CryptoLuck Ransomware - How to remove

A new species of cryptomalware has recently been detected, which is spread in the ways quite unusual for the ransomware viruses. This new crypto-locker has been dubbed CryptoLuck. It has been discovered by a research worker form Proofpoint, nicknamed Kafeine. CryptoLuck ransomware is a standard asymmetric encryptor, but its trojan-like distribution refers not to the traditional spam e-mail flooding, not the mention the malvertising techniques, employed by the distributors of this peculiar ransomware virus. Apart from the latter peculiarities, CryptoLuck encrypting malware behaves in the manner quite similar to the rest of the ransomware lockers.

How is Encryption by CryptoLuck Ransomware Performed?

CryptoLuck file-encrypting malware aims at the files stored locally as well as the files shared on the network. The virus combines the private AES-256 key with the public RSA-2048 key to encrypt the data containers, having the following extensions:

.3ds .3fr .4db .4dd .7z .7zip .accdb .accdt .aep .aes .ai .apk .arch00 .arj .arw .asset .bar .bay .bc6 .bc7 .big .bik .bkf .bkp .blob .bpw .bsa .cas .cdr .cer .cfr .cr2 .crp .crt .crw .csv .d3dbsp .das .dazip .db0 .dba .dbf .dbx .dcr .der .desc .dmp .dng .doc .docm .docx .dot .dotm .dotx .dwfx .dwg .dwk .dxf .dxg .eml .epk .eps .erf .esm .fdb .ff .flv .forge .fos .fpk .fsh .gdb .gho .gpg .gxk .hkdb .hkx .hplg .hvpl .ibank .icxs .idx .ifx .indd .iso .itdb .itl .itm .iwd .iwi .jpe .jpeg .jpg .js .kdb .kdbx .kdc .key .kf .ksd .layout .lbf .litemod .lrf .ltx .lvl .m2 .map .max .mcmeta .mdb .mdbackup .mddata .mdf .mef .menu .mlx .mpd .mpp .mpqge .mrwref .msg .myo .nba .nbf .ncf .nrw .nsf .ntl .nv2 .odb .odc .odm .odp .ods .odt .ofx .orf .p12 .p7b .p7c .pak .pdb .pdd .pdf .pef .pem .pfx .pgp .pkpass .ppj .pps .ppsx .ppt .pptm .pptx .prproj .psd .psk .pst .psw .ptx .py .qba .qbb .qbo .qbw .qdf .qfx .qic .qif .r3d .raf .rar .raw .rb .re4 .rgss3a .rim .rofl .rtf .rw2 .rwl .saj .sav .sb .sdc .sdf .sid .sidd .sidn .sie .sis .sko .slm .snx .sql .sr2 .srf .srw .sum .svg .sxc .syncdb .t12 .t13 .tar .tax .tbl .tib .tor .txt .upk .vcf .vcxproj .vdf .vfs0 .vpk .vpp_pc .vtf .w3x .wallet .wb2 .wdb .wotreplay .wpd .wps .x3f .xf .xlk .xls .xlsb .xlsm .xlsx .xxx .zip .ztmp

These file types are appended .[victim_id]_luck extension as an additional part of their names, which also stands as a marker, signifying that the files have been locked and that they are no longer readable and/or executable. For example, Scenery.jpg is renamed Scenery.jpg.[victim_id]_luck, after having been locked. The victim ID is the combination of random characters, numbers and letters, for instance, 0054B131. Besides, it is important to mention that CryptoLuck encrypting virus bypass the files, which names have the following strings, even if they are among those file types targeted by the malware:

Windows
Program Files
Program Files (x86)
ProgramData
AppData
Application Data
Temporary Internet Files
Temp
Games
nvidia
intel
$Recycle.Bin
Cookies

The file @WARNING_FILES_ARE_ENCRYPTED.[victim_id].txt is placed in the compromised folders. This file contains the ransom statement by the cyber criminal/-s:

A T T E N T I O N !
YOUR PERSONAL FILES ARE ENCRYPTED!
PERSONAL ID: 0054B131

Your important files encryption produced on this computer: photos, videos, documents, etc. Encryption was produced using a unique public key RSA-2048 generated for this computer. To decrypt files you need to obtain the private key.

If you see this text but don’t see Decryptor Wizard window – please, disable any Firewalls and antivirus products, and download Decryptor Wizard on this URL:
http://dropmefiles.com/304718

You have 72 hours for payment.
After this time the private key will be destroyed.

For more info and support, please, contact us at this email address:
[email protected]

The ransom note is also displayed in the wizard:

72 hours are given for the victim to contact the hacker/-s by the contact e-mail – [email protected]. It has already been reported that the ransom payment is of 2.1 BTC (bitcoin), which is 1,499.52 USD at this particular moment of writing the post. So far there has been no news regarding the decryption provided by these crooks.

The Peculiar Way CryptoLuck Ransomware is Spread

CryptoLuck file-locking virus has been distributed via RIG-E (Empire) EK (Exploit Kit). This deadly combination has been spotted being advertised on adult content websites. There is quite a good chance that such malvertising campaigns are carried out through other suspicious or compromised domains.

The other peculiar way CryptoLuck virus has been discovered to be spread is the Googleupdate.exe application. As strange as it is, the latter program is developed by Google. Despite this fact, the coders of the ransomware are able to exploit it to distribute their malicious application. In fact, it is a RAR SFX (self-extracting archive) file, which contains crp.cfg, GoogleUpdate.exe and goopdate.dll files. The files are extracted automatically, Googleupdate.exe app is run, and a DLL hijack ensues. Since the goopdate.dll file is not the original one, but rather the one, which is corrupted with the payload of CryptoLuck malware, the legitimate Googleupdate.exe program actually loads the ransomware on the compromised PC.

How to Remove CryptoLuck Ransomware and Get Access to Your Data?

CryptoLuck crypto-malware can be removed with Spyhunter or Malwarebytes certified malware removal tools. It can also be deleted manually. For either of the options you can find a solution here. The antivirus applications can be downloaded following the links, while the manual elimination of the virus can be done following the guide posted below.

Unfortunately, we cannot provide you with the decryptor, in fact, at the present moment no one can. Thus, you can try to make use of your backup, whether it is removable drives or copies stored on the system. You can always apply such data recovery applications as Recuva, etc. to regain access to your data.

How to recover CryptoLuck Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before CryptoLuck Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of CryptoLuck Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to CryptoLuck Ransomware. You can check other tools here.  

Step 3. Restore CryptoLuck Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually CryptoLuck Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover CryptoLuck Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.