rooterz

My files are infection/ with CryptoLocker / Pclock

Recommended Posts

Hello.

I want you to decrypt my encrypted files.

 

My PC is infected by ransomeware named CryptoLocker./ Pclock

Unfortunally, these files are not backed up, so the way I get the files back is only decryption.

Therefore, I want to borrow your wisdom.

 

screenshot of wallpapper on pc :

1XciXqL.png

Share this post


Link to post
Share on other sites

i have got the same ransomware but i really dont know how it could be happen no download any soft or install recently

now mostly all my picture and video are encrypt hope can find solution soon

i have 2 encrypt file list some sample of file but cannot find the virus file

i just notice that my previous antivirus (AVAST) as been disable and taskmanager too et my computer as frozen

wepkeys.txt

Share this post


Link to post
Share on other sites

Hi rooterz and xginx,

PCLock is unfortunately not decryptable. You can either backup your files and wait for a solution, or pay the criminals (we do not recommend this) currently.

xginx, if you think you're infected then please do this for me:

Install and Run Emsisoft Emergency Kit (EEK):

  • Double click EmergencyKitScanner.exe to install EEK
  • When the installation of EEK is complete the Emergency Kit scanner will run.
  • NOTE: Make sure to enable PUPs detection.
  • Click "Yes" to Update Emsisoft Emergency Kit
  • Under "Scan" click-on "Malware Scan".
  • IMPORTANT: Do not quarantine or delete anything. We just want the scan log without anything being quarantined or deleted.
  • Save the scan log somewhere that you can find it.
  • Exit Emsisoft Emergency Kit.

 

Run Farbar Recovery Scan Tool (FRST):

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • Farbar Recovery Scan Tool will produce the following logs:
  • FRST.txt
  • Addition.txt

 

Reply here and attach the following logs to your post:

  • Emsisoft Emergency Kit log (C:\EEK\Reports\)
  • FRST.txt
  • Addition.txt

Share this post


Link to post
Share on other sites

Hi xginx,

We need to run a fix with FRST:

  • Please download the attached fixlist.txt file and save it to the same location as FRST
    Note: It's important that both files, FRST.exe/FRST64.exe and fixlist.txt are in the same location or the fix will not work
    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
    fixlist.txt
  • Run FRST.exe/FRST64.exe and press the Fix button just once and wait
  • If for some reason the tool needs a restart, please make sure you let the system restart normally, then let the tool complete its run
  • When finished, FRST will generate a log (Fixlog.txt) in the same location the tool was run, please post it to your reply

=================================================================

We need to remove programs using "Programs and Features"

Click the "Start" orb on the taskbar, and then click the "Control Panel" button.

  • If you use Category mode, click on Uninstall a Program.
  • If you use Icons mode, click on Program and Features.

A list of programs installed will be "populated" (this may take a bit of time).
If they exist, uninstall the following by clicking on the below entries and selecting "Remove":

  • Advanced SystemCare 10
  • Reimage Repair 
  • WindowsMangerProtect20.0.0.1064


Additional instructions can be found here if needed.

=================================================================

Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator
  • The tool will start to update the database if one is required.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Logfile button.
  • A window will open which lists the logs of your scans.
  • Click on the Scan tab.
  • Double-click the most recent scan which will be at the top of the list....the log will appear.
  • Review the results...see note below
  • After reviewing the log, click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[CX].txt) will open automatically (where the largest value of X represents the most recent report).
  • To open a Cleaning log, launch AdwareClearer, click on the Logfile button, click on the Cleaning tab and double-click the log at the top of the list.
  • Copy and paste the contents of AdwCleaner[CX].txt in your next reply.
  • A copy of all logfiles are saved to C:\AdwCleaner.

=================================================================

Reply here and attach the following logs to your post:

  • fixlog.txt
  • AdwCleaner log

Regards

  • Upvote 1

Share this post


Link to post
Share on other sites

hi

i cant download the attach fixlist.txt i have this error 

The page you are trying to access is not available for your account.

Error code: 2C171/1

WindowsMangerProtect20.0.0.1064 wasnt in the uninstall list but

i had remove  

  • Advanced SystemCare 10
    • Reimage Repair 
    •  

Share this post


Link to post
Share on other sites

Hi xginx,

How is the system running now? Can you access Avast and task manager?

Please re-run FRST, put a check into the box next to Addition.txt and press the scan button. It will produce FRST.txt and Addition.txt logs located on the desktop. Please copy and paste the logs into your next reply.

Regards,

Sarah

Share this post


Link to post
Share on other sites

hi sarah

taskmanager i have restore the registry key as soon i notice i cannot access it

avast i have reinstall it since the infection

my system is running like normal but i still doing a scan everyday

waiting for a solution for decrypt

as 30% of the file encrypt is really vital for me

Addition.txt

FRST.txt

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.