Ever Been Hit With Ransomware?

[SnoopyDrew]

Well it happened to me last night. I was a little drunk and not really thinking. I got an email that said I needed to appear in court. It seemed somewhat legit and it was not in my spam folder. It had an attatched file on it that seemed legit as well.

Long story short I have ransomware that has a note that says.

- If you do not pay in 3 days YOU LOOSE ALL YOUR FILES.
- Nobody can help you except us.
- It`s useless to reinstall Windows, update antivirus software, etc.
- Your files can be decrypted only after you make payment.
- You can find this manual on your desktop

I thought it was a joke until I actually did some reading up on it and it seems as if its a very serious problem right now. Some of my files have already been crypted. Does anybody have any experience in this stuff? I have been trying malware forums and stuff like that but those forums take FOREVER to answer me back. I can't lose all my files and I am freaking out

 

[okta123]

The fbi recommends that you pay up if hackers infect your computer with ransomware.

 

[SkyrocketSEO]

Dude, you are fucked!

 

[Conor]

Just ignore it. It sounds like moronware.

Formatting always works.

 

[jigsaw23]

Well it happened to me last night. I was a little drunk and not really thinking. I got an email that said I needed to appear in court. It seemed somewhat legit and it was not in my spam folder. It had an attatched file on it that seemed legit as well.

Long story short I have ransomware that has a note that says.

- If you do not pay in 3 days YOU LOOSE ALL YOUR FILES.
- Nobody can help you except us.
- It`s useless to reinstall Windows, update antivirus software, etc.
- Your files can be decrypted only after you make payment.
- You can find this manual on your desktop

I thought it was a joke until I actually did some reading up on it and it seems as if its a very serious problem right now. Some of my files have already been crypted. Does anybody have any experience in this stuff? I have been trying malware forums and stuff like that but those forums take FOREVER to answer me back. I can't lose all my files and I am freaking out

can you provide a screenshot for the message you are receiving
Just to be sure which ransomware has targeted you.

These days teslacrypt and locky ransomware are doing the rounds.
Are they demanding you to visit a tor link?

 

[SnoopyDrew]

Well I have done some research and it seems like I have pinpointed the exact type of ransomware it is. I just have to decrypt all the infected files and its a huge fucking hassle.

 

[SnoopyDrew]

Here is a screen print of it

 

[Conor]

http://www.bitdefender.com/tech-assist/self-help/removing-police-themed-ransomware-malware.html

 

[msoman]

Maybe try reporting to the police?

 

[roguerabbit]

I can offer no help, only came here to say I'm holding thumbs you manage to sort this S out

 

[jigsaw23]

Well I have done some research and it seems like I have pinpointed the exact type of ransomware it is. I just have to decrypt all the infected files and its a huge fucking hassle.

can you give me the name

For example if it is teslacrypt
then we can use this tool by CISCO
http://www.talosintel.com/teslacrypt_tool/

IT IS BETA BUT STILL A SHOT

if its locky then it is harder

 

[SnoopyDrew]

I think the malware forum people were saying its a nemucod or something like that. They are helpful in the forums but they answer back so slowly.

 

[jigsaw23]

Maybe try reporting to the police?

no use at all...

 

[jigsaw23]

I think the malware forum people were saying its a nemucod or something like that. They are helpful in the forums but they answer back so slowly.

Awesome(that there is a decryptor not that you got infected.)
the decryptor for nemucod is released already.

I WILL GIVE THE LINK TO THE SOFTWARE

but just to be sure about the type

which forum was it
How were you notified about the ransom

Example: If your computer is infected with the Locky ransomware will display a red _Locky_recover_instructions.png wallpaper that covers the entire desktop, and all your documents will have a .Locky extension. A _Locky_recover_instructions.txt text file will be placed on your desktop. Both files contain instruction on how or recover the encrypted files.

 

[SnoopyDrew]

Yes It was confirmed to be .crypted nemucod ransomware and its already crypted a lot of files on my pc.

I wish I was a little bit more tech savvy but I have no idea what I am doing to be honest.

 

[tompots]

That sucks that happened to you, I have heard about this, and it is becoming a big problem. I guess the encyption is so strong the US goverment can't decrypt it. There was a big hospital here whare I live that got it and had to pay a tone of money

 

[SnoopyDrew]

Awesome(that there is a decryptor not that you got infected.)
the decryptor for nemucod is released already.

I WILL GIVE THE LINK TO THE SOFTWARE

but just to be sure about the type

which forum was it
How were you notified about the ransom

Example: If your computer is infected with the Locky ransomware will display a red _Locky_recover_instructions.png wallpaper that covers the entire desktop, and all your documents will have a .Locky extension. A _Locky_recover_instructions.txt text file will be placed on your desktop. Both files contain instruction on how or recover the encrypted files.

Thank you so much for the help I really appreciate it.

I got it from bleepingcomputer and this thread http://www.bleepingcomputer.com/for...ucod-decrypttxt-support-and-help-topic/page-6

I think I already have the decrpter software downloaded if its a application called Decrypt_nemucod then yes I have that already I just have no idea how to use it.

 

[SnoopyDrew]

That sucks that happened to you, I have heard about this, and it is becoming a big problem. I gusset the encyption is so strong the US goverment can't decrypt it. There was a big hospital here whare I live that got it and had to pay a tone of money.

Hopefully this thread can save some people the trouble. Do not click on an email if it tells you to appear in court.

 

[jigsaw23]

http://www.bitdefender.com/tech-assist/self-help/removing-police-themed-ransomware-malware.html

BRO cryptovirus are a different class

it is not your usual malware. It took FBI, govts, security firms months to find a solution.

Example: Cryptolocker in 2013(others are just clones and variants)
Due to the nature of CryptoLocker's operation, some experts reluctantly suggested that paying the ransom was the only way to recover files from CryptoLocker in the absence of current backups (offline backups made before the infection that are inaccessible from infected computers cannot be attacked by CryptoLocker).Due to the length of the key employed by CryptoLocker, experts considered it practically impossible to use a brute-force attack to obtain the key needed to decrypt files without paying ransom

 

[shanna_doll]

I'd recommend to backup all of your important files on a USB or SD Card or something.