Cryptolocker is a terrible virus, much worse than that of the Postal Police, which affects Windows computers all over the world. When affected by this malware, all personal files, including documents and photos, are encrypted with a secret key and therefore made inaccessible to the user.
Even by removing the virus (see here the guide to remove viruses that take your PC hostage ), which is not difficult, the files are still protected from reading and therefore not visible.
The only way to get out of it and regain access to these files is by paying a ransom to the hackers behind Cryptolocker to get the decryption key.
The worst thing is that, apparently (I have not had, fortunately, direct experience), you only have 72 hours to make the payment, after which the files are lost forever.
The Ransomware malware, which infects computers through fake and apparently innocent emails, has been around for almost a year and only recently, thanks to the work of two companies in cyber security, there is a free online service that can help to recover files encrypted by malware.
First of all, in this video you can see how you get infected with a Ransomware file and, above all, how easy it is to spread.
It is not clear how many systems have been infected with CryptoLocker to date, but the number is estimated to be around a million.
Of these victims only 1.3% of the victims would have paid the ransom with CryptoLocker, while the rest have lost their data forever.
To learn more about how to remove Cryptolocker and what it does on a computer, including the payment process required to unlock the files, you can read the Bleeping Computer website.
Of this type of malware we can remember the famous postal police virus or those who pretend to be antivirus and who, in order to continue using the computer, ask for a sum of money in return.
Fortunately, to prevent this type of problem it should be enough to have an updated antivirus (also Windows Defender), perhaps on a Windows 10 PC, which should block the entry of the virus before it can cause damage.
For security and further protection we then saw:
- Free Anti Ransomware programs to protect your computer
- block execution of programs in protected areas of Windows (against ransomware and viruses) .
Below we see what tools we can use to recover files blocked and encrypted by the Ransomware virus without having to pay the ransom .
1) Kaspersky has made available a program called Ransomware Decryptor that allows you to decrypt and recover files blocked by Coinvault and BitCryptor malware .
2) To know at least which files are hidden and encrypted by Cryptolocker, you can use a free program called Cryptolocker scan tool which finds the encrypted files and presents them in a list on a CSV file.
It cannot decrypt them, but at least it is possible to know what actually disappeared from the computer in order to eventually restore these files from a backup.
3) Nomoreransom is a site that allows you to ask for help in decrypting files taken hostage by the virus without paying.
The site, always updated on the latest threats and with indications on the tools to recover data blocked by ransom viruses, was born from the collaboration between the High Tech Crime Unit of the Netherlands police, the European Cybercrime Center (Europol) and two computer security company, Kaspersky Lab and Intel Security.
the decriptors page collects the decryption tools for some of the best known Ransomware.
Decryptor programs include those for TeslaCrypt, Coinvault, Bitcryptor, RCryptXXX, Chimera, Shade and eltri viruses.
The CRyptoSheriff service, on the other hand, allows you to know which type of Ransomware has affected the PC.
4) The ID Ransomware site provides a free space to upload the virus file, with the warning and the redemption or to upload one of the files that have been encrypted to try to decrypt them.
5) Avast Decryption tool is a set of tools that serve to free encrypted files from some of the most well-known Ransomware viruses, including Alcatraz Locker, Apocalypse, BadBlock, Bart, Crypt888, CrySiS, Globe, Legion, NoobCrypt, SZFLocker and TeslaCrypt.
6) On the 360 Ransomware Decryption Tool it can decrypt and unlock files blocked by over 80 ransomware including GandCrab, Petya, Gryphon, GoldenEye and WannaCry.
The 360 Security decryption tool therefore offers the possibility to recover files without having to pay the ransom.
7) Emsisoft in 2016 released an unlocker to recover files encrypted by HydraCrypt and UmbreCrypt viruses .
8) TeslaDecoder is the definitive program to decrypt files if the PC has been hit by Teslacrypt ransomware which can be said to be now completely defeated.
9) Trendmicro also has its own set of tools to try to free the files blocked by ransomware and eliminate the ransom demand screen.
