Security researchers from Emsisoft have discovered a new ransomware they have dubbed CryptoLocker, or Trojan:Win32/Crilock. This ransomware is designed to encrypt almost all files on an infected device and decrypt them when a ransom is paid by the victim.
The files that CryptoLocker targets and encrypts are many: odt, doc, docx, xls, xlsx, ppt, pptx, mdb, accdb, rtf, mdf, dbf, psd, pdd, jpg, srf, sr2 ,bay ,crw, dcr, kdc, erf, mef, mrw, nef, nrw, raf, raw, rwl, rw2, ptx, pef, srw, x3f, der, cer, crt, pem, and p12.
According to experts, the ransomware is distributed via emails that have the subject line (for now, because this could change) of customer complaints. The attachment that comes with the malicious email is a downloader that will download the malware.
Once it infects a device, CryptoLocker creates a registry entry to ensure that it runs after every reboot. It then establishes communication with the server it uses as a command and control (C&C) center. All communications are encrypted with RSA.
“Using RSA encryption for communication not only allows the attacker to hide the actual conversations between the malware and the server, but also makes it virtually invisible to malware researchers,” Emsisoft.
Finally, CryptoLocker searches for all of the above files and begins encrypting them using AES . Unfortunately, they are impossible to decrypt without the AES key, which is stored on the C&C server and accessible only by the attacker.
If you are attacked by any Ransomware, do not give in to its blackmail. Ask a friend who is more knowledgeable about computers for help.
See the instructions we published previously
Currently, many computers have been infected with a ransomware that blocks the user's computer and demands a ransom for its release. This virus is also known as the Metropolitan Police scam.The information appears on the user's browser homepage from the Greek Police and states that the user has committed illegal actions and will have to pay a fine. This message is fake and does not come from the Greek Police in any way but is part of an attempt to deceive users into extorting money. Simply follow the steps below to deal with it in order to restore your computer to its original state.
Removal of Metropolitan Police Virus Malware1. Restart your computer in Safe Mode with Command Prompt. While your computer is booting, press and F8 until the Windows Advanced Options Menu as shown below. Use the arrow keys to move to Safe Mode with Command Prompt and press Enter. Log in with the same username that you used to log in to the regular Windows environment.
2. When Windows loads, the Windows command prompt will appear as shown below. Type explorer and press Enter. Windows Explorer will open. Do not close it.
3. Then open the Registry editor using the Windows command prompt. Type regedit and press Enter. The Registry Editor opens.
4. Locate the following entry in the registry:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
On the right, select the registry key named Shell. Right-click on it and click Modify.
Its initial value is Explorer.exe.
The value “tampered” by the virus points to the virus executable.
Copy the executable location to a Notepad text file and change the value data to Explorer.exe. Click OK to save the changes and exit the Registry editor.
5. Remove the malicious file. Locate the location of the executable you noted earlier where it is stored. There should be a movie.exe file there.
Full location: C:\Documents and Settings\Michael\Desktop\movie.exe
Return to Windows Normal Mode . To restart your system from a command prompt, type shutdown /r /t 0 and press Enter .
6. Download the recommended anti-malware software (Spyware Doctor) or GridinSoft Trojan Killer https://trojan-killer.net/download.php and run a full system scan to remove any virus remnants from your computer. That's it!
