[Phil]

Hey guys,

So my dad's company has been Crypto'd (it has many important files related to the business) and I was wondering If Is there any way to get it back? I did my own research, tried programs and websites but nothing seems to work.



Any of you have an idea of how I could get it back? I even tried System Restore, but it is still there.

Thanks.

[obviouslyracist]

CryptoLocker 3.0 doesn't have a fix.
The only way to get the files is to pay the ransom.
Sorry. :(

[Phil]

CryptoLocker 3.0 doesn't have a fix.
The only way to get the files is to pay the ransom.
Sorry. :(

Damn that is a pain. I wish someone did make a fix for it 😕

[5chn4pp]

have you tryed going into safemode and do something there?

[archangel.dmitry]

have you tryed going into safemode and do something there?

If it is CrytoLocker 3.0, safe mode is useless. The only way to fight CL 3.0 is to have backups.

[5chn4pp]

If it is CrytoLocker 3.0, safe mode is useless. The only way to fight CL 3.0 is to have backups.

ok, thats good to know, how spread is it?

[Phil]

ok, thats good to know, how spread is it?

Pretty spread, 603 files encrypted 😕

[5chn4pp]

Pretty spread, 603 files encrypted 😕

oh, i meant how many computers had it? also, 600 files is nothing.

[Anti~Malware]

1) If your computer has been infected by CryptoLocker, disconnect from your wireless or wired network right away to prevent further file encryption.

2) Decide if you want to pay the ransom and have files decrypted or try to restore the files yourself.

3) If you choose to pay the ransom, do it BEFORE removing the virus. Once the ransom is paid, your files will all become decrypted over the course of 3-4 days.

[Davy]

Dang, it sucks for you man, but I have to admit, thats pretty original.

[Phil]

oh, i meant how many computers had it? also, 600 files is nothing.

Yeah 600 files is nothing but its the files I require most.

[Knautschtabak]

You can try to recover files from shadow copies. But that's pretty much it.

See:

To restore the previous version of a file using the traditional Windows interface, just right-click the file in question and choose Properties. If System Restore is enabled or your administrator has enabled Shadow Copies through Group Policy, you should be able to see the Previous Versions tab in the Properties window. This will list all of the versions on record of the file. Choose a version before the Cryptolocker infection and then click either Copy to export a copy of the file somewhere else, or Restore to pop the backup right where the encrypted file belongs. You can open the files directly from this box too if you are not sure of the exact date and time of infection.

1) If your computer has been infected by CryptoLocker, disconnect from your wireless or wired network right away to prevent further file encryption.

Cryptolocker does not need the internet to encrypt files. So why should this prevent encryption?

[Pharmacist]

You can try to recover files from shadow copies. But that's pretty much it.

See:

Cryptolocker does not need the internet to encrypt files. So why should this prevent encryption?

CL deletes shadow copies.
Its really an amazing work of art, if only they had used that skill for something other than this..

[Knautschtabak]

CL deletes shadow copies.
Its really an amazing work of art, if only they had used that skill for something other than this..

Woah, so they thought of everything.

[Pharmacist]

Woah, so they thought of everything.

Yup.
I've never actually seen this 3.0 version.
But it doesn't seem that it would be extremely hard to create, mostly, all they had to do is know the basics of cryptology, and execute cmd commands. And that's it!