OT: Computer infected with ransomware, all my files are encrypted, any way to recover them?

[greenknight]

I get emails all day demanding bitcoin and they have a password I use. I just delete and figure of they could they would have already shut down

 

[yesrutgers01]

Ok so we contacted them and they want $8k. Sorry but that ain't happening. They did offer to decrypt one file for free. Now, I know nothing about computers but if we know what the encrypted file's original data looks like, and we know what it is post-encryption, is it possible to reverse engineer the deception keys?

You are not going to reverse engineer it. Try to negotiate as that seems high for a personal computer.

 

[GoodOl'Rutgers]

are you sure you got encrypted? I saw something pop on my screen from a website teh other day.. seemed to stop what I could do.. and they wanted me to gall to pay to release everythign.. I did CTRL-ALT-DEL started task manager.. shut down my browser.. rebooted.. all was well.

And I don't go anywhere I shouldn't on the web, so it was likely some "real" website got infected and sent out some crap stuff.. like some ads on Rivals have done from time to time. Blackhats are always watching for the most used search terms and trying to jump in that traffic.

And if that ever happened to me I would reformat and reinstall windows from scratch.. a lot of stuff is backed u in the cloud.. google photos, etc. I'd rather lose stuff and work to reinstall everything than pay the bastards.

And, yes, often it is just some malware interfering with you but when you panic and call them they will try to get you to install some really vicious stuff that will give them full control of everything.

 

[drewbagel423]

MIL just called me this week saying that she had a number on screen and she called it because her "Windows 35" was comprised, LOL. They wanted her to download something to give them control over the laptop. Luckily she didn't fall for it. I told her to shutdown and bring the laptop over, I expected something like this but fortunately it was just some malware and nothing else. I wouldn't pay or even acknowledge them.

Not sure if a decrypter exists for this yet, but the first step is to get rid of the malware. This site, https://malwaretips.com/blogs/remove-mr-helper-qq-com-dewar/ , has some good tips for this and other malware in general. You may be able to get your files back through shadow explorer.

If a decrypter doesn't exist, then best option is to reformat the drive (check for rootkits), and reinstall. In the future back up documents to MS and Google.

I reformatted and reinstalled windows already. How do I check for rootkits?

 

[czxqa]

I reformatted and reinstalled windows already. How do I check for rootkits?

Download Malwarebytes and install it. Then run a full scan. It will search for rootkits. Enable the realtime protection and this shouldn't happen to you again.

Edit: the program is free. The subscription is for a couple extra features but it's not much.

 

[GoodOl'Rutgers]

Download Malwarebytes and install it. Then run a full scan. It will search for rootkits. Enable the realtime protection and this shouldn't happen to you again.

Malwarebytes seconded

 

[yesrutgers01]

Download Malwarebytes and install it. Then run a full scan. It will search for rootkits. Enable the realtime protection and this shouldn't happen to you again.

Edit: the program is free. The subscription is for a couple extra features but it's not much.

Unless you open a link you shouldnt

 

[fg7321]

This post inspired me to back up my PC with the 1TB drive I have for just this reason.

 

[sherrane]

Ok so we contacted them and they want $8k. Sorry but that ain't happening. They did offer to decrypt one file for free. Now, I know nothing about computers but if we know what the encrypted file's original data looks like, and we know what it is post-encryption, is it possible to reverse engineer the deception keys?

It would take about 300 trillion years to crack a 2K encryption key, which is likely the size of the key that was used. This is the reason the FBI wants Congress to require back doors in encryption. You know, because only the good guys would ever use it.

 

[sherrane]

This post inspired me to back up my PC with the 1TB drive I have for just this reason.

Make sure you disconnect it from the computer when you are not backing up to it or restoring from it. The cryptos will encrypt all drives connected to your computer.

 

[drewbagel423]

Make sure you disconnect it from the computer when you are not backing up to it or restoring from it. The cryptos will encrypt all drives connected to your computer.

This was my problem.

 

[fg7321]

Here is another TIP....

Run this program on your computer Magic Jelly bean. It will make a list of you installed programs and any product keys you have installed on the pc.

https://www.magicaljellybean.com/keyfinder/

 

[RUinOhio]

here's a good resource

 

[ashokan]

I think any computer linked to internet has to be considered vulnerable, and anything valuable on it backed-up on another device that's not connected. Transfer speeds are so sweet these days there's no reason not to back things up to even just a small flash drive

 

[yesrutgers01]

One of the things they say to do is have a device at home that is 109% financial. Do not use it for anything else and do not use anything else for the finances.

 

[fg7321]

One of the things they say to do is have a device at home that is 109% financial. Do not use it for anything else and do not use anything else for the finances.

That strategy wont work if that PC is connected to a network. Any PC or tablet or phone connected to the same network can infect all devices on that network. One dope in your company can click a malware link and shut down your whole enterprise.

 

[yesrutgers01]

That strategy wont work if that PC is connected to a network. Any PC or tablet or phone connected to the same network can infect all devices on that network. One dope in your company can click a malware link and shut down your whole enterprise.

Talking about personal only. 99.9 % of the time the attack at home is just one device...