new crypto locker makes its victims spread the virus

Use a program like Shadow Explorer or Torrent Unlocker to try to restore your files. Still an option if you have very important files you wish to save, and no backups. At least one confirmed case of decryption after payment, but do not take it as a 100% guarantee. Once Windows is reinstalled, restore your manual backup. This is a surefire way to get rid of the trojan. Reformat your hard drive and reinstall Windows. Use an anti-malware software such as Malwarebytes to attempt to remove the ransomware. Unfortunately, in a similar line to most Cryptoblocker ransomware, there is no surefire way of being able to remove the infection and reverse the encryption effect. I will continue monitoring the situation. Removing the infection does not decrypt the files though.

Update: As anti-malware software updates, it might be possible to remove the infection using something like Malwarebytes. This makes it incredibly difficult to remove it or roll back to solve the issue. The ransomware is also known to disable certain system features like system restore, delete shadow copies, and prevent the uninstalling of software. The program will then pop up informing the user they have 72 hours to make a 0.1BTC payment to save their files. A service called ldr.exe and a program called rkcl.exe will run promptly at midnight, which will encrypt the files and lock them.

It is not known if it's configured to only trigger on 25/5 yet. It first activated at 25/5, midnight by the local clock. As it stands, there seem to be trends in users of Chrome, TeamExtreme cracked Minecraft, and sports streaming sites, although none have been truly confirmed. The virus is known to be on a fuse, so any file downloaded within the past week/month could be a likely culprit. It is a ransomware that encrypts picture and Microsoft Office files, although it does not cover all extensions (for example. The Locker virus version X.XX (it takes on a random number with 2 decimal places) is represented in this picture ( ). Update: Most detailed description and analysis on this forum ( )

New crypto locker makes its victims spread the virus