Question about CryptoWallencryption ransom virus

Post » Sat Jul 04, 2015 4:09 pm

Working on someone's computer. It was a mess. It was running at 100% cpu constantly... super bad. But I did lots of scans with different tools and cleaned it up.

The problem is that all the documents (.txt, .docx, .xlsx .jpg, basically everything but shortcuts) had a strange file extension when it arrived... All the documents end in .dpkwdwf... like "IMG_1915.JPG.dpkwdwf" or "resume.DOC.dpkwdwf."

I finally discovered this was due to a CryptoWall virus (or whatever the technical term is) and they encrypted all the files for ransom.

So, what do I do now? I'm guessing nobody's found a way to decrypt the files without paying the ransom? As I said, I cleaned the computer as best as I know how... is that virus still active (maybe hidden) somewhere, or would you think that it's safe now?

User avatar
Matt Bigelow
 
Posts: 3350
Joined: Sun Sep 30, 2007 6:36 pm

Post » Sat Jul 04, 2015 10:30 am

At work they deleted and restored data from backup.
I believe most would recommend a drive wipe before trusting any data on the drive.
User avatar
JUDY FIGHTS
 
Posts: 3420
Joined: Fri Jun 23, 2006 4:25 am

Post » Sat Jul 04, 2015 3:47 am

Thanks for the input. That's kinda where I was leaning too. Decided to ask before I did anything drastic.

User avatar
StunnaLiike FiiFii
 
Posts: 3373
Joined: Tue Oct 31, 2006 2:30 am

Post » Sat Jul 04, 2015 11:20 am

The best thing to do is wipe the Hard Drive

User avatar
StunnaLiike FiiFii
 
Posts: 3373
Joined: Tue Oct 31, 2006 2:30 am


Return to Othor Games