So how fucked am I? Any way to decrypt my files?
Just restore from your backup
What kind of shady Russian site did you get that shit from?
>>54334664
Anon ..
>>54334664
No backup.
>>54334633
You're a retard for not making backups, a retard for getting infected, retard for not realizing there is no decryption tool and you are 100% totally assfucked until you pay up or someone decrypts it, which isn't likely.
>>54334686
Updated ccleaner then put my computer to sleep, turned it back on and pic related. Running Recuva now for the encrypted files. ANyone else come across this?
>>54334706
Reinstall your shit; make backups next time.
>>54334719
What the hell site did you update Ccleaner from?
The official site?
>>54334733
It's pretty obvious he got it from some shithole website, or isn't running an adblocker and got hit by malvertizing.
>>54334719
>Running Recuva
Recuva isn't going to do shit, anon.
Recuva is a file recovery program(shitty one at that). The files aren't deleted. They're just encrypted.
Your only options are pay the ransom, wait for someone to busy the developer and release the decryption toolset, or buy another HDD.
>>54334724
How to make backup?
>>54334750
Or they had flash enabled.
>>54334752
Step 1. Reinstall your encrypted OS
Step 2. Get an external HDD.
Step 3. http://windows.microsoft.com/en-us/windows-10/getstarted-back-up-your-files
A few seconds in Google could of just answered this for you, but, here you go.
>>54334776
See, spoonfeeding retards doesn't help the board at all.
dont worry i'll pay it for you OP
sent ;)
>>54334633
just ask the NSA for the private key :^)
How quickly can a ransomware encrypt a 1 TB hard drive?
>>54334633
Jesus, dude, you're using Windows (which doesn't require an admin login to install/uninstall/change shit), and you DIDN'T back up your files?
You're done. Also, you obviously updated CCleaner from a non-official website. Why would you do that?
Here's what you do: reinstall your OS, or install a new one (if you're fucking retarded on anything but windows, like me, then use Mint 17.3 Cinnamon). There's no choice, shy of a literal miracle.
And if you're gonna use Windows, then be fucking smart about it. By the sounds of things, you need a spyware/malware/virus scanner that constantly monitors you. Drop the coin for something that will, so that you hopefully won't get something like this again. Vipre or Webroot would have stopped that shit in its tracks (but, knowing you, you would have over-ridden it).
>>54334719
There is nothing more pathetic than a retard who thinks he isn't. At least old people admit they don't know shit. People like you manage to fuck up systems far worse then they ever could.
>>54334876
They just encrypt most important files, like doc, pdf, etc
And it depends entirely on your cpu and hdd/sdd read/write speeds.
>>54334897
>They just encrypt most important files, like doc, pdf, etc
no
most ransomware now tries to encrypt fucking everything, even external drives.
>>54334904
No one said they won't encrypt external drives, they in fact do that, anything that is visible from your computer (network drivers, network pcs, etc), but they mostly encrypt most useful files first, they don't encrypt useless or system files.
>>54334904
Why on earth would you have an external drive constantly connected? It defeats the point entirely.
>>54334917
>mostly encrypt most useful files first
useful is subjective.
here is the full list..7z, .rar, .m4a, .wma, .avi, .wmv, .csv, .d3dbsp, .sc2save, .sie, .sum, .ibank, .t13, .t12, .qdf, .gdb, .tax, .pkpass, .bc6, .bc7, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mcgame, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .001, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .DayZProfile, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, .unity3d, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbfv, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps, .docm, .docx, .doc, .odb, .odc, .odm, .odp, .ods, .odt
FORMAT
>>54334878
>Mint 17.3 Cinnamon
>>54334991
I already gave my reasons. I'm alright at Windows, but utter ass at literally everything else.
You could try this OP, depending on what version of the ransomware you have.
http://www.bleepingcomputer.com/virus-removal/teslacrypt-alphacrypt-ransomware-information#tesla
>>54334952
>can't find .mkv in the list
so my animes is fine?
>>54335030
Do sites like Dropbox back up user files? Wondering how much of a shitstorm there would be if Dropbox or similar got hit with ransomware.
>>54334922
You're fucking retarded.
>>54335079
You're fucking retarded too.
>>54335079
Keep a physical backup in your home that's not attached to your network. It's the only 100% safe way.
>>54335101
I think it might be you who is the retard.
>>54335001
>I'm alright at Windows
>whole system is fucked
>>54335104
Sorry anon, but that question was the dumbest thing I've read all day.
>>54335104
>Wondering how much of a shitstorm there would be if Dropbox or similar got hit with ransomware.
You're calling others retards after saying this?
>>54335115
>>54335122
You can't even explain why, so I think that represents a huge problem for you two. Inability to express or explain your thoughts are symptoms of spectrum disorders.
>>54335079
>Do sites like Dropbox back up user files?
this can't be real
>>54334633
What is the name of the note
What extensions got added to your files? You need to know what ransomware this is
>>54334706
You deserve your fate
Make offsite redundant backups
>>54335129
>>54335175
If you need an explanation for why your post was the dumbest shit we've read all day, are you really sure you aren't retarded?
>>54334814
>decrypt one file for free
LMAO
>>54335191
You definitely have a problem.
>>54334952
>wotreplay
>>54335182
de_crypt was the name. All yhe changed file extensions are .crypt
>>54335106
I'm not OP, dude.
>>54334876
Technically a fast 1tb hdd connected by usb3 or SATA could be encrypted in 5 hours or so. Then the cpu comes into play making it longer.
>>54335217
You got hit with CryptXXX, most likely as a result of an exploit kit
Do you have outdated flash?
See following blog post https://blog.kaspersky.com/cryptxxx-ransomware/11939/
>>54335243
I don't think so. I was updating ccleaner through its link and I'm thinking I got hit with it when it opened the link in IE
>>54335303
Try it anyway dude
>>54335211
this
you should downvote his post and report him to reddit police, he is in dire need of safe space
>>54335303
>IE
Also, I don't believe for a second that you updated CCleaner through its official site.
Did you double check the address bar?
>>54334633
Run forensics, hope and find the malware installer, share with with malware research community and see if there are any flaws in its crypto to attack the program.
This has been done multiple times before. I can't immediately recognize which variant of cryptolocker you got.
>>54335313
Ok, I tried the RannohDrryptor and it's asking me to specify the path of the encrypted file. I'm clicking on one of the .crypt foles and it's telling me it can't without the original copy
>>54335476
Surely you can find the original for one of your encrypted files
>>54335506
Ok, got it. Scanning now. Wishe lick, anonbros. And yes, I'm not trying to hide that i'm remedial when it came to this. This is a legit call for help, no pretenses
>>54335580
Gl breh
>>54335580
any prograss anon? it needs on original copy, and one encrypted copy. also i think its best if you provide file with largest size.
pls keep us updated
>>54335207
Just request to decrypt the hard drive file, that should cover all of them, right? [spoiler]:')[/spoiler]
plug your HD into another computer and see if the thing actually encrypted your files. If it did, you're fucked.
>>54335844
Scan still in progress.
Found: 26544
Decrypted: 6453
44 mins elapsed. I think o may need to feed it a bigger file sample.
>>54334751
wrong. the files do get deleted, tho the chance to recover any is likely zero.
>>54336028
Nah should be okay, this takes a while it's normal
>our Secret Server
>user ID starts with BBC
lmao
>>54336171
File size sample doesn't matter? I was thinking it only decrypted files smaller than the sample fed to it
>>54334633
>protected
>>54335207
I guess its there to "prove" they can actually decrypt files
>>54334878
Windows does require admin login to do that, but you have to set up a seperate user account and log into that instead.
>>54334633
Thanks anon, I needed a good laugh.
>>54334633
>You don't need no antivirus
/g/ said
>antiviruses are for plebs
/g/ said
Never listen to /g/.
>>54334706
Well, live and learn.
People say restore from backups, but my backup solution is putting a portable external and copy files every 12 hours. If by some reason I would get my files encrypted by some asshole, then what the fuck would I do? I'm sure they could access my backup as well since it's connected almost all of the time.
Looks like OP bailed the thread
>>54341623
Then it's not a good backup system. A good backup system should have redundancy, even from itself. Try keeping your backup connected every 12hours, sure, but then every week or so just keep another, separate behind an air wall.
>>54341651
A NAS or server where I can only backup putting a password? That sounds a little safer.
>>54341691
Your data can still be pwnd over a password, and if you were RATted then it wouldn't help. The way I do it is I have have a TB external HDD, which I store anything important on, however, it is never connected to my network outside of when I'm transferring data.
did it really encrypted your files?
boot with a linux live distro and check if you can access your files
>>54340360
>which antivirus you use /g/?
>common sense
you don't an antivirus if you are careful
if you're retard though it is a different story
>>54334719
>uses ccleaner
>thinks recuva recovers encrypted files
>asks for tech support on board that isn't your personal tech support
ISHYGDDT
>>54340360
>implying antivirus recognizes a majority these ransomwares
>implying antivirus helps if you're retarded, which OP obviously is
>people don't realize op just got the image from le interwebz
just remember people. anti virus doesnt do dick. 1 step forward, 3 steps back.
>>54342249
I've seen cryptolocker stopped a few times in our ERAC at the office, never had a breakout. Just strikes given to the remote users who got them in the first place.
>>54334862
>using the smiley with a carat nose
>>54334633
>RSA4096
Your bleeding anus amuses me greatly
>>54334633
>files ?
I can't begin to tell you how much this annoys me.
https://en.wikipedia.org/wiki/Plenken
The authors deserve 15 years of hard labor prison for their crime against typography.
how many time does it take to encrypt all?
>>54336228
I don't see why it would matter. One you guess the key by cryptanalysis of the two files you have the key and its gonna work on whatever else was encrypted with it
>>54334633
Either pony up the bitcoins or wait for the FBI to find the guys and release the private keys
This seems like a good time to tell a story about a friends experience with ransomware
>comes to uni one day laughing and saying he got ransomware
>ask him what he's going to do
>nah man I have everything backed up on an external
>starts laughing
>next day
>bro I lost everything because of ransomware
>ask him about his backup, expect him to say something like the backup is broken/missing/etc
>I plugged it into the computer and all the files were encrypted by the ransomware
Nigger literally had his files safe, and decided to plug his only backup into an infected system.
I laughed at him then called him a fucking idiot.
>>54342799
calm the fuck down man holy shit
>>54335844
Managed to recover a good ammount of files. Gonna head out while it scans again.
I got it too like a retard that I am (didn't visit any site out of the ordinary) and I shut it down quickly when Windows Defender kept spamming messages and luckily it only fugged txt files. Anyway, u're boned OP.
>>54334706
Get REKT, sunshine
>>54334633
Wipe it.
Install from a recent backup.
Didn't make a backup? Tough shit, you lose your files.
>>54343598
Did you just reformat afterwards? I ran malwarebytes just to check if my system was still filthy
>>54343662
Only ran Malwarebytes and searched for the crypt extension to see if it did something in the meantime. Malwarebytes found a trojan and some messed registries.
Who would you report this to?
Would there been any point?
>>54343702
At this point, I'm just trying to salvage files. Gooing good for the most part with the recovery
>>54344023
Make sure to keep us updated about the eventual % recovered safely.
Also when you finish you should message the malware people and make fun of them
>>54334633
Better start factoring.
>>54342710
>carat
>tfw I don't have backups because I haven't bothered to organize my shit into what needs backing up and what is expendable
>tfw I only visit a select few websites and never click on questionable shit so I'm pretty safe
>>54344237
Factoring what?
>>54344660
https://en.wikipedia.org/wiki/Integer_factorization
>>54334814
i like their way if forming sentences, such nice guys just like we are friends.
>>54334952
>no xm v2m or mod files in the list
my haxor music is safe
>Not using Google drive/Dropbox/a large capacity jumpdrive to store your files
>>54344856
D-do you use Cubic Player? The one with the Alien background?
>>54334770
Or had Java installed.
>>54345439
nope i use xmplay but damn cubic looks nice
so how do you even get hit by ransomware
>>54334719
>ccleaner
im using it and it works fine for me
>>54345666
Haha shit I didn't realise Cubic was still active semi recently. I was asking ironically because last time I used it was on my 386 that couldn't play this fancy new MP3 format everyone was raving about.
>>54345817
i would gladly switch over to anything but no player can handle v2m and converting it is a crime (its so fucking good)
>>54345817
I also found a screenshot of this monstrosity while looking for the CP screenshot. I remember using it at some point on my life.
Sucks to be you OP by the way, but I'm done detailing now.
>>54345845
I'll admit I don't even know v2m format. Trackers and scene in general are ancient history for me now. Sometimes I regret it.
>>54345878
I want to be a part of it but i have yet to find time to learn opengl and the tricks of winapi to make some cool effects
>>54345915
>scene
>learn opengl
>winapi
kek, back when I was into it it was assembly or bust. Which is what ultimately put me off of it because I couldn't get over the learning curve with the two books I had and no internet to look up stuff and ask others.
I better just watch Second Reality [spoiler]on youtube[/spoiler] and go to sleep before I get too nostalgic.
>>54346025
i still have my commodore 64 in the garage but if i will ever make a demo it will be 64k coded in c++ probably
>>54346049
Godspeed anon, it's one of the best hobbies there are. I found other outlets but it's good to see people are still interested in it.
>>54334633
try to brute-force it with your GPU
paying up is for loosers
I would personally just wipe my drive with daemon and reinstall my os. Especially easy to do if you have your key and some installation disks. Also, this kinda shit only happens to morons so rip op
>>54334633
>he actually thinks his 1 TB of anime was encrypted wit Houten him noticing
Most of these attacks only hold key components at risk and they are of no lost value
>>54342799
I recently had to modify the code of someone who did this. Every function's arguments would have a space before each comma but not one after; it was maddening.
>>54344152
So update time -- Managed to recover somere files. The remaining encrypted ones are large (60mb), so i need to dig up an oroginal copy of that file and feed it into the decryptor
>>54346281
This decryptor tool seems to be doing good werk. Imma brute force it as a plan Z
>>54346414
how did you recover those files?
Here's a protip: if it encrypted your files locally the key is in your memory.
Likewise if it will offer to decrypt locally for one file for free
>>54334633
How does someone fuck up so badly at using the computer and cause this to happen?
What the fuck do you people download? I haven't had a virus/malware encounter since 2001, and I'm still absolutely bewildered by how people come across this kind of shit.
>>54346485
Encryption only requires the public key to be in memory. I doubt ransomware use symmetric keys.
>>54346485
How do I search for said key?
>>54342203
WHAT
THE
FUCK
?!?
>>54334814
>73.188.154.110
Do these encryption schemes affect any other partitions on the same Drive? Other installed drive?
>>54342249
Premium Malwarebytes recognizes most of them and stops them in their tracks.
They also have a free Beta program called Anti-Ransomware that will catch every single one.
It monitors your hard drive and as soon as any encrypting is started it stops that program.
>>54346751
>premium feature
what happaned to anons giving away a fuckton of codes? i used one fore a while but it eventually stopped
>>54346671
It seemed to affect all drives connected at the time of infection
>>54346512
Seriously, where do people go to find randomware? OP, what dodgy sites have you been browsing and what random .exe have you been running?
>>54334633
>protected
You are such an idiot.
Did you open something from your email like? attachment.zip.exe?
lol n00b
>>54346595
You should create an image of your memory (live acquisition). Then perform a forensic investigation on the image. This link could help you determined which tool you'd need: http://forensicswiki.org/wiki/Tools:Memory_Imaging
Note that you're on your own on this one, and there's no guarantee you'll find it. Even if you do, it's probably the public key anyway, which is unable to decrypt your data.
>>54347715
Probably some js/flash bullshit. People need to stop visiting so many websites. If you ever only visit like 3 websites with official SSL certificates, you're safe from pretty much anything I really don't get why people feel the need to browse as many websites as possible, you only need like 3-4.
>>54347715
>>54348167
Piriform opened up an IE window for the ccleaner update prompt, I updated and turned the laptop to sleep, I come back, my shit is encrypted
>>54334633
Your only hope get your files back without paying is if the ransomware is hidden tear based.
This is why I have a 120GB ssd and a slow as fuck hdd for everything else. Good luck encrypting my shit at the pace of a literal turd falling from my asshole.
>>54346528
>I doubt ransomware use symmetric keys.
All public key crypto systems use symmetric keys, friend.
>>54348488
Semantics, you know what I mean.
>>54348537
>you know what I mean.
Yes, but I'm anonymous on the internet so I'm still going to be an asshole about it
>>54348488
So can these assholes tag me again after I decrypt my shit?
Shadow Explorer is a must have tool to recover lost files
http://www.shadowexplorer.com/
>>54348583
Are you retarded? If you manage somehow to decrypt your shit you reinstall ASAP. You should probably already done it.
>>54348644
No, I'm still in progress of decrypting the rest of the large files. Reinstalling/reformatting ASAP once I get my shit back
>>54348691
How are you decrypting?
Did you pay them
I work in data recovery.
Your files are fucked. We send those jobs straight back with nothing but laughter.
>>54348633
The majority of decent ransomware purges shadow copies; only shit ones don't and a lot of those use encryption methods weak enough to be broken with a few samples.
>>54348933
>I work in data recovery.
>doesn't do data recovery
you sure are good at your job anon.
>>54348933
So far, the recovered files are good -- so there's that relief. It's the .psd's I'm wanting to recover next
>>54348933
That really says a lot about your service.
Can you tell the name so we never go there since you obviously can't do the job you advertise?
>>54348791
ANSWER THE QUESTION, OP.
>>54349228
I think we all know how he is doing it...
>>54334633
>Windows problems
>>54349228
I didn't pay them. Having someone do the decrypt for me. Didnt get around to asking in depth what the method is
>>54349273
>mfw I put my sister, parents, and grandparents onto linux mint and have had so much less IT bitch work to deal with from them
>>54349228
Read the thread, dipshit!
>>54335207
This might seem strange to you, but professional criminals are running a business, they need to keep their customers happy (i.e., whoever is paying them). If you're selling guns or drugs, you can't just sell duds if want to keep getting paid.
>>54346669
>not seeing .onion
It is a darknet site. First IP is pointless. Learn to internet.
>>54349677
So they waanted me to go to the darknet to pay the ransom?
>>54349722
> Not reading OP's image.
>>54334633
this is why i use gnu/ linux
>>54343193
>yfw the private keys are AES256-encrypted and they won't give the police the key
>>54349281
Only known one is Shor's algorithm, and you need a quantum computer for that, so no, they aren't.
Update:
25583 encrypted files found
24922 decrypted
97% recovered, using an 8.00 MB file sample. I'm getting there, /g/. Going for a triple digit file sample next before I hit the sack. I'll post my findings in the morning.
>>54346462
It's probably a fork of the original Cryptolocker, and the master keys were released once they caught the Slavshits who ran it, there's a decryption program made by one security company that automates the process
>>54346982
>paying for ransomware protection
There's a free program that's been doing this shit for years now, it stopped both the original CL and some chinkshit fork when some retard at my parents' office got a mysterious PDF from Adobe
https://www.foolishit.com/cryptoprevent-malware-prevention/
![snapshot_11.17_[2016.02.14_12.56.25].png](https://i.imgur.com/kk3Wlei.jpg "snapshot_11.17_[2016.02.14_12.56.25].png")
>>54334878
spamming/advertising isn't allowed here
This is why encryption should be illegal. Vote Hillary, faggots.
>>54352660
nice b8 m8
>>54334750
Or he has Adobe Flash installed
>>54349970
>Shor's algorithm
The majority of real cryptography is broken by side channel attacks.
RSA is only safe if perfectly implemented. And like all common algorithms, it's very hard to implement properly.
>>54334706
>>54348231
You got hit with malvertizing probably. IE has filter lists that block ads. Use them.
>>54334952
> sc2save
> d3dbsp
That's fucking random
Maps for call of duty and SCII saves?
>>54336058
files can't get deleted if your hard drive has no power.
>>54355474
some russian kid probably just found which were the top 50 file formats on his PC or some shit.
