Posted: 7/29/2015 1:24:30 PM EDT
| Is there anyway to decrypt the files? Yes we have backups but someone decided to keep files in an unbacked up location even though we warn them every time they log in. I have searched but can't find anything but figured I would ask just in case. |
| Depends on what iteration of the infection you have. Some of the C&C servers for early variations were ceased and the private keys extracted. Newer variants it's not possible at all without the private key. Either case should be handled by a professional, your user is basically boned. |
|
Quoted: Could someone explain to those of us who are ignorant, but interested, just what the fuck is going on here?
Thanks. One of OP's users didn't backup their files. Then their PC got hijacked, and all of the files are either encrypted, or scrambled. The hijackers are demanding a ransom to provide a key to decrypt the files, which may or may not work. |
|
Quoted:
One of OP's users didn't backup their files. Then their PC got hijacked, and all of the files are either encrypted, or scrambled. The hijackers are demanding a ransom to provide a key to decrypt the files, which may or may not work. Quoted:
Quoted: Could someone explain to those of us who are ignorant, but interested, just what the fuck is going on here?
Thanks. One of OP's users didn't backup their files. Then their PC got hijacked, and all of the files are either encrypted, or scrambled. The hijackers are demanding a ransom to provide a key to decrypt the files, which may or may not work. How can the hijackers know the key? Sorry to be so dense. |
|
Quoted:
Depends on what iteration of the infection you have. Some of the C&C servers for early variations were ceased and the private keys extracted. Newer variants it's not possible at all without the private key. Either case should be handled by a professional, your user is basically boned. version 3.0 |
|
Quoted:
version 3.0 Quoted:
Quoted:
Depends on what iteration of the infection you have. Some of the C&C servers for early variations were ceased and the private keys extracted. Newer variants it's not possible at all without the private key. Either case should be handled by a professional, your user is basically boned. version 3.0 You're fucked. Tell the user that they should have listened to you, and that this is all their fault and you'll be contacting their supervisor. |
|
If this ticket is resolved, please fill out the quality survey.
http://questionpro.com/t/ALhoWZStmB |