+- Sinisterly (https://sinister.li)
+-- Forum: Computers (https://sinister.li/Forum-Computers)
+--- Forum: Antivirus & Protection (https://sinister.li/Forum-Antivirus-Protection)
+--- Thread: Help im infected (locker v 4.94 ransomware) (/Thread-Help-im-infected-locker-v-4-94-ransomware)
Help im infected (locker v 4.94 ransomware) - loading... - 05-25-2015
I was just infected by something called "Locker v4.94" that has encrypted some of my files. It shows a list of the encrypted files and none of them are important (actually they're all useless lululululul) and it gave me a 70 hour time limit to pay them or it will "delete the encryption key off their server leaving my files encrypted forever". Good for them.
Anyway i'm just worried it might encrypt more or somehow get more malware installed and was wondering if anyone has had this before and how exactly they got rid of it? I'm running a virus scan as we speak but it is only windows defender. I have Malwarebytes but whenever I run a scan with it, my computer freezes up and I get a "security option dialog" things that has nothing to do with the malware as its always happened.
Anyway it shows a screen with every startup with the time limit and some details and I want to get rid of it and the software itself. Any help appreciated thanks!
And dont just tell me to run a virus scan....
RE: Help im infected (locker v 4.94 ransomware) - Reiko - 05-25-2015
To remove this, you'll have to wait for your malware defs to update, or learn how Windows works in depth and remove it manually.
Even if you did run a virus scan, it won't decrypt your files.
These types of malware are the equivalent of "GO AHEAD CALL THE COPS THEY CANT UNRAPE YOU"
Should've kept a backup.
RE: Help im infected (locker v 4.94 ransomware) - mothered - 05-25-2015
Given you've said most of your files aren't Important, simply hit a clean Installation of Windows and be done with It. Be sure to delete all existing partitions and Install on the unallocated space.
By the time you perform scans, analyze log files, apply removal methodologies etc, you'll be up and running with a clean Install "days" prior.
RE: Help im infected (locker v 4.94 ransomware) - Oni - 05-25-2015
(05-25-2015, 01:20 PM)Reiko Wrote: To remove this, you'll have to wait for your malware defs to update, or learn how Windows works in depth and remove it manually.
Even if you did run a virus scan, it won't decrypt your files.
These types of malware are the equivalent of "GO AHEAD CALL THE COPS THEY CANT UNRAPE YOU"
Should've kept a backup.
Pretty much this. A clean install is probably your best option, @loading....
RE: Help im infected (locker v 4.94 ransomware) - ねこまっしぐら - 05-25-2015
Did you, by any chance, get this by downloading any GTA: V mods?
RE: Help im infected (locker v 4.94 ransomware) - roger_smith - 05-25-2015
As @Reiko pointed out, you're basically SOL on the files that were encrypted. You can check out Kaspersky's database and see if you're lucky enough to have a decryption key available https://noransom.kaspersky.com/
Otherwise, if you don't have anything important on the machine, scrub the drive and start fresh.
RE: Help im infected (locker v 4.94 ransomware) - Hyper_ - 05-27-2015
Try decrypting them by reversing the program to get the stored keys, it is obviously communicating with a different server that stores them, or restore your system.
Shouldn't have downloaded that random program without running it sandboxed or anaylizing it, learn from your mistakes.
RE: Help im infected (locker v 4.94 ransomware) - Reiko - 05-28-2015
(05-27-2015, 10:09 PM)Hyper_ Wrote: Try decrypting them by reversing the program to get the stored keys, it is obviously communicating with a different server that stores them, or restore your system.
Shouldn't have downloaded that random program without running it sandboxed or anaylizing it, learn from your mistakes.
This is why RSA was invented. You cannot break RSA without solving a pretty difficult math problem. You'd make more money by solving it than you would by breaking everybody's RSA keys.
I would be amazed if any cryptolocker-style malware was dumb enough to use symmetric crypto.
RE: Help im infected (locker v 4.94 ransomware) - Ultimatum - 05-28-2015
(05-28-2015, 02:01 PM)Reiko Wrote: This is why RSA was invented. You cannot break RSA without solving a pretty difficult math problem. You'd make more money by solving it than you would by breaking everybody's RSA keys.
I would be amazed if any cryptolocker-style malware was dumb enough to use symmetric crypto.
Yes, that's what I thought too. However, there are quite a few "newbie" ones, which use encryption, such as RSA, but fail to store keys appropriately (or make some stupid mistake).
OP's cryptolocker seems like some cheap knock-off (I think they ask for like $25), which MAY make things recoverable, but that would depend analysing the malware itself, and how it generates/stores keys. If it was CryptoWall though, gg.
RE: Help im infected (locker v 4.94 ransomware) - Hyper_ - 05-28-2015
(05-28-2015, 02:01 PM)Reiko Wrote: This is why RSA was invented. You cannot break RSA without solving a pretty difficult math problem. You'd make more money by solving it than you would by breaking everybody's RSA keys.
I would be amazed if any cryptolocker-style malware was dumb enough to use symmetric crypto.
Maybe if it is one-time pad. RSA has already been cracked.
http://www.extremetech.com/extreme/173108-researchers-crack-the-worlds-toughest-encryption-by-listening-to-the-tiny-sounds-made-by-your-computers-cpu