+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] CryptoLocker 3.0 (/showthread.php?tid=4750709)
Pages: Pages
1
2
CryptoLocker 3.0 - Phil - Mar 28, 2015
Hey guys,
So my dad's company has been Crypto'd (it has many important files related to the business) and I was wondering If Is there any way to get it back? I did my own research, tried programs and websites but nothing seems to work.
![[Image: aV6txFl.png]](https://i.imgur.com/aV6txFl.png)
Any of you have an idea of how I could get it back? I even tried System Restore, but it is still there.
Thanks.
* - obviouslyracist - Mar 28, 2015
CryptoLocker 3.0 doesn't have a fix.
The only way to get the files is to pay the ransom.
Sorry. :(
* - Phil - Mar 28, 2015
(Mar 28, 2015 02:55 AM)obviouslyracist Wrote: CryptoLocker 3.0 doesn't have a fix.
The only way to get the files is to pay the ransom.
Sorry. :(
Damn that is a pain. I wish someone did make a fix for it 😕
* - 5chn4pp - Mar 28, 2015
have you tryed going into safemode and do something there?
* - archangel.dmitry - Mar 28, 2015
(Mar 28, 2015 04:11 AM)One Virus( ͡° ͜ʖ ͡°) Wrote: have you tryed going into safemode and do something there?
If it is CrytoLocker 3.0, safe mode is useless. The only way to fight CL 3.0 is to have backups.
* - 5chn4pp - Mar 28, 2015
(Mar 28, 2015 07:51 AM)archangel.dmitry Wrote: If it is CrytoLocker 3.0, safe mode is useless. The only way to fight CL 3.0 is to have backups.
ok, thats good to know, how spread is it?
* - Phil - Mar 28, 2015
(Mar 28, 2015 08:04 AM)One Virus( ͡° ͜ʖ ͡°) Wrote: ok, thats good to know, how spread is it?
Pretty spread, 603 files encrypted 😕
* - 5chn4pp - Mar 28, 2015
(Mar 28, 2015 11:27 AM)DehPhil Wrote: Pretty spread, 603 files encrypted 😕
oh, i meant how many computers had it? also, 600 files is nothing.
* - Anti~Malware - Mar 28, 2015
1) If your computer has been infected by CryptoLocker, disconnect from your wireless or wired network right away to prevent further file encryption.
2) Decide if you want to pay the ransom and have files decrypted or try to restore the files yourself.
3) If you choose to pay the ransom, do it BEFORE removing the virus. Once the ransom is paid, your files will all become decrypted over the course of 3-4 days.
* - Davy - Mar 28, 2015
Dang, it sucks for you man, but I have to admit, thats pretty original.
* - Phil - Mar 28, 2015
(Mar 28, 2015 11:32 AM)One Virus( ͡° ͜ʖ ͡°) Wrote: oh, i meant how many computers had it? also, 600 files is nothing.
Yeah 600 files is nothing but its the files I require most.
* - Knautschtabak - Apr 1, 2015
You can try to recover files from shadow copies. But that's pretty much it.
See:
Quote:To restore the previous version of a file using the traditional Windows interface, just right-click the file in question and choose Properties. If System Restore is enabled or your administrator has enabled Shadow Copies through Group Policy, you should be able to see the Previous Versions tab in the Properties window. This will list all of the versions on record of the file. Choose a version before the Cryptolocker infection and then click either Copy to export a copy of the file somewhere else, or Restore to pop the backup right where the encrypted file belongs. You can open the files directly from this box too if you are not sure of the exact date and time of infection.
Quote:1) If your computer has been infected by CryptoLocker, disconnect from your wireless or wired network right away to prevent further file encryption.
Cryptolocker does not need the internet to encrypt files. So why should this prevent encryption?
* - Pharmacist - Apr 1, 2015
(Apr 1, 2015 12:19 PM)Knautschtabak Wrote: You can try to recover files from shadow copies. But that's pretty much it.
See:
Cryptolocker does not need the internet to encrypt files. So why should this prevent encryption?
CL deletes shadow copies.
Its really an amazing work of art, if only they had used that skill for something other than this..
* - Knautschtabak - Apr 1, 2015
(Apr 1, 2015 12:21 PM)Humiliated Wrote: CL deletes shadow copies.
Its really an amazing work of art, if only they had used that skill for something other than this..
Woah, so they thought of everything.
* - Pharmacist - Apr 1, 2015
(Apr 1, 2015 12:45 PM)Knautschtabak Wrote: Woah, so they thought of everything.
Yup.
I've never actually seen this 3.0 version.
But it doesn't seem that it would be extremely hard to create, mostly, all they had to do is know the basics of cryptology, and execute cmd commands. And that's it!