What to do if you see this screen on you computer !
- Disconnect Power from the Computer IMMEDIATELY
If it’s mains pull the plug, if its a laptop hold down the power until it shuts off - Disconnect from the internet (simply unplug your router from Phone line and power)
- Shut down any other PC’s (including Macs) in the premises
- Call Us – 0844 504 2986
Do this immediately and do not turn anything back on until you have spoken to us!
Why ??
You have Cryptolocker Malware, and it is busy irreversibly locking your documents, photo’s etc (the only way you might, – and we mean might, – get any data back is to pay a ransom of around €300 (nearly £300) in Bitcoin within 72 hours – we recommend you do not go there!)
What Is CryptoLocker ?
(info drawn for various websites and our own experience)
CryptoLocker is a piece of malware targeting computers running the Microsoft Windows operating system. It is typically spread as an email attachment, often purporting to be from a legitimate source (including Intuit and Companies House). Some say it is also being spread through the ZeuS botnet.
Once installed on your computer, it systematically encrypts all documents that are stored on your local computer, as well as ones that are stored on mapped network drives and mounted removable storage .(this includes USB drives and drives on connected computers – inc Macs)
“The encryption used is strong, 2048 bit RSA, with the decryption key for your files being stored on a remote server. The odds of you being able to break this encryption is almost nonexistent. If you want to get your files back, CryptoLocker asks for you to fork over some cash; either twobitcoins (At the time of writing, worth almost USD $380) or $300 in either MonkeyPak or Ukash prepaid cards. If you don’t pay within three days, the decryption key is deleted and you lose access to your files forever.”
The best “in detail” article we have found is here:
http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information
##########################
In contrast, CryptoLocker is very easy to deal with IF you are making frequent backups. Here is what you must do NOW to prevent future CryptoLocker problems:
- Make sure you are making frequent backups, starting NOW, before your computer becomes infected with the “CryptoLocker” problem. Everyone should do that all the time anyway. Ideally, you should be using some backup program that automatically makes backups every few hours. Only use a backup program that saves ALL VERSIONS of all files. Not all backup programs do that. There are a dozen or more such programs to choose from.
- When you get the CryptoLocker problem, please call us first! you can (in theory) use most up-to-date anti-virus program to delete it. Almost all of today’s Windows anti-virus programs will do that but they
probablywill not restore access to your files! - Restore those files from your most recent backup. You will be back in business.
Of course, if you don’t make frequent backups before CryptoLocker strikes, you will have problems. Big problems.
########################
From Wikepedia:
In December 2013, ZDNet traced four Bitcoin addresses posted by users who had been infected by CryptoLocker, in an attempt to gauge the operators’ earnings. The four addresses showed movement of 41,928 BTC between October 15 and December 18, a value of about $27,000,000 USD per the exchange rate at that point in time.
A survey by researchers at the University of Kent found that 41% of UK respondents who were Cryptolocker victims claimed to have agreed to pay the ransom, a figure much larger than expected; 3% had been conjectured by Symantec, and 0.4% by Dell SecureWorks.The average amount per infection in the U.S. is $300.
######################
This article is unfinshed but as we have just had a second instance of this within 24 hours I am posting it first and finalising it later