Ransomware Virus, How to remove and get my files back without paying?

Solution
Most ransomware encrypts the victim's files, and without the encryption key you can't decrypt them yourself. If you have anything valuable on there you can kiss it goodbye.

Mr Kagouris

Estimable
Sep 7, 2015
141
0
4,710
Most ransomware encrypts the victim's files, and without the encryption key you can't decrypt them yourself. If you have anything valuable on there you can kiss it goodbye.
 
Solution

martinch

Estimable
Mar 21, 2014
28
0
4,590

Anti-virus and security firms (Kaspersky et al) have made decryption applications available for Cryptxxx and TeslaCrypt (and others, e.g. Locky, I think), after finding coding errors in them. The best bet is to see if you can find out what family it comes from, and if there's a decryption tool for it. Otherwise, hope your backups exist and are OK (and obviously don't connect the backups to an infected device to check...).

 

Wayfall

Honorable
Dec 27, 2013
164
0
10,660


I'm just wondering what your mum did to even get this huge virus in the first place.

She needs to be more careful what sites she goes on, files downloaded and emails opened.
 

Mr Kagouris

Estimable
Sep 7, 2015
141
0
4,710
I'm just wondering what your mum did to even get this huge virus in the first place.

She needs to be more careful what sites she goes on, files downloaded and emails opened.

Had a friend that got such ransomware on his laptop from an infected flash drive. After wiping the drive and doing a clean install of Windows he goes to get his files from his PC, and lo and behold, he plugs in the same flash drive. Poof goes the backup.

It's easy for the technology-literate to avoid such things, but not everyone is like that.
 

guanyu210379

Distinguished
Hmmm....some AVs can really already decrypting some of those ransomware? cool! I did not know that.

@Wayfall:
I have to clean several systems already quite frequently for my sister, my old aunt and my old uncle. Thank goodness, no encrypting ransomware so far.

Viruses are attacking everywhere and the best antivirus is the user, not Kaspersky, not BitDefender, etc.
People, who are not really know their way around, will be more prone to viruses.
Careful? How? If they do not even know what is ok and what is not.
Even if you told them some things, they will forget it since they have not enough basic to really understand.
Trust me, I tried explaining already thousands of times.
 

Rabmac

Estimable
Nov 29, 2015
82
0
4,610
Number of issues here.

Issue 1 - Can I get my files back?
=====================
The answer to that is maybe but don't bank on it.

Step 1: Disconnect PC from internet immediately
Step 2: Try a system restore to a point before the PC got infected.
Step 3: See if you can access your files. (goto step 4 if you got them, step 5 if you didn't)
Step 4: Copy only the absolutely necessary files to an external device (be aware that it is possible that the infection can get on this device so make sure it does not have anything important, I recommend a cheap USB stick)
Step 5: Try an earlier restore point.

Issue 2: What do I do now?
=================
Step 1: If you used this PC for internet banking or online shopping contact your bank and credit card company and tell them you have been hacked and your data is at risk.
Step 2: Log onto a PC that is free from infection and change all your passwords. This is essential as it is likely the hacker knows all of this information now and your accounts are at risk.
Step 3: Do a full reinstall of Windows and install Avast, Zemana anti-logger, malwarebytes anti-exploit & unchecky. Now update Windows. This should give you a decent level of protection.
Step 4: Teach your mum about these threats and safe browsing. I advise that you give your mum a user account with no admin privileges and setup remote desktop so you can do things for her that require admin privileges.
Step 5: Scan with TDSS Killer to make sure the malware did not infect the master boot.


P.S. Can people stop calling this a virus (one of my pet hates). As someone already pointed out this is Ransomware which is completely different from a virus. You can also call it malicious software (malware) which is the generic term for all infections. If you call it malware you will never be wrong, it just means you have not defined what type of malware it is.
 

guanyu210379

Distinguished
Everything Malware, Adware, Trojan, Worm, Virus, Ransomware, etc. are all simply viruses for normal users.
It is a simple as that.
You can spend lots of efforts explaining the differences, which could take forever, or simply try to fix the problem.
 

Rabmac

Estimable
Nov 29, 2015
82
0
4,610
I'm afraid I have to disagree and think your understanding contains a common misconception.

All viruses are malware but not all malware are viruses.

I found this link which I thought would be helpful for you: http://www.dummies.com/how-to/content/know-the-different-types-of-malware.html


 

Wayfall

Honorable
Dec 27, 2013
164
0
10,660


Well I myself found this helpful.

Thanks
 

LukeFatwalker

Estimable
Dec 29, 2015
24
0
4,570
If you decide to pay the ransom (which I personally am against) then there's no way to know they didn't leave a stealth trojan for next time.

Best thing you can do is re-format the machine. Especially if you don't use a backup solution. I use a program called Rollback Rx and it's saved my arce from ransomware a few times. Once you reformat you'll want to install the program or alternatively use a disk imager. Either way, cut your loses and start backing up your data to prevent this situation from happening in the future.
 

CWEric

Estimable
Jun 13, 2015
170
0
4,710

I think he understands. He just means that normal average people virus is the common term for them and to just let them be as long everyone understand what they meant.