CryptoWall 3.0 Decryption Possible?

[flynempire]

A customer of mine, his son has a PC which got infected with this damn malware. I know there was a version 1 and 2 and that decryption keys where then made available after some time.

This version is fairly new so I dont know if those keys are out yet. This really sucks you know..

If anyone can pass along some info on this I would appreciate it.

[+Warwagon MVC]

As far as I know,  it's ACTUALLY using good encryption. I heard you have one of 4 options with this one

 

1) Loose all your files

2) Restore from a backup (that was not connected to your machine at the time of infection)

3) MAYBE restore from volume shadow copies

4) Pay them.

[Zinomian]

actually, didnt even think either key had been made available.   I thought a site had been setup that would decrypt individual files for ver1, but that was all i thought it was possible.

 

sorry i am not more helpful.

As far as I know, they fixed it now were it's ACTUALLY using good encryption. I heard you have one of 4 options with this one

 

1) Loose all your files  Correct

2) Restore from a backup Correct

3) MAYBE restore from volume shadow copies Nope, they got smart, Shadow Copies get erased after infection.

4) Pay them. Correct, and I truly hate those bastards.

[+John Teacake MVC]

http://www.symantec.com/connect/forums/cryptowall-30-status

[flynempire]

Wow. There is nothing I can do then. This is terrible

[+Warwagon MVC]

Wow. There is nothing I can do then. This is terrible

 

The worst part is your are lucky if anyone backs up. if they do it's usually connected to the computer. Which in this case also would have gotten encrypted. Nobody ever backs up let alone has off site backups . If they had a network drive mapped to that machine with full write access. Its gone too.

 

If this were to happen to me, at worst I'd loose a few files. I have a backup in my safety deposit box that gets swapped monthly, which contains important files from ALL my drives in my system and server. But sadly that's not normal

[flynempire]

The worst part is your are lucky if anyone backs up. if they do it's usually connected to the computer. Which in this case also would have gotten encrypted. Nobody ever backs up let alone has off site backups or ones that are connected to the computer. Or shared network drives on other PC's in the house with full write access. They are gone too.

 

If this were to happen to me, at worst I'd loose a few files. I have a backup in my safety deposit box that gets swapped monthly, which contains important files from ALL my drives in my system and server. But sadly that's not normal

Yes you are not the norm and I wish more were like you. They had an external disc connected to the machine with just files and all those got encrypted also.

Ohhh boy!

[+BudMan MVC]

The hard lesson of not having a backup!  What I would do is wipe their machine for them, and show them how to perform a backup.  Either get them an external backup disk, get them with one of the online backup services.  Both prob better idea!!

 

Keep in mind only critical files really need backup.. Stuff you can not recreate or get again, etc.  This would include pictures and home videos mostly..  Pretty much everything can be gotten again..

 

Depending on amount of these types of files your backup might be a couple of thumbdrives..

 

If you want to do the community and your customers a real service in IT.. Backup Backup Backup!!  Every customer you deal you should be asking them how they backup up their critical files - sorry but that video of Kevin's fist steps are not something you can get again.  Those pictures of trip to Cabo, same thing..

[flynempire]

Actually BudMan I do ask the majority and I stress to them backups and a UPS system in case the power goes out. Here in Florida that can happen often.

I leave it up to them though as I cannot force anyone to do something and there have been times when I had to say I told you so. They had to learn the hard away unfortunately.

[+Warwagon MVC]

The hard lesson of not having a backup! 

Well technically, its a hard lesson of not having an offsite, or one you don't keep connected to the computer backup. Which Even if a person has, because it's not being done automatically they tend to forget about it and not keep that backup current. In my case I turn it into a routine where the disconnected 2TB drive in my office and the one in my safety deposit box gets swapped on the last Friday of every month.

 

I will agree with you a cloud service would be a good choice, especially one which offers versioning such as carbonite.

[+Warwagon MVC]

Actually BudMan I do ask the majority and I stress to them backups and a UPS system in case the power goes out. Here in Florida that can happen often.

I leave it up to them though as I cannot force anyone to do something and there have been times when I had to say I told you so. They had to learn the hard away unfortunately.

 

I had one person ask me if I could transfer some stuff off of a desktop PC that wasn't working. I said what do you want me to put them on? I think it was a bunch of photos, music and stuff .. it was a bunch. So I said, well why don't you go buy an external hard drive I can put them on that and you can hook that up to your new computer. Then you can use that as a backup drive seeing how you dont' have one. Because at the moment the only copy of her stuff was on that PC, I told her, had that drive died you would have lost it all.

 

So then I backed up her files onto one of my spare drives, and was able to resurrect her PC. Then she said "oh well maybe i'll buy that external some day" ..I cant remember what she said exactly, but she was really trying to get out buying the drive....I was like ... oh whatever, I give up.

 

You can lead a horse to water but you can't make it drink.

[wakjak]

You can try one thing... reverting to previous version of files...

 

It'll hopefully let you go to a version of the file that was there before the CryptoWall files... I did this at work and it worked amazing..

 

Go to a file that you know was affected, Right click, Properties, Previous Version tab.. hopefully there's something there.

[DeusProto]

Cryptowall versions past 1.0 you're pretty screwed without backups.

The news of CW 3.0 is why I started backing up everything into the cloud

SOMETIMES it apparently fails to delete the Shadow Copies, but often not.

[Zinomian]

carbonite.com  its what i tell home users to get.  cheap, plenty of storage, and offsite backup.

[flynempire]

Yeah from some files I saw there are no shadow copies.

[goretsky Supervisor]

Hello,

One thing you might want to do is check with your anti-malware vendor:  They may have some suggestions, tips or tricks to help recover files that they're not broadcasting in order to make it harder for the criminal gang behind this malware to fix any flaws in it.

 

Regards,

 

Aryeh Goretsky

[JESBVT]

Hello, new to this forum.  I have now had 4 clients hit with this virus.  One was saved with Carbonite -104 GB of server data -it took a week but we restored to a previous version.  One we reformatted and two I am working on but it is looking more like reformat is the only option.  

 

I have found that Bitdefender has an immunization utility that runs on Windows startup and prevents the Ransom viruses (all of them) from encrypting anything.  After you run/install it -make sure you turn on all the features and the IMMUNIZATION.   Bitdefender is a leader in this field so I have to trust that this utility really works.

 

http://labs.bitdefender.com/projects/cryptowall-vaccine-2/bitdefender-offers-cryptowall-vaccine/

 

Good Luck.

 

John

[anticryptowall 3.0]

Hi everyone here it is a solution, how to protect your files and documents of this CryptoWall virus

 

Good luck

[Anibal P]

Time to Format C:\ 

Maybe your customer will learn their lesson about basic internet security and backups, altho I doubt it, most never learn, unless this is a business and they better learn quick