Opening an email from Australia Post has had 3 clients in 3 days lose ALL their data to the CRYPTOLOCKER virus

* WARNING *  in Emails

australia post logo

Update: 5th Feb 2016

Today we have heard of three more cases of people and businesses in the Perth area being targeted and having their computers, servers and any attached backup drives completely encrypted with:

The CRYPTOLOCKER is impossible to break or decode without the original encryption key. This type of virus is known as Ransomware and unless you have recent backups that have not been affected by the virus, you will need to PAY THE RANSOM, if you wish to recover those files

Each computer became infected after opening an EMAIL from AUSTRALIA POST (or ), with a subject line such as:

Subject: An agent was unable to redeem the parcel to your place for the reason: receiver was absent

There have been many different subject lines but they commonly want you to click on an attachment or a link such as “Down Load Shipping Label

More info here: http://auspost.com.au/about-us/scam-email-warning.html

CryptoLocker is a which targets computers running Microsoft Windows. There is a demand for money which if not paid escalates each day.

The only surefire way of removing the virus is to reinstall windows back to factory settings and then restore your data from your last backup, so please make sure your data is backed up TODAY, onsite AND offsite. If you believe you have seen such an email or encountered this virus recently, please give us a call on 08 6365 5603 and we can help you remove this or any other computer virus or malware.

Please be vigilant.

How do you know if you have contracted the CryptoLocker Virus?

Messages such as these will start appearing on your computer screen

 

You will also find that you will be unable to open document and picture files and the files now have an extension of .encrypted as per this example:

We know nobody likes to pay a ransom but in some cases it may be the cheapest alternative to resolving the situation.

If you are in the situation where you either have no backup of your files or the backup has also been corrupted and it will cost you more than the cost of the ransom to re-create that data, it maybe worth paying the ransom and hoping the crooks decrypt your files as they promise to do.

Before doing so just check if there are earlier “versions” of your files by following these guides

http://windows.microsoft.com/en-au/windows/previous-versions-files-faq ….. for Windows 7

http://windows.microsoft.com/en-AU/windows-8/how-use-file-history …. for Windows 8

If you use Dropbox or Google Drive for storing documents and pictures you can also go back to previous versions that may not be encryted, using the following

https://support.google.com/drive/answer/2409045?hl=en ….. Google Drive

https://www.dropbox.com/help/11 ….. Dropbox

In an example of the latest attack a ransom of AUD $ 640 (1.298976 ) increasing to AUD $1,280 in 120 hours has been demanded.

cryptolocker-ransom-demand

Although our client was reluctantly willing to pay the ransom, as the payment was required in (BTC) it makes it a very difficult and involved process if you know nothing about the digital currency Bitcoin (BTC)

cryptolocker-ransom-demand-bitcoin

In order to purchase Bitcoin (BTC) it is necessary to firstly purchase them from an  Bitcoin Exchanger or a .

Credit card or Debit card payments are not accepted when purchasing BitCoin’s

After trying multiple ways of purchasing Bitcoin (BTC) with many site links not working, we finally came across a site called “” (http://www.coinjar.com) and after a long drawn process of registration and proof of identity (including submitting proof of identification with copies of driving licence, passports and utility bills) we were finally given a BPAY Biller code and BPAY reference number in order to transfer money into the Coin Jar account which can then be used to purchase Bitcoins once the BPAY payment has cleared (2-3 business days) and  once in the account she can use those AUD $ to purchase 1.298976 BTC which can then be transferred to the anonymous seller of the encryption key.

Once the bitcoins have been transferred and you “Verify Payment” by clicking on the link provided, you will see a similar screen to this, confirming the payment.

ransom-paid

Clicking on Decryption_Software.exe link, downloads the executable file that will give you access back to your files and remove the “.encrypted” extension

decryption_software-download

When downloaded, run the executable file and click on the “Start Decryption” button

decryption-started

Decryption should commence, and when complete, you will be prompted to restart your computer.

Our experience to date is that the decryption software will only run and decrypt a certain number of files (we have no idea what the limit is) Therefore you may find that only a percentage of the files are decrypted. With one client non of the files on their encrypted external Hard Disk drive were decrypted.

The murky world of the online scammer.

If you do not want to fall victim to online scammers and ransom-ware pirates, make sure all your data is backed up daily in two locations, one online and the other on a local drive. See articles below. We also suggest moving your emails to Microsoft Hosted Exchange to add another level of security and to stop junk and viruses making their may through to your email client.

Need more help?

Covid-19 Update: Business as usual for workshop repairs, remote support and onsite support.

If you live in Western Australia, and you need any kind of computer help, please bring your computer to us at 315 Rokeby Road, Subiaco, Western Australia or call us out. You can email us at helpdesk@itguyswa.com.au or call:

08 6118 2601 
Microsoft Silver Cloud Partner

Apple Consultants Network

For instant remote control sessions, follow the instructions found on this page

Leave a Reply

Your email address will not be published.