get a Decyption KEY code???

ANY THOUGHTS, suggestions as to how I might be able to decrypt the files.....or just kiss them goodbye, and CLEAN the computer/Registry.....I should be able to run a CD-rom based AV boot program to remove the virus. Regrettably, this is an older computer still running WinXP SP3....has IDE drive as well as SATA, but the latest AVG recovery/rescue disc can NOT find the Main System drive/files?? An older AVG Recovery disc from over a year ago CAN see it, but the Registry editor program on that one is TEXT based, the newer one has a GUI, but it can't see my C: IDE drive!?!?

Anyone know of a boot CD with a GUI type registry editor on it???

From my LAPTOP, not my infected DESKTOP! T.C.

[Bigfoot]

Yeah, that one really sucks. About your only hope is to remove the infection and hope that system restore works or that you can restore from a previous version. Take a look at this,

http://www.wintips.org/how-to-remove...re-your-files/

Good luck

[Jerry]

Don't know if the will help:

HOW TO REMOVE CRYPTOLOCKER?
In most of the cases, users can restore connection to their files by using System Restore or by running a full system scan with any of these applications: STOPzilla, SpyHunter, Malwarebytes Anti Malware. For bypassing system's block, you can follow these steps:

Reboot you infected PC to 'Safe mode with command prompt' to disable virus (this should be working with all versions of this threat)
Run Regedit
Search for WinLogon Entries and write down all the files that are not explorer.exe or blank. Replace them with explorer.exe.
Search the registry for these files you have written down and delete the registry keys referencing the files.
Reboot and run a full system scan with updated anti-spyware.
However, if this fails to work for you, there is a huge possibility that you won't be capable to recover your files...

Link to full article is http://www.2-spyware.com/remove-cryptolocker.html

Have not had to deal with this yet but have been running Malware Anti Malware (MBAM) on corporate PCs for several years and so far no reports of CryptoLocker on our 40+ laptops or 90+ desktops. Also run ESET Node32 at the corporate level, PCs and Macs. No one programs is going to cover everything and the paid-for stuff is generally better than free stuff, although many of my corporate Windows boxes are also running Microsoft Security Essentials. i would not rely on that program, though, as a primary defense.

Sorry you got whacked. Post your response when it is all done and let us know if you came across any really good tips!

[ViperRon]

malwarebytes.org Safe mode networking mode this is a tool to find and remove dependant on how bad or what version.

[SFerinTEXAS]

HitManPro saved my lunch . 30 day free trial version. Will buy it if gremlins jump me again.
http://http://www.bleepingcomputer.c...oad/hitmanpro/

I like to download to an unaffected computer and transfer with a flash drive in Safe Mode.

Also have used malwarebytes with good success but it didn't fix what HitManpro did

[SFerinTEXAS]

Bad link. Try it now .

http://www.bleepingcomputer.com/download/hitmanpro/

[TopCatGr58]

Again, thanks for your help, info, and links. What's surprising is that I never was shown a cryptolocker type screen, just a message WITHIN each encrypted file that they had been encrypted. Well, I certainly wasn't going to pay any ranson that would be $300 or more!! Oh well, learn a lesson and move on. I've since been able to remove the infection with a variety of boot discs...AVG, AVAST, and then Safe Mode programs..Roguekiller, and then Spybot, and then I was able to access my registry to ensure the boot/run keys were clean.

I've also gone ahead and deleted ALL of the encrypted files! What's interesting is that the files that were affected on mine were a bit different than what has been listed/attributed to the Cyrptolocker or CPTL ver2 virus. Here they are:

DOC, RTF, but not TXT;

XLS, PPT, but not PPS;

JPG, PNG, but not BMP or GIF or TIF;

AVI, MPG, WMV, but not MP4 or MOV or MP2, or VOB;

PDF, ZIP.

The encrypted files were these file names/types with *.enc.rtf added.

There may be other types, but I didn't have/use them....like Open Office Docs.

Some of the recent photos I had and lost I have copies that were sent to family. Others were loaded to Facebook and PhotoBucket. So...hopefully the total damage will be less than first expected. You can bet I'll be doing more frequent backups routinely from now on.

Jerry, This web site seems to have the most info with regards to other programs you can use to change some of the settings in Windows to help prevent the programs from running and doing the encryption. That is until the virus authors change things.

http://www.bleepingcomputer.com/viru...re-information

T.C.

[SFerinTEXAS]

That is some NASTY.

[ViperRon]

This is a nasty virus but there are other varients of it the one I got last year Norton worked with it for several hours and said the only way to get rid of all of it was to reinstall windows. The version I had locked up even in safe mode when ever it hit the internet. The only way to fight threw it was use a bootable CD operating system disk. These days there is no one antivirus program to catch all. I am glad you recovered the system me I was lucky enough to have backed everything up.

[Slimbob]

Hey TC,
Just wondering if you had current Anti Virus or Anti Malware SW installed when the virus hit?

If so whose was it? Norton,.........

How did you first notice the virus? Keep us posted.

Thanks and good luck,
Slimbob

[skippy344]

FWIW, Handyrecovery

TC,

I have had success with using a product, that I downloaded and bought, called "Handy Recovery." The author is Russian, but I trust him anyway! LOL Because I am Ukrainian!!

http://www.google.com/url?sa=t&rct=j...65636070,d.b2U

It can go back as many a 4 formats and recover files. Tech support is good, but they are 12 hours ahead, or so.

You might be able to "undo" the encryption with this utility.

Good luck!

[TopCatGr58]

Hey Slim/Skippy,

I was running current (PAID..for my desktop, free on my laptops) version of Avast, also running Spybot S&D ver 2.# . What I didn't realize was that Spybot S&D Ver. 2# (free) doesn't provide realtime active protection!
Their earlier version 1.6#(still available) has active REGISTRY changes protection! I've since removed 2.# and reinstalled 1.6#.

I also only have Windows Firewall! Years ago I used to use ZoneAlarm, but it later conflicted with Avast, and so I removed it opting for A-V/spyware protection vs. the fancy firewall. I may look into getting an actual firewall program again...I also later had Comodo, but it also didn't play well with my A-V program. What I liked about a real firewall program is that once you have it set up and it creates the whitelist of programs that can have permission to access the "NET", any other program that tries will be blocked! Window's firewall doesn't do that!

It was also a bit my fault, as I stated I had downloaded some "Human Anatomy" files that were in a ZIP file. I have Windows set to show the full filenames and extensions, and I know not to download or run *.exe type files. After I extracted the files from the ZIP, they were *.scr ....and I thought that they might have been ScreenSaver type files? I didn't install them, just rightclicked to PREVIEW them. But that was probably what set them LOOSE because they were most likely SCRIPT files...which are essentially program files, and because they were a fairly new variant of the Black Ice Encryptor trojan, Avast didn't recognize or stop it!

And since Spybot wasn't active protecting, it was able to make changes to my REGISTRY without me knowing or giving permission.

One of the suggestions I was given was to get a different DNS server, this way the trojan that needs to find it's server to get the encryption code, and the different DNS server would prevent it from being able to access/find it's server!

As for the recovery program, that's more for being able to UNDELETE files. Windows deletion process is fairly simple in that it just changes the begining file flags that says the storage space is open, but it doesn't actually erase/re-write over the file contents, so these programs can find the file remnants, reset the flags and viola, you get your file back. THIS BASTARD program REWROTE the contents of the files running it thru an encryption program which scrambles the data into undiscernible giberish! But thanks for the idea.

T.C.

[TopCatGr58]

Ps

Well, I just dug into my Avast Internet Security Suite(Paid) version, and it DOES have a Firewall section. AND it can control access to the internet....however... when I installed the suite, it DEFAULTED to automatically decide internet access for new programs! And reviewing the Log files, of course I found the suspect *.exe file that was given full internet access AUTOMATICALLY ! I have now changed the settings to ASK when a new program requests to access the NET!! Okay, another LAYER of control set!

T.C.