Decryption Tools for Ransomware

from JoeUser Forums

 

The Windows Club has published a pretty extensive list of tools to help you if you get zapped. First of all, it’ll probably be Petya or Locky as they’re the most common ones encountered currently. First you have to identify the malware. You upload the ransom note or a file which has been encrypted by the malware (and hope it identifies the malware) here: https://id-ransomware.malwarehunterteam.com/index.php

There’s a great list of the tools here: http://www.thewindowsclub.com/list-ransomware-decryptor-tools and each tool is specific to the malware identified, so…step one is very important.

There are also several intrusion detection tools, but according to the Windows Club, WinPatrol is free and probably the best. You can read about it at the linked url.

There are also free anti-Ransomware tools. I've written about one, but there are several, and you can read about (and get links to them) here: http://www.thewindowsclub.com/free-anti-ransomware-tools 

Probably another article to read to help you get organized about what you should do if you get attacked is located here: http://www.thewindowsclub.com/what-to-do-after-ransomware-attack

The most important thing to is have recent backups, so don't be lazy: Make one now. The only backup you'll ever regret making is the one you didn't make.

Hope this helps in case you get hit. I’ve bookmarked the links above…and you might consider doing the same.

Have a great weekend!

Sources:

http://www.thewindowsclub.com/list-ransomware-decryptor-tools 

https://www.winpatrol.com/ 

http://www.thewindowsclub.com/free-anti-ransomware-tools

 

 

 

 

186,834 views 35 replies +1 Loading…
Reply #1 from JoeUser Forums Top

Doc -

I bought the 5-PC license for WinAntiRansomPlus and I'm running it alongside BitDefender AntiRansomware and MWB AntiRansomware.  So far, they seem to be playing nice together.

BitDefender goes about its business quietly without notifications but it may have blocked Locky on two of my rigs.  I happened to spot an obsolete software key on each when running the CCleaner Registry cleaner yesterday: HKCU\Software\Locky.  Which means I'm 'lucky' to have paid attention to your posts here.

So you know you may have saved at least one poor soul some misery.  For that, I say "Thanks!"

 

Addendum:  That 'obsolete' software key keeps getting rewritten to the registry after being deleted.  Not immediately, but it shows up again if I run CCleaner an hour or two after deleting it.

Got some work to do.

Reply #2 from WinCustomize Forums Top

If I helped, I'm truly happy Daiwa. Are you sure that registry key isn't being written by one of your AR program updates (I assume they update daily...and maybe stuff is hanging around in memory and getting rewritten?). 

If I were you, I would definitely be asking the AR makers about this and making a post about it in MWB's Forum...and maybe WARPs as well...

TouchTasks - Access tasks with ease on Windows touchscreens.
Reply #3 from JoeUser Forums Top

McAfee's site says the presence of that specific reg key is indicative of infection, but so far no harm.  I'll keep this thread updated.

Reply #4 from WinCustomize Forums Top

After reading Daiwa's reply #1 I decided to run CCleaner's registry cleaner and found the same obsolete reg key, HKCU\Locky. When I clicked on fix issues a window opened and said the key is left behind after uninstalling software. The only ones I uninstalled was CCleaner and BitDefender Anti-Ransomeware to update to the latest versions.

Reply #5 from JoeUser Forums Top

Interesting, Uvah.  I'm talking to my tech guy this morning on this issue.  My first suspicion was that BitDefender had blocked a Locky attempt and that a harmless reg key was left behind.  Now not so sure.  I'll post back.

Reply #6 from JoeUser Forums Top

After a lengthy session with my tech guy, it appears probable that the reg key in question is actually being written by one of the antiransomware apps, most likely BitDefender Antiransomware, for reasons unclear.  We actually found a set of two related keys in 6 different locations in the reg - CCleaner only found 1 set flagged as 'obsolete'.  It may be part of a strategy to 'immunize' against Locky.

One more little experiment to conduct before I can be sure.  More to follow.

Reply #7 from WinCustomize Forums Top

Locations please.

Reply #8 from WinCustomize Forums Top

Daiwa...I guessed correctly (response #2). ;) . Glad about that!

Reply #9 from JoeUser Forums Top

Quoting DrJBHL, reply 8

Daiwa...I guessed correctly (response #2). ;) . Glad about that!
End of DrJBHL's quote

You were close, Doc.  4* Not just on program update, but within an hour of the keys being deleted.

Reply #10 from JoeUser Forums Top

I'd love to give you the locations, Uvah, but I wasn't watching real-time as he did the reg search.  All you need to do is search in regedit for Locky & delete all found keys.

Reply #11 from GalCiv3 Forums Top

Thank you!

Reply #12 from WinCustomize Forums Top

@Daiwa...thanks, I will.

Reply #13 from JoeUser Forums Top

There was a second key in the same section as each Locky key, gibberish alphanumeric name starting with 7ou, that CCleaner had also flagged as obsolete.  It, too, kept getting rewritten to the reg, so we nuked all those, too.

Reply #14 from JoeUser Forums Top

I can report that 18 hours after deleting all found Locky keys and all the 7ou... keys, they remain gone on both rigs.  Interesting that CCleaner only picked up one set of the keys as obsolete when there were multiple sets.  The only protectionware difference between the two rigs is one runs BitDefender AV, the other Avast Pro AV.  Both run MWB, MWB Anti-exploit and BD Antiransomware.  And they are now both running WinPatrol WinAntiRansomwarePlus.  Still not sure where those Locky keys came from.

Reply #15 from JoeUser Forums Top

Additional info today.

Avast Pro blocked the Locky trojan in several emails this morning - first time I'd seen a popup indicating so, but I assume there were others that I missed in the past.  This happened with active scanning of the inbound emails before they reached my inbox.

Found 4 instances of the Locky & 7ouHlW14R0XZ0x keys in the reg, all empty, suggesting that the trojan is able to get that far before Avast blocks it.

BitDefender on the other machine doesn't show popups, just does its biz in the background so it appears to be effectively blocking Locky as well.

Reply #16 from WinCustomize Forums Top

Just ran CCleaner registry again and Locky was back along with another obsolete reg key, 4T54zly5. I don't know if it has anything to do with Locky though. Did a quick search in the registry but didn't find any more. Would help if I knew where else to look. HKEY_CURRENT USER_SOFTWARE and...

Reply #17 from JoeUser Forums Top

Did you see that alphanumeric key in the same section as the Locky key?  If so, it's likely a companion key, especially if it's empty.  I ran my searches on the entire registry.  It's looking like if all we have is the reg keys, we're OK.  Risk of ransomware attack would seem to be low if good AV is running.

Reply #18 from WinCustomize Forums Top

Has either of you looked up the topic in the anti-ransomware forums of each program?

 

Reply #19 from JoeUser Forums Top

Yes.

Nothing in the way of this detail on the Avast forums, though ransomware in general discussed.

This BD-related thread mentions the Locky reg key and suggests it prevents Locky infection.

Still not clear what's going on, but based on the email hits Avast is blocking, Locky is getting around.

Edit:  Indeed, just launched Outlook again & Avast blocked another email with Locky.

Reply #20 from JoeUser Forums Top

It's a gmail-hosted address that is bearing the Locky traffic.  May have to get them involved.

Reply #21 from WinCustomize Forums Top

According to post #13 Minimalist suggested not removing the reg keys. I ran CCleaner again but found nothing.

Reply #22 from JoeUser Forums Top

My tech guy suspected that, too, at first but he would have expected the antiransomware to lock down permissions for those keys as a way to block access to them & it didn't.  I'm inclined to leave the keys alone if/when they show up again, but the guys making this stuff keep massaging it to avoid AV detection so who knows?

Reply #23 from GalCiv3 Forums Top

What's ransomewhare.

Reply #25 from GalCiv3 Forums Top

Some ransomeware lock up the internet if they do just clear your history and exit out of the internet. This seems to work.