I come home from the office tonight, my PC has rebooted to login screen. I figured it had installed an update. Logged on normally.

However, poking around I see all these tagged with file extension [payday@cryptmaster.info] It appears as though all files on this PC, including backup volumes have been encrypted also.

I sent email to the cocksuckers for instructions. Does anybody know clean, safe means for decrypting the files?

Damn, I feel violated. They've destroyed years worth of family pics, writings, scores, etc.

We just hired a consulting company out of California to help us at my place of work.
It was about $45,000 in the criminal currency BitCoin.

I know those with knowledge will chime in.

But for me, when ever I hear about these low life cretins' activities, all I can thing of is judiciously used det-cord and plastique as payback!

Yeah, nothing would give me more pleasure. But, who and where is the target?

quote:

Originally posted by mjlennon:
Yeah, nothing would give me more pleasure. But, who and where is the target?

Definitely a problem but I've often wondered if some of the better reformed hackers who know their way around the Dark Web couldn't unmask these asshats' email addys.

Personally if I came home and found my computer in that state.. I'd simply wipe and reload the OS.
Any files that I'm concerned about keeping I have staged on multiple machines and/or in the cloud.

It would merely be an annoyance of a couple hours while i re-install.

quote:

Originally posted by creslin:
Personally if I came home and found my computer in that state.. I'd simply wipe and reload the OS.
Any files that I'm concerned about keeping I have staged on multiple machines and/or in the cloud.

It would merely be an annoyance of a couple hours while i re-install.

This. 100% this.

Without the key used to encrypt the files you job will be close to impossible. There are a few companies out there that have free decryption tools for existing ransomware. Unfortunately there is new flavor of the shit coming out on an almost daily basis.

Trend Micro
Kapersky
Avast

A more complete list

I did a google search on the file extension that you mentioned in your post (payday@cryptmaster.info) and it didn't pull up much

FYI, paying the ransom is no guarantee that you will get your files back.

quote:

How to deal with ransomware

Prevention and isolated backups are the only answers.
As an IT guy nothing scares the shit out me more than this.
No coming back from it and almost no chance even if you pay.
Hence, the only answer is to "air-gap" your backups.
Anti-Virus is usually too late but can help in some cases but don't rely on ANY AV program for security.
Online is helpful but isolated copies is the only true savior.
Unfortunately, many of my clients do not share the same fear.
I have had a couple clients get hit and one got hit twice even after I made unused recommendations.
Luckily, he had an online backup that was fairly current.
Oh, and up to these ransomware viruses I have never had one single computer that I could not fully clean of a virus/malware.
This is a new ball game.
It is some bad shit.

longshot, but one friend got this shit & all I had to do was change the file extension back to .jpeg/.mp3/etc to fix the file(s). It wasn't really encrypted, just the extension was changed. 90% of people wouldn't know the difference.

this was quite a while ago, before this shit was popular - but it's at least worth a shot.

quote:

Originally posted by Bytes:
Without the key used to encrypt the files you job will be close to impossible. There are a few companies out there that have free decryption tools for existing ransomware. Unfortunately there is new flavor of the shit coming out on an almost daily basis.

Trend Micro
Kapersky
Avast

A more complete list

I did a google search on the file extension that you mentioned in your post (payday@cryptmaster.info) and it didn't pull up much

FYI, paying the ransom is no guarantee that you will get your files back.

A friend recommended adding this to the list.

https://www.nomoreransom.org/en/index.html

quote:

Originally posted by mjlennon:
I come home from the office tonight, my PC has rebooted to login screen. I figured it had installed an update. Logged on normally.

However, poking around I see all these tagged with file extension [payday@cryptmaster.info] It appears as though all files on this PC, including backup volumes have been encrypted also.

I sent email to the cocksuckers for instructions. Does anybody know clean, safe means for decrypting the files?

Damn, I feel violated. They've destroyed years worth of family pics, writings, scores, etc.

If you don't have a backup of your files, you are f'ed without paying up.

You can search to see if by chance, the particular variant has been decrypted but chances are beyond slim. We get hit at work from time to time, but it's no big deal as everything on the file shares is backed up.

quote:

Originally posted by mjlennon:
It appears as though all files on this PC, including backup volumes have been encrypted also.

Your only backups were on-line, accessible from your PC at all times?

As you just found out: Not a good plan.

quote:

Originally posted by mjlennon:
I sent email to the cocksuckers for instructions. Does anybody know clean, safe means for decrypting the files?

Usually there is none that doesn't involve lots and lots off money. Sorry.

 
Hack/Ransom mine no problem. I have my data (and a bootable volume) offsite. I might lose a few days of my meager data, but otherwise no problem If your data is daily/hourly/minutely sensitive, then you need a more aggressive plan. But the same principles apply. Keep your data backed up, off-site at regular intervals, and you can tell these ransom hackers to F-off.
 
 

Ummm, yeah a “back up” physically in the computer, even on a different physical HD isn’t really a “back up” at all.

I back my Mac up, alternating between two different external drives. Never had a crash, but certainly makes upgrading and fresh install very easy thanks to Apple Time Machine.

quote:

https://www.nomoreransom.org/en/index.html

Ransomware is the new norm. Get use to it. Nothing beside a good backup strategy will save you. Paying the bastard is no guarantee of getting your files back but only encourage more of that illicit activities. Also all these site promising to unlock your files are full of shit. 256 encryption is next to impossible to decipher.

^^^^^. So what is a good backup strategy? We have an external storage device hooked up to our computers for backup. At one time that was enough.

I rec'd the ransom via email. These are their demands:

decrypter <payday@cryptmaster.info>
To medic three Today at 12:15 AM
We can decrypt your data, here is price:
- 1 Bitcoins in 30 hours without any stupid questions and test decryption.
- 3 Bitcoins if you need more than 30 hours to pay us, but less than 72 hours.
- 5 Bitcoins if you need more than 72 hours to pay us. Pay us and send payment's screenshot in attachment.
In this way after you pay we will send you decryptor tool with instructions.
TIME = MONEY.
If you don't believe in our service and you want to see a proof, you can ask about test decryption.
About test decryption:You have to send us 3 crypted file.
Use dropfile . to and Win-Rar to send file for test decryptions.
File have to be less than 10 MB.
We will decrypt and send you your decrypted files back.
Answer us with your decision.
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price
(they add their fee to our) or you can become a victim of a scam.
Time limit starts from this email.
Here is our bitcoin wallet:
REDACTED
Places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/inform...w-can-i-buy-bitcoins
can recommend easy bitcoin exchange service - localbitcoins.com (HOW TO BUY BITCOINS: https://localbitcoins.com/guides/how-to-buy-bitcoins)
or you can google any service you want.
Please write your answer right away!

The exchange rate this morning:

1 bitcoin = $4246.01

Fuck that. I back up HD because my wife would kill me if we lost our pictures. I can see buying a second HD for more backup. They aren't very expensive. Certainly nothing is worth 5000 dollars on my computer.