This week my main pc was infected with Ransom:win32/Croti

fastfade · 31 Oct 2014

This week my main pc was infected with Ransom:win32/Croti.
My main protection program is MS Security Essentials. I was a bit surprised since I routinely keep my virus def.s up to date & stay off of any risky (??) sites. (You’ve heard it all many timesJ) No other PC’s on my Home Network appear to be affected.
I’ve applied all the fixes recommended b y knowledgeable sites (MBAM, MBAM Anti Rootkit,
Rkil, etc. However, I plan to do a complete clean install(including pull Ram/Batt, write zeros to HDD, & the reinstall my WIN7 Pro x64.
My primary concern is can I recover any of my corrupted files which I can no longer read?) I do have some external backup files I can depend on but several recent files on the affected PC can no longer be read.

Thank you for any comments

PC Vitals:
ASUS FA85 Mobo
AMD A10 5800k
16GB RAM
Win7 Pro 64bit SP1

cyberSAR · 31 Oct 2014

Unless you pay the ransom you will have to restore from backup. Bunch of info here CryptoWall - new variant of CryptoDefense - General Security

fastfade · 01 Nov 2014

Thanks for the response cyberSAR:)

Started Clean install today - what a destructive virus/Trojan/et al

Learned a hard lesson regarding real time backup

Thanks again

cyberSAR · 01 Nov 2014

Sorry for your bad luck but at least you'll have a fresh clean machine when done

May want to look into CryptoPrevent https://www.foolishit.com/vb6-projects/cryptoprevent/

Borg 386 · 01 Nov 2014

You might want to consider making a system image in case this happens again. It can be a lifesaver when disaster strikes. Keep it on an external drive & keep 2 or 3 previous versions in case you inadvertently make one with a virus or malware on it. That way you have a couple to fall back on.

Backup Complete Computer - Create an Image Backup

A system image is an exact copy of a drive. By default, a system image includes the drives required for Windows to run. This would be all NTFS formatted partitions or drives with an operating system installed on it (ex: C ) and the System Reserved partition are selected (checked) to be included in the backup and cannot be unselected. It also includes Windows and your system settings, programs, and files. You can use a system image to restore the contents of your computer if your hard disk or computer ever stops working. When you restore your computer from a system image, it's a complete restoration—you can't choose individual items to restore, and all of your current programs, system settings, and files are replaced with the contents of the system image.