cancel
Showing results for 
Search instead for 
Did you mean: 
racey23
Level 7
Report Inappropriate Content
Message 1 of 22

How can I decrypt files after CryptoLocker virus

I have a computer infected with CryptoLocker Virus which has encrypted all the files. The user had the backup drive attached when the virus was activated so the backups are encrypted too.

I have uploaded a filename.doc.encrypted file to..a website..but it returns Invalid file The file does not seem to be infected by CryptoLocker.

The computer does not show any previous versions of files so the volume shadow copy seems to have been deleted even though there are restore points listed.

I do have an original file and an encrypted file as I read that you could upload both to a site which could decipher the encryption from both states but I can't locate this site.

Can anybody help me with this?

Link removed by Moderator as possibly unsafe

21 Replies
avinash34
Level 12
Report Inappropriate Content
Message 2 of 22

Re: How can I decrypt files after CryptoLocker virus

Reliable Contributor exbrit
Reliable Contributor
Report Inappropriate Content
Message 3 of 22

Re: How can I decrypt files after CryptoLocker virus

Yes, you should be able to retrieve your files

Reliable Contributor catdaddy
Reliable Contributor
Report Inappropriate Content
Message 4 of 22

Re: How can I decrypt files after CryptoLocker virus

Thanks Ex_ Brit....Bookmarked it.  Hope I never need it !

Cliff
McAfee Volunteer
Reliable Contributor exbrit
Reliable Contributor
Report Inappropriate Content
Message 5 of 22

Re: How can I decrypt files after CryptoLocker virus

Let's hope not 😉

Reliable Contributor tao
Reliable Contributor
Report Inappropriate Content
Message 6 of 22

Re: How can I decrypt files after CryptoLocker virus

Decryption Tool does not work for CryptoWall

If this information was helpful or has answered your question, please select Accept as Solution. This will assist other memebers
Reliable Contributor catdaddy
Reliable Contributor
Report Inappropriate Content
Message 7 of 22

Re: How can I decrypt files after CryptoLocker virus

The OP mentioned his/her machine was infected with (Cryptolocker). Cryptowall is a descendant of Cryptolocker, if you will. Altogether a different "Ransomware".  I posted an article on this months ago.

Here is a rather lengthy Guide in regards to (Cryptowall) : CryptoWall and DECRYPT_INSTRUCTION Ransomware Information Guide and FAQ

Cliff
McAfee Volunteer
Highlighted

Re: How can I decrypt files after CryptoLocker virus

I've seen this several times with CryptoLocker and CryptoWall (different variances).  You need a backup of your files.  Restore them from a previous point and use a command that will delete all infected files from the root.

Reliable Contributor tao
Reliable Contributor
Report Inappropriate Content
Message 9 of 22

Re: How can I decrypt files after CryptoLocker virus

Posted on 9/29/14: Digitally signed cert made it an ad popup drive-by.


Virustoal Detection was on 10/7/14

https://www.virustotal.com/en/file/048321a1ea3a7c04a3dceac523ccfd7f61561049535f7d4c3776a3a9d1fa3510/...

The following doc is really good; especially the rule about "**\decrypt_Instruction.*" & "**.*encrypted"

If this information was helpful or has answered your question, please select Accept as Solution. This will assist other memebers

Re: How can I decrypt files after CryptoLocker virus

It seems that the infection is a new variant of TorrentLocker which is a copycat and posing as CryptoLocker.


Before 11th September this infection was using an easy to decrypt XOR encryption method.
The tool to decrypt this variant is found here: http://www.bleepingcomputer.com/forums/t/547708/torrentlocker-ransomware-cracked-and-decrypter-has-b...


Unfortunately, some researchers decided to publicly blog about this encryption method, which caused the malware developer to change the encryption to a much stronger and unbreakable decryption using AES. Due to this change, Nathan Scott's TorrentLocker decrypter no longer works on this infection.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community