Cryptolocker Solotion

[kudoscurd]

Hi,

Here is ransomeware Cryptolocker

I can not see my data - Pics mainly which are more dear to me than any other data..

I have attached the file. It looks like that on my desktop.

Kindly suggest solution.

Regards,

Kudoscurd

[Aura]

Hi kudoscurd,

Can you upload one of your encrypted file on ID-Ransomware, and copy/paste the results of the analysis here after?

https://id-ransomware.malwarehunterteam.com/

[xXToffeeXx]

You've been hit by PClock. It's not decryptable, so if you have backups I suggest restoring from them.

xXToffeeXx~

[kudoscurd]

27 minutes ago, Aura said:

Hi kudoscurd,

Can you upload one of your encrypted file on ID-Ransomware, and copy/paste the results of the analysis here after?

https://id-ransomware.malwarehunterteam.com/

Hi Aura,

I tried to upload encrypted file.

but it shows -----

 

 Unable to determine ransomware.

Please make sure you are uploading a ransom note and encrypted sample file from the same infection.

This can happen if this is a new ransomware, or one that cannot be currently identified automatically.

You may post a new topic in the Ransomware Tech Support and Help forums on BleepingComputer for further assistance and analysis.

Please reference this case SHA1: 17bb271ecbaf53b361dd7c2643959bf153ee31bb

 

[kudoscurd]

9 minutes ago, xXToffeeXx said:

You've been hit by PClock. It's not decryptable, so if you have backups I suggest restoring from them.

xXToffeeXx~

Hi,

I have no backups for it. I want my pictures back. They are around 30 GB and precious for me as part of memory.

Kindly suggest solution, if any.

Best Regards,

Kudoscurd

[Aura]

Sadly as Toffee mentionned, PClock is currently not decryptable for free. What you should do right now is back up all your encrypted files and hope that a free decryption solution arise in the future. You can also try to recover your files using data recovery software such as Recuva, PhotoRec, ShadowExplorer, EaseUS Data Recovery Wizard, etc. but that's pretty much the only thing you can do.

[kudoscurd]

Thanks Aura for your quick reply.

I hope something (solution) comes-up soon for the same.

[Aura]

No problem, and thanks to Toffee as well for the quick ID

And we all hope that as well!

[kudoscurd]

On 12/23/2016 at 9:47 PM, Aura said:

Sadly as Toffee mentionned, PClock is currently not decryptable for free. What you should do right now is back up all your encrypted files and hope that a free decryption solution arise in the future. You can also try to recover your files using data recovery software such as Recuva, PhotoRec, ShadowExplorer, EaseUS Data Recovery Wizard, etc. but that's pretty much the only thing you can do.

Hi Aura,

Please see attachment of ransomeware Cryptolocker.

I have been told that there is no solution for this. However, I feel, 

I need to ask few questions - 

1. Can I get solution for such kind of ransomewares after 2 years or 4 years?

I can wait for that much of time. But I just want to know that there are such cases in past that - solution was created for such issues after some time. 

If solution is not possible, then kindly explain me some technical issue in short.

2. what happens after time passes beyond deadline (now 23 hours are left)? Do these guy have access to my computer data all times? can they delete my data by instructing that program?

3. Shall i take that data into another computer or Hard Disc and wait for solution , maybe 4 years or 8 years?

4. Do I have to format my Laptop and reinstall windows  8.1 again?

5. I have only Pics to get de-crypted. I dont need other data at all. SO MY WHOLE FOCUS IS ON "JPG" files. Can these files be De-Crypted in short time in future? i feel that this file format is simple, therefore i am asking.

 

Thanks a lot for answers.

 

Regards,

Kudoscurd

20161226_184241.pdf

[kudoscurd]

On 12/23/2016 at 9:30 PM, xXToffeeXx said:

You've been hit by PClock. It's not decryptable, so if you have backups I suggest restoring from them.

xXToffeeXx~

Hi Toffee,

Please see attachment of ransomeware Cryptolocker.

I have been told that there is no solution for this. However, I feel, 

I need to ask few questions - 

1. Can I get solution for such kind of ransomewares after 2 years or 4 years?

I can wait for that much of time. But I just want to know that there are such cases in past that - solution was created for such issues after some time. 

If solution is not possible, then kindly explain me some technical issue in short.

2. what happens after time passes beyond deadline (now 23 hours are left)? Do these guy have access to my computer data all times? can they delete my data by instructing that program?

3. Shall i take that data into another computer or Hard Disc and wait for solution , maybe 4 years or 8 years?

4. Do I have to format my Laptop and reinstall windows  8.1 again?

5. I have only Pics to get de-crypted. I dont need other data at all. SO MY WHOLE FOCUS IS ON "JPG" files. Can these files be De-Crypted in short time in future? i feel that this file format is simple, therefore i am asking.

 

Thanks a lot for answers.

 

Regards,

Kudoscurd

20161226_184241.pdf

20161226_184241.pdf

[Aura]

Quote

1. Can I get solution for such kind of ransomewares after 2 years or 4 years?

I can wait for that much of time. But I just want to know that there are such cases in past that - solution was created for such issues after some time. 

It's impossible to predict/guess what will happen. There were cases were decryption keys were found/released a long time after the Ransomware was first spotted, but it doesn't always happen.

Quote

2. what happens after time passes beyond deadline (now 23 hours are left)? Do these guy have access to my computer data all times? can they delete my data by instructing that program?

They say that  the private key will be destroyed, but past experiences shows that it's just a tactic to scare the user and make you pay the ransom as fast as possible. Usually the private key is kept on their server and you can still pay the ransom any time after that.

Quote

3. Shall i take that data into another computer or Hard Disc and wait for solution , maybe 4 years or 8 years?

Yes, that's what you should do. You should back up your data somewhere else (on a USB Flash Drive, external HDD or another HDD) and hope that a solution to decrypt these files for free gets released one day (though there's no guarantee that it'll ever happen).

Quote

4. Do I have to format my Laptop and reinstall windows  8.1 again?

You don't have to format your laptop and reinstall Windows 8.1. Ransomware usually don't encrypt system files, so your Windows install isn't affected by it, you can keep using it. The only thing you have to remove are the ransom notes.

Quote

5. I have only Pics to get de-crypted. I dont need other data at all. SO MY WHOLE FOCUS IS ON "JPG" files. Can these files be De-Crypted in short time in future? i feel that this file format is simple, therefore i am asking.

The answer for this is the same as the answer to your 1st question.

[Ried]

Judging by the name of the ransomware notes placed on the desktop, I'm not so sure this is PClock.

@kudoscurd  Please run this next scanner so I can get more clues about exactly which one this is. This next scanner will not make any changes to your machine on its own, nor will it divulge any personal information that may compromise your security.

  Please download Farbar Recovery Scan Tool from here http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ and save it to your desktop.

Note: You need to run the version compatible with your system

  **After you click the Download Now 64-bit, or the Download Now 32-bit, another page will open -- DO NOT CLICK ANY ADDITIONAL 'download now' buttons, just wait and look toward the bottom of your browser for the option to Run or Save. Click Save.

•Double-click to run it. When the tool opens click Yes to the disclaimer.

Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.

•Click the Scan button.

•When the scan has finished, it will make produce 2 logs in the same directory the tool was run from. Please attach the following logs to your next reply:

FRST.txt

Addition.txt.

[exile360]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!