Bitcrypt Trojan Virus

[xnirkxnork]

Hi Folks

My pc has been infected with something called bitcrypt.

When I open my text documents I can´t read them due to encrypting.

All documents now also have an .bitcrypt ending.

Is there a way to restore my original files. What to do?
I´ve tried a system recovery without success.

Thx
Tommy

 

[pistache007]

Get Bitdefender and voila.

 

[ss202sl]

Restore your files from backup, but remove the virus first. There really isn't anything you can do.

 

[aldan]

have you done any antivirus/malware scans? what do you have for av/malware protection? if you dont already have it download update and run a scan with malwarebytes.when the scan is finished it will give you a list of detected items.put a check in the box to the left of all of them and click remove selected.post the log from this and your av scan as well in your next post.

 

[pistache007]

Hi

Thx for your fast answers.

All my photos has been encrypted by this shit.

Got a message that I can go to an adress and get an encoder. I will not.

I have AVG antivirus and have just installed Sophos Virus removal tool.

1 threat was removed and now I can create new .text documents and open them correctly. But all my photos are gone 🙁

I'm sorry, but AVG is not so good. If you want to get good protection, you really need to pay for it.

 

[aldan]

i would go with avast here.as per my post,run the scans and post the logs so we can see what is happening.

 

[xnirkxnork]

This is what it says:

All necessary files on your pc was encoded with a unique RSA-1024 key
Decoding of your files is only possible by a special programe that is unique for each bitcrypt ID
Specialists from computer repair services and anti-virus labs won´t be able to help you
In order to receive the program decryptor you need to follow this link www.bitcrypt.info and read the instructions

 

[ss202sl]

Pay the ransom ???????

Some people have gotten their files back this way, others just wasted their money. Either way, this is your only way to possibly get your files back.

If it doesn't work, restoring from back-up is your only solution.

 

[pistache007]

May I ask... How did you get this virus?

 

[aldan]

lets get back on track here.do not pay anything to get rid of it.start with the steps i gave you in my post.post the malwarebytes log as well as the avtivirus scanlog.you cant just do a couple of scans and voila its gone.there are different methods for getting rid of different infections.

 

[xnirkxnork]

From (obviously now) a fake micrisoft essential warning

 

[xnirkxnork]

Found this with avast

Java Sakura-F kit

 

[Dim1972]

I am also a victim of the virus. Computer specialists have not been able to do and offered me 2 outputs.
1. Format HDD and forget about the files.
2. Pay the ransom.

All photos of my family for the last 10 years have been encoding. Had to pay.
Now all files recovery and recorded on DVD.
Don't forget make backup of important information

 

[xnirkxnork]

They want 0.4 bitcoins for recovery and what I heard it is not sure you get it anyway

 

[Dim1972]

I paid 0.4BTC. Bastards sent me the program and key in a few hours. All files recovered.
You know how this virus got on my computer?

 

[aldan]

oh christ i give up.you guys want to diddle around go ahead.you want to get rid of this for gods sake read my first post.bye now.

 

[Dim1972]

oh christ i give up.you guys want to diddle around go ahead.you want to get rid of this for gods sake read my first post.bye now.

I already reinstall Windows.

 

[janbeckers]

i would go with avast here.as per my post,run the scans and post the logs so we can see what is happening.

Hi Aldan,
I have the same problem: all files encrypted with bitcrypt and they ask me money to restore my files. I don't intend to pay and sent a complaint to the police. Meanwhile I am working with Avast to delete the virus.
But do you have ideas on how to restore the encryted files?
regards
Jan

 

[ss202sl]

i would go with avast here.as per my post,run the scans and post the logs so we can see what is happening.

Hi Aldan,
I have the same problem: all files encrypted with bitcrypt and they ask me money to restore my files. I don't intend to pay and sent a complaint to the police. Meanwhile I am working with Avast to delete the virus.
But do you have ideas on how to restore the encryted files?
regards
Jan

You have 2 choices.
1. Pay the ransom and hope you can decrypt the files.
2. Restore the files from backup (after the virus has been cleaned from your system).

 

[aldan]

bullshit.never pay.this thing can be gotten rid of.ive done it and so have a lot of people i know.start with malwarebytes and read some of the many tutorials you can google in 1 minute on manual removal.paying the ransom doesnt get the virus files off your machine.

 

[ckd]

We get it in our company... page where we can pay that mthfcks doesn't work... our important files gone....
Trying to recover with some free data recover programs didn't succeeded. Could someone send that program that u bought from them? maybe He'll work for everyone?

 

[Anaero LLC]

Computer in our office is also infected. In the Kaspersky Lab say "File decryption without private key impossible". Private key unique for each ID.

Site bitcrypt.info does not work since yesterday evening, but in bitcrypt.txt are alternative domains kphijmuo2x5expag.tor2web.com and tor site kphijmuo2x5expag.onion They are now available.

Someone knows where to buy BitCoin by credit card?

 

[dewk]

Computer in our office is also infected. In the Kaspersky Lab say "File decryption without private key impossible". Private key unique for each ID.

Site bitcrypt.info does not work since yesterday evening, but in bitcrypt.txt are alternative domains kphijmuo2x5expag.tor2web.com and tor site kphijmuo2x5expag.onion They are now available.

Someone knows where to buy BitCoin by credit card?

Bitcrypt has been broken.

See this: http://blog.cassidiancybersecurity.com/post/2014/02/Bitcrypt-broken

 

[Tamma Paf]

1) if i want my data back (since not every file has backup and i really learn lesson from this), should i remove the virus first and then pay the ransom? or i should pay the ransom first.

2) i do not receive email about the bitcrypt ID, is it can be found from the bitcrypt.txt file?

aldan, I understand we should not pay for it, however, i really want my photos and videos back............🙁

I am also a victim of the virus. Computer specialists have not been able to do and offered me 2 outputs.
1. Format HDD and forget about the files.
2. Pay the ransom.

All photos of my family for the last 10 years have been encoding. Had to pay.
Now all files recovery and recorded on DVD.
Don't forget make backup of important information

 

[Tamma Paf]

i read the article, but for non computer expert, how to solve the problem? any quick solution?

Computer in our office is also infected. In the Kaspersky Lab say "File decryption without private key impossible". Private key unique for each ID.

Site bitcrypt.info does not work since yesterday evening, but in bitcrypt.txt are alternative domains kphijmuo2x5expag.tor2web.com and tor site kphijmuo2x5expag.onion They are now available.

Someone knows where to buy BitCoin by credit card?

Bitcrypt has been broken.

See this: http://blog.cassidiancybersecurity.com/post/2014/02/Bitcrypt-broken