Looking for design inspiration?   Browse our curated collections!

Return to Main Discussion Page
Discussion Quote Icon

Discussion

Main Menu | Search Discussions

Search Discussions
 
 

Family Treasures PRIVATE GALLERY

9 Years Ago

Anyone Experienced With The Crypto Wall Virus??? This Is Really Bad News!

I was attempting to help a friend with her computer problems and found out she had all her images (jpgs) infected with a trojan called Crypto Wall. I found out it is easy to remove the program reponsible for the problem, but they incrypt the files and I have not seen anything that would fix these files. They want you to pay a ransom which is now up to $750.00. Anyone know anything about this? Here is the message they give you:

What happened to your files?



All of your files were protected by a strong encryption with RSA-2048 using CryptoWall. More information about the encryption keys using RSA-2048 can be found here: en.wikipedia.org/wiki/RSA_(crypto system)



What does this mean?



This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.



How did this happen?



Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.



What do I do?



Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for the solutions because they do not exist.

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:

Reply Order

Post Reply
 

Mike Savad

9 Years Ago

i have no plans on clicking on any of those links, which probably leads me to the virus. i always thought it only covered DOC type files.

---Mike Savad

 

Hi Mike, I don't see that those links are clickable, but no one should follow those links. I just wanted to show the message that they included with their takeover. Yes, it covers doc files as well as jpgs and I believe one other type of file. I will remove those addresses above so that no one will follow them.

 

James B Toy

9 Years Ago

First and foremost, whatever "they" tell you to do, DON'T DO IT!

Here's an article describing the problem. http://www.pcworld.com/article/2600543/cryptowall-held-over-halfamillion-computers-hostage-encrypted-5-billion-files.html

Symantec may have a solution http://www.symantec.com/security_response/writeup.jsp?docid=2014-061923-2824-99

 

Thank you James

 

Mike Savad

9 Years Ago

the only thing it reminded me to do is to make new backups on a dvd of the doc files these were meant for. i heard about this one last year. i forgot to do it over the 8 months or so.

---Mike Savad

 

Thanks for the info James. I think that from now on I am going to use my oldest, crappiest, computer for the internet and my good computer with my important stuff on it for everything else. I have too many old backup drives that won't work with newer computers and operating systems to even trust them. It seems like my old camera cards are still working and the files still accessible. Maybe that is more effective for me anyway than the backup devices that I have used.

 

I found some info on youtube on how to get rid of this malware. Some say to just do the going back to an earlier time. I tried it but couldn't go back far enough. I found this one. https://www.youtube.com/watch?v=Evy0xK1N2gc I think I am too scared to try it though.

 

Mike Savad

9 Years Ago

when you go back, it will save the current session. but the back step doesn't save the jpgs and such unless you asked it too. the space would be too much. so if you have locked files then your out of luck. and it doesn't always work, sometimes a virus will remove the back steps, and others will replace those copies with copies of itself. in the worst case scenario, or most annoying, you can format and start over.

---Mike Savad

 

This malware seems to be confined to whoever is the current user. I created a new user id with full permission and the computer and the internet is working great. It is when I went into the affected or infected user id, that is where the trouble begins. We couldn't see that the files were infected until we went into "my pictures" where all the photos were kept that we could see what the problems was. Everyone should have an extra id that is granted full permission to make changes. That way if your having a problem in one user id account, you have a better chance of fixing it using another id that is unaffected rather than trying to fix the problem in the current id that is having the problem.

 

Richard Rizzo

9 Years Ago


sorry to hear this happening to you or anyone else but it would be interesting to find out how they can get a way with doing this.

 

Evidently there have been previous versions of this virus (trojan) with names like cryptolocker. Also referred to as "ransomeware".

The criminals behind CryptoWall managed to compromise 625,000 computers in the last six months, surpassing the roughly half million infected with CryptoLocker.

However, its lack of less complicated payment options has led to a much smaller take, roughly $1.1 million versus about $3 million for CryptoLocker.

CrptoWall encrypts files more important to consumers, such as jpgs, audio and video files. CrytoLocker was more focused on document files.

 

This discussion is closed.