Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Infected with ransomware (Cryptolock/PClock?) how to decrypt files?

  • This topic is locked This topic is locked
2 replies to this topic

#1 buur


  • Members
  • 3 posts
  • Local time:03:04 AM

Posted 10 March 2015 - 05:05 AM



On my windows xp pc I got infected with some kind of ransomware (pay 165 usd within 95 hours). I had the name Cryptolock in it but I do not know if this is the real name. I got it removed with Malwarebytes but I have my files encrypted by it :( . Files that are encrypted are my photos, videos and documents. Is there some way to decrypt my files? I tried system restore but that did not work and there are no shadowcopies (deleted by the ransomware?).

Hope someone can help me.



BC AdBot (Login to Remove)


#2 Gemini566


  • Members
  • 2 posts
  • Gender:Male
  • Location:Weoley, Birmingham UK
  • Local time:02:04 AM

Posted 10 March 2015 - 05:22 AM

Hi Anton,


I would suggest you read Grinler's post at the bottom of this page>>>   http://www.bleepingcomputer.com/forums/t/506924/cryptolocker-hijack-program/page-26#entry3165383


It was started two years ago but is kept up to date. Unfortunately you will not be able to recover your lost data without paying the ransom, but at least you learn more about Crypto_lock in particular and ransomware in general - I did. I have followed the advice and now feel safe and secure in the knowledge that my data, and all that is on my network PC's and NAS drives will never be held to ransom. 


Good luck,




P.S. I would suggest that you ditch XP NOW in favour of W7. XP has no MS support, making it highly vulnerable to all malware now.

Edited by Gemini566, 10 March 2015 - 05:24 AM.

#3 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,953 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:04 PM

Posted 10 March 2015 - 08:02 AM

PClock and CriptoLocker (variant) pretend to be CryptoLocker.

There is an ongoing discussion in this support topic: New PClock CryptoLocker Ransomware discovered Support and Discussion.

...from the above topic.

Since most of the questions are duplicates I decided to create a short compilation of frequently asked questions...

At the moment there are 5 different variants of the malware in circulation. I am happy to say that we can help in the majority of cases. This is the current breakdown:
Files encrypted by variant 1 can be restored in all cases.
Files encrypted by variant 2 can be restored in about 95% of all cases.
Files encrypted by variant 3 can be restored in about 99% of all cases.
Files encrypted by variant 4 can be restored in about 1% of all cases.
Files encrypted by variant 5 can be restored in about 99% of all cases.
Files encrypted by variant 6 can be restored in about 1% of all cases.
Files encrypted by variant 7 can be restored in about 1% of all cases.

I am actively looking into variant 4, 6 and 7 at the moment, but it is unlikely that I will be able to provide decryption for it at all.

Fabian Wosar, Security Colleague Post #320

Rather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions, comments or requests for assistance in that topic discussion.

The BC Staff
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users