help with Locky virus

ethan · 7 Jun 2016 at 15:11

Have run spyhunter. Can anybody advise on next step to gain access to encrypted data. Thanks

tom_e · 7 Jun 2016 at 15:13

Without the encryption key I'm going to guess it's basically impossible and time to write the data off and break out your backups.

Glanza · 7 Jun 2016 at 15:22

tom_e said:
Without the encryption key I'm going to guess it's basically impossible and time to write the data off and break out your backups.

Pretty much this, once you've got it not much you can do unless your on the lucky list of keys that the FBI? released.

slick rick · 7 Jun 2016 at 15:26

Is it Locky or AutoLocky? If its AutoLocky I think there is a decryption tool available.

Orcvader · 7 Jun 2016 at 15:58

slick rick said:
Is it Locky or AutoLocky? If its AutoLocky I think there is a decryption tool available.

This, AutoLocky is a fake version of Locky and actually has flaws which allows it to be decrypted: https://decrypter.emsisoft.com/autolocky

But if it's the actual Locky ransomware, you're stuck. I had this hit two clients and couldn't retrieve the files back, so had to reformat the infected systems.

bledd · 7 Jun 2016 at 16:31

Where did you get it from?

ethan · 7 Jun 2016 at 18:17

I believe it was from an email.

ethan · 7 Jun 2016 at 18:30

Showing my ignorance here but on one of the locked files I right clicked the tab for restore previous version only to be greeted by there being no previous version. I'm assuming that once Spy hunter has completed its scan and removed locky, the correct procedure would be to restore to a previous restore point. Would there still be a restore point available prior to infection where those files would be unencrypted? I'm guessing here but I'm assuming there won't be.

Zefan · 7 Jun 2016 at 18:34

Rolling back to a restore point won't restore everything, only system files and settings.

Restore points will often also be infected by malware, so aren't the best option.

asim18 · 7 Jun 2016 at 18:44

ethan said:
Showing my ignorance here but on one of the locked files I right clicked the tab for restore previous version only to be greeted by there being no previous version. I'm assuming that once Spy hunter has completed its scan and removed locky, the correct procedure would be to restore to a previous restore point. Would there still be a restore point available prior to infection where those files would be unencrypted? I'm guessing here but I'm assuming there won't be.

Locky will delete shadow copies.

haveaniceday · 7 Jun 2016 at 19:07

Locky is Ransomware if it is Locky it will give you a price to release the files

ethan · 7 Jun 2016 at 20:53

Shadow copies not there

It appears only to have targeted the pdf's so far; each saying locky). After the scan Spyhunter also appears to request a payment of £26.00 to apply the fix. I haven't got a clue what the IT guy is doing as I was kept out of the loop. Office workers with a talent for opening everything that is emailed are a complete disaster. Anyway, on my PC I've installed the free Bitdefender anti ransom app as a precaution.

opethdisciple · 7 Jun 2016 at 23:32

ethan said:
Shadow copies not there It appears only to have targeted the pdf's so far; each saying locky). After the scan Spyhunter also appears to request a payment of £26.00 to apply the fix. I haven't got a clue what the IT guy is doing as I was kept out of the loop. Office workers with a talent for opening everything that is emailed are a complete disaster. Anyway, on my PC I've installed the free Bitdefender anti ransom app as a precaution.

Could you imagine we reach a point where we are all running dedicated anti-ransomeware software.

ethan · 8 Jun 2016 at 00:45

opethdisciple said:
Could you imagine we reach a point where we are all running dedicated anti-ransomeware software.

For a price

I have an excuse, my eyes start to blur around 2:30 early morning and I an't be sure what I'm clicking.

Glanza · 8 Jun 2016 at 16:41

If it's the proper locky Spyhunter will do nothing.

ethan · 8 Jun 2016 at 20:26

Glanza said:
If it's the proper locky Spyhunter will do nothing.

What will shift it then? I already mentioned I installed the Antiransom ware app from Bit defender as a precaution. This was in p art due to me reading it nicks your email friends lists and then proliferates by sending out emails pretending to be from people you know.

Orcvader · 8 Jun 2016 at 20:43

Your best bet is to nuke the drive with DBAN and do a fresh install of Windows.

Luckily, it affects only the PC, and nothing on the network.

BuToNz · 8 Jun 2016 at 22:12

Orcvader said:
Luckily, it affects only the PC, and nothing on the network.

Not true, if there are any mapped drives it'll go through those as well and encrypt anything it has permission to do so.

Spooter · 8 Jun 2016 at 22:23

Details here.

McAfee Labs Threat Advisory Ransomware-Locky

Rroff · 8 Jun 2016 at 22:28

Orcvader said:
Your best bet is to nuke the drive with DBAN and do a fresh install of Windows.

Luckily, it affects only the PC, and nothing on the network.

Probably not the case with locky (though it could have been deployed as the payload of other malware) but there are increasingly variants out there or bundled malware which will attempt to infect the network before then infecting/triggering the cryptolocker stuff. So its a good idea to mount any backups with read only or recover from a copy taken of the backups elsewhere, etc.