Cryptolocker Ransomware Removal Instructions

Tips to Remove Cryptolocker Ransomware

Cryptolocker is a malware that made its first appearance on 5th September 2013 & continued its attack to late May 2014. This malign Cryptolocker Ransomware gained notoriety over the past few years for stealthily infecting a system & encrypting the files.

According to the detailed research by the security analyst, the Cryptolocker Ransomware attack utilized a Trojan that fired at the computers running on Microsoft Windows & was reported to have been published on the internet on 5th Sep’2013. It used corrupted e-mail attachments & an existing botnet named Gameover ZeuS to spread & proliferate. Upon execution, the Cryptolocker virus encrypted certain types of files stored on local & mounted network drives by using public-key cryptography. The private key for decrypting the data was stored only on the malware’s control servers.

Following the encryption of the files, the Cryptolocker Trojan called forth a message offering the victim to pay a certain amount (in bitcoin or a pre-paid cash voucher) within a stated deadline in order to decrypt the data. The message was further followed by a threat of the permanent deletion of data & private key in case the deadline passes.

Surprisingly, the treacherous malware operators offered to decrypt files & data through an online service for a considerably higher amount in bitcoin if the deadline was not met. However, the message made no suggestion about the release of encrypted content after the payment was made.

Operation Tovar: Segregation of Cryptolocker Trojan

Though Cryptolocker Trojan removal was done easily, the infected files remained encrypted & researchers found it pretty much inconvenient to decrypt.

In the late May 2014, Operation Tovar, an international collaborative operation was carried out that extirpate Gameover ZeuS botnet, which was used by the cybercriminals to distribute malware. The operation also enabled a security firm involved to acquire the database of private keys used by Cryptolocker Ransomware. Thankfully, the security firm was able to build an online tool to recover the keys & encrypted files without paying the ransom.

Though, Operation Tovar was able to put an end to Cryptolocker Trojan attack, this malicious virus paved a way for a new generation of other sophisticated & precarious cyber threats.

Cryptolocker Ransomware -Threat Behavior

Cryptolocker Ransomware that infected Microsoft Windows ranks among one of the first Ransomware Trojan. It infected over 500,000 PCs from September 2013 to May 2014. Though the virus was brought down by US authorities in late May 2014, Cryptolocker successfully spawned a few clones named CryptoWall, Crypt0L0cker & TorrentLocker.

A ZIP file for Cryptolocker attached to an e-mail arrives on the targeted system disguised as a PDF file. The Virus smartly takes the advantage of Window’s default behavior of hiding the extension from the file names.

Upon execution it creates the following file on the compromised computer:

%UserProfile%\Application Data\[RANDOM CHARACTERS].exe.

Once the executable file has been created, it creates the following registry entry to prompt its initiation every time the Windows start: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\”addon_v57″ = “%UserProfile%\Application Data\[RANDOM CHARACTERS].exe

Following the infection of the system, the Cryptolocker virus thoroughly searches the network, looking for files & data to encrypt. Cryptolocker uses an obnoxious method of encryption (RSA-2048 public-key cryptography) that is quite arduous to crack.

The files targeted by the Ransomware include .doc, .docx, .docm, .wps, .xls, .xlsx, .xlsb, .ppt, .pptx, .mef, .nef, .raw, .rwl, .ptx, .pem, .pfx etc.

Each encrypted file was appended with the string: .mp3

Read More:- Click here