CryptoLocker/Wall is a file encrypting virus that will encrypt all your videos, pictures and personal documents. Before you realise, the program that encrypts your file will demand some ransom money. The victim has 96 hours to pay before all data is lost and destroyed.
To confirm you have been infected with the virus, there are two files that will be placed on your desktop:
1) DECRYPT_INSTRUCTIONS.html
2) DECRYPT_INTSTRUCTION.txt
With similar contents:
“WARNING we have encrypted your files with CryptoLocker virus. Your important files (including those on the network disks, USB, etc): photos, videos, documents, etc. were encrypted with our CryptoLocker virus. The only way to get your files back is to pay us. Otherwise, your files will be lost. Caution: Removing of CryptoLocker will not restore access to your encrypted files.”
There are tools that can remove CryptoLocker completely. However, as of writing this notice, none can decrypt the files that has already been encrypted by the virus. Our recommendation is to follow the Malwarebytes “Removal Instructions” here:
https://forums.malwarebytes.org/index.php?/topic/134420-removal-instructions-for-cryptolocker/
For business and corporate, re-imaging the infected machine is the best course of action.
As a preventative measure, please download and install CryptoPrevent from FoolishIT.
If you happen to be a victim of this virus, feel free to contact us on (02) 8199 7650.