For some time now, malware authors and attackers buying licenses for use of their programs on the black market have been making a killing off of file recovery ransom schemes. \u00a0The most widespread of these was the “Windows File Recovery” style rogues that hit a couple of years ago, where a rogue recovery program named something of the sort would appear on an infected system in an attempt to convince the user that they had lost all of their data due to some catastrophic event (i.e., a hard disk failure) and that they would need to pay to have those files retrieved. \u00a0More recently, these were followed up by the still-rampant FBI Moneypak Trojans, which display a message at Windows startup explaining that the FBI has locked the PC due to its use for illegal activities and that the user will need to pay $300 via Moneypak to have it unlocked.<\/p>\n
None of these initial attempts were very difficult to thwart unless the user or technician was completely unfamiliar with them. \u00a0The Windows Recovery rogues simply hid<\/em> the files, which could easily be un<\/em>hidden following their removal. \u00a0The most sinister thing they ever did was moved the user’s shortcuts to a hidden temporary folder. \u00a0The FBI Moneypak is a cinch to kill once you know of its loading points (though it does often come bundled with the ZeroAccess rootkit). \u00a0Some of the later iterations of these ransom rogues took this a step further by actually encrypting the user’s data, but even these could be beaten with special decryption tools. \u00a0Eventually, they were assigned the title of Ransomware, which technically could be used to classify any of these specimens.<\/p>\n In case you haven’t heard, there’s a new form of this malware, however, and it’s much, much nastier. \u00a0It’s called CryptoLocker, and it also encrypts the user’s data\u2014but it does so using a fusion of AES and RSA encryption that is literally impossible to reverse without the possession of a private key. \u00a0That private key resides on a remote server that is only accessible once the user actually pays to have the decryption performed (and it doesn’t always work, either). \u00a0By the time the user knows they’ve been infected, all of their precious data has usually already been encrypted. \u00a0Needless to say, this is disastrous, especially for businesses.<\/p>\n Over the course of the past few weeks, I’ve had two different customers with this infection. \u00a0While it’s true that there is no possible way to decrypt the data, fortunately, there are still ways to recover some or even all of the data (albeit, slightly older versions of the files) if you know just one simple trick.<\/p>\n Windows Vista and beyond include a little-known feature called Volume Shadow Copy<\/strong>. \u00a0It’s closely-related to System Restore, of which many people are familiar already, but most people are not aware of the fact that Volume Shadow Copy (unlike System Restore) actually includes management of versioned snapshots<\/strong> of the user’s data as well.<\/p>\n This is a valuable tool in data recovery, of course, provided the system is bootable and the Volume Shadow Copy functionality is accessible\/unbroken. \u00a0But it also happens to work with current versions of the CryptoLocker Trojan.<\/p>\n Here’s the process you’d need to follow:<\/p>\n If you need help locating all of the files which were encrypted, you can download ListCrilock<\/a> from Grinler, which is a tool that lists the contents of the\u00a0HKEY_CURRENT_USER\\Software\\CryptoLocker\\Files<\/strong> registry key (the location CryptoLocker records the files it has encrypted).<\/p>\n While this is a very fortunate oversight by the authors of the malware, I wouldn’t expect it to last. \u00a0All that would need to be added is a quick routine to clear all restore points or the contents of the System Volume Information folder to prevent this recovery from taking place, and the authors know this\u2014something which is probably in the works already as this solution has begun to spread throughout the security communities. \u00a0Ultimately, what this should do is remind everyone of the importance of regular (preferably versioned) backups offsite or to a drive which is disconnected in between backups<\/em> (to prevent the files from being encrypted upon the next connection).<\/p>\n Thanks to Grinler for much of the information used to assemble this post<\/a>, for his excellent tool, and for running a terrific website in the process.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" For some time now, malware authors and attackers buying licenses for use of their programs on the black market have been making a killing off of file recovery ransom schemes. \u00a0The most widespread of these was the “Windows File Recovery” … Continue reading \n
\n