Fisiere criptate de catre virus

[Vizitator user_andrei]

Salut

 

Am reusit sa infectez laptopul cu un virus din gama Criptolocker din ce am vazut pe internet. Majoritatea fisierelor cu extensii mai importante au fost criptate si le-a fost adaugata extensia .crypt (fisier.exe.crypt; fisier.rar.crypt; fisier.jpeg.crypt etc). La incercarea de deschidere a fisierelor apar mesaje cum ca acestea sunt fie in format necunoscut fie corupte. 

 

Am incercat cu Malwarebites si Hitman pro, insa nu am fost foarte atent. Probabil virusul in sine a fost sters insa au ramas fisierele criptate. 

 

Vazand ca inca nu se deschid am formatat Windows fara sa ma gandesc intai sa incerc o restabilire de sistem. Dupa ce am formatat, vazand ca tot nu se deschid am sters cu optiunea Multi rename tool din Total Commander, extensia .crypt de la fiecare fisier. Nici asa nu se deschid.

 

In fiecare folder au fost create cate 3 fisiere numite de_cript_readme in format bitmap, HTML si text.

 

Stie careva vreo solutie la tipul asta de virus? Exista vreun mod de decriptare a fisierelor?

 

 

Aici e continutul HTML:

 

NOT YOUR LANGUAGE? USE https://translate.google.com

What happened to your files?

All of your files were protected by a strong encryption with RSA4096

More information about the encryption keys using RSA4096 can be found here: https://en.wikipedia.org/wiki/RSA_(cryptosystem)

How did this happen?

!!! Specially for your PC was generated personal RSA4096 Key , both public and private.

!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.

!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server

What do I do ?

So , there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment

Your personal id 20045A6C5DBD

For more specific instructions, please visit your personal home page,

there are a few different addresses pointing to your page below:

http://  avm2ypcvtxfxu2ib.onion.to

http://  avm2ypcvtxfxu2ib.onion.cab

http://  avm2ypcvtxfxu2ib.onion.city

If for some reasons the addresses are not available, follow these steps:

Download and install tor-browser: https://torproject.org/projects/torbrowser.html.en

Video instruction:

After a successful installation, run the browser

Type in the address bar: http://  avm2ypcvtxfxu2ib.onion

Follow the instructions on the site.

 

 

 

 

Si prima pagina pentru alte instructiuni:

 

Your files are encrypted.

You did not pay in time for decryption, that`s why the decryption price increases 2 times. At the moment, the cost of 

decrypting your files is 1008 USD. In case of failure to 26/05/16 your key will be deleted permanently and it will 

be impossible to decrypt your files.

Your system: Windows 7  |  First connect IP: 109.--.--.--

Payment Decrypt soft help FAQ

We present a special software - Google Decrypter - which allows to decrypt and return control to all your encrypted files. 

How to buy Google decrypter?

1. You can make a payment with BitCoins, there are many methods to get them.

 

 

 

2. You should register BitCoin wallet (simplest online wallet OR some other methods of creating wallet)

 

3. Purchasing Bitcoins - Although it`s not yet easy to buy bitcoins, it`s getting simpler every day.

 

Here are our recommendations:

btcdirect.eu - Good service for Europe.

bittylicious.com - Get BTC with Visa/MC or SEPA(EU) Bank transfer.

localbitcoins.com - Service allows you to search for people in your community willing to sell bitcoins to you directly(WU, Cash, SEPA, Paypal and many others).

cex.io - Buy Bitcoins with Visa/Mastercard or Wire Transfer.

coincafe.com - Recommended for fast, simple service. Payment Methods: Western Union, Bank of America, Cash by FedEx, Moneygram, Money Order.

bitstamp.net - Old and trusted Bitcoin dealer.

btc-e.com - BTC dealer, Visa/Mastercard and etc.

Couldn't find BTC in your location? Try searching these directories:

buybitcoinworldwide.com - An international directory of bitcoin exchanges.

bitcoin-net.com - One more BTC dealer directory.

howtobuybitcoins.info - An international directory of bitcoin exchanges.

bittybot.co/eu/ - EU countries directory.

 

4. Send  

2.4

 BTC to Bitcoin address:  

1JF7htKdtTtmddALiZxLRTrsaz8r9JwEf4

 

5. Enter the Transaction ID and chose payment option:

 

    Clear 

 Note: Transaction ID - you can find in detailed info about transaction you made. 

(example 44214efca56ef039386ddb929c40bf34f19a27c42f07f5cf3e2aa08114c4d1f2)

 

6. Please check the payment information and click button "PAY".

 

PAY

Your sent drafts

Num Draft type Draft number or transaction ID Amount Status

Your payments not found.

0 valid drafts are put, the total amount of 0.0 BTC.

 

[FLORIN IORDACHE]

O chestie asemanatoare am avut-o si eu acum ceva timp.....Dati un click aici  :http://www.elforum.info/topic/113692-cum-pot-scapa-de-acest-virus-filecodercryptowallf-troian/

O seara minunata va doresc !!!  Mult,mult succes va doresc !!!

Editat Mai 23, 2016 de FLORIN IORDACHE

[belasajgo]

Din cate imi pot da seama din textul de mai sus, mi se pare ca este vorba de ransomware-ul CryptXXX. Pentru acest ransomware exista utilitar de decriptare functional, se numeste RannohDecryptor.

In cazul in care utilitarul de decriptare nu reuseste sa calculeze automat cheia de decriptare, atunci trebuie sa ii pui la dispozitie macar un fisier din cele criptate si in varianta necriptata (sa recuperezi de undeva originalul - o copie salvata pe o memorie externa sau pe alt calculator), de unde utilitarul sa poata calcula cheia de decriptare. Fisierul original necriptat ce ii dai pentru calcularea cheii de decriptare ar fi bine sa fie una din cele mai mari fisiere care sunt criptate, deoarece utilitarul nu va putea decripta fisiere mai mari decat cel ce a folosit pentru calcularea cheii de decriptare. In orice caz va fi nevoie sa refaci extensia .crypt la fisierele criptate.

[Dell vostro]

Gasesti aici de la Kaspersky:

https://noransom.kaspersky.com/

[validae]

Faceţi-vă copii (back-up) pentru fişierele importante şi nu ţineţi totul pe un singur suport fizic. Astfel, puteţi reinstala sistemul formatând partiţiile infestate fără probleme. Iar cei ce se ocupă cu măgării din astea ar trebui executaţi în public, ca în China....

[Vizitator user_andrei]

Am reusit sa decriptez fisierele cu metoda aratata de voi. Am intrat pe https://noransom.kaspersky.com/, cum a indicat Dell-vostro si am descarcat programul numit rannohdecryptor.exe. 

 

Apoi am  facut ce a zis belasajgo, am incarcat in program un video de vreun giga, in varianta criptata si originalul. Bineinteles a trebuit sa refac extensia .crypt la toate fisierele pentru ca altfel nu le vedea.

 

Va multumesc tuturor pentru sfaturi si solutii.

[Dell vostro]

Bravo!Nu uita un lucru foarte important:Backup extern.