RansomWare and Removing it

[Kevinwza]

Hi ,

Really could do with some advice . Had never heard of this till about an hour ago . A client phoned me saying he has has a pop up on his laptop saying his files have been encrypted and he must pay them in bitcoins or he will never get his files back . He says McAfee has identified it as randsom-exxroute~txt .

Is there software that can help here or is it only possible to prevent an attack rather than remove it once it has infected .

Any advice is welcome.

 

[USAFRet]

Ransomeware popups:

There are a few different levels of weirdness.

1. A simple popup. Nothing has been done, but they want you to think it has.
Call them, and then the stupidness ensues

2. The system HAS actually been infected, but nothing is actually encrypted yet.
This is where the owners backup comes into play.

3. The files on the system are actually encrypted, and can only be undone by paying them.
Again, a viable backup.

Some variants of this encryption can be undone. but some cannot. The files are encrypted and unsable, unless you pay them.

 

[Kevinwza]

Sadly , I think we have to go with the third option . According to him his files are all now ending with a cyrpt extension.

 

[ss202sl]

Paying them isn't a sure thing. Restoring from backup is.

 

[Kevinwza]

Paying them isn't a sure thing. Restoring from backup is.

I don't think he has backups ...

 

[USAFRet]

Paying them isn't a sure thing. Restoring from backup is.

I don't think he has backups ...

So what critical data is on this laptop?
OS and applications are replaceable.

 

[Solandri]

He says McAfee has identified it as randsom-exxroute~txt .

Supposedly, this is one of the more poorly written pieces of ransomware, and the encryption can be broken.

http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Ransom:Win32/Exxroute.A

https://blog.kaspersky.com/cryptxxx-ransomware/11939/

 

[123andrew]

I think such attacks are easy to prevent rather then removing it because once the files are hacked there is no solution to get them back through any security software. So it is better to install antivirus before so that it will block such viruses from infecting.