How do I decrypt the files?

[SirDarknight]

So, this is the situation with my friend's PC. He called me over today to help him solve this. He couldn't specify exactly when or how this ransomware infected his PC.

Now, he did reinstall Windows after the infection(but no change whatsoever). I did some googling and found out that a particular website provided free service of file decryption regarding this ransomware but ''they've stopped the service'' now.

I installed Kaspersky on his PC, did a few scans & things. It caught some Trojans, viruses and successfully disinfected the PC.

But, how can I get those encrypted files back?

 

[kanewolf]

You can't, probably. You pay the ransom and MAYBE get them back or you restore from backups .... which somebody with ransomware, viruses and trojans won't have.

Tell him/her that they need to be more careful in the future.

 

[esco_sid]

If they are encrypted there really is no way of getting them back it seems you will have to reinstall windows again if you still get viruses use this tool to completely erase the HDD as it will erase sectors where malware could be hiding http/www.dban.org/

 

[ZippyPeanut]

Yeah, as kanewolf says, you probably can't. But consider trying Kaspersky's decryption tools at https/noransom.kaspersky.com/. The one that looks like it might possibly work is the RakhniDecryptor tool.

CryptoLocker is bad news. In the future, be sure to have a weekly/monthly backup system in place in which all data gets backed up onto an external drive. I use Macrium Reflect. I cloned all my drives onto a 6TB external drive and (re)clone those drives about once every two months. It's important that the only time the external drive is connected to you PC is when you are backing up or cloning. At all other times it should be air gapped; otherwise it could become infected.