Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Locker Ransomware Support and Help Topic


  • Please log in to reply
634 replies to this topic

#466 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 48,067 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:10:25 AM

Posted 31 May 2015 - 08:39 AM

We have a discussion topic about that announcement here..."Locker" Ransomware Author Allegedly Releases Database of Private Keys
.
.
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Microsoft MVP Reconnect 2016
Windows Insider MVP 2017
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

BC AdBot (Login to Remove)

 


#467 Vladelos

Vladelos

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:25 PM

Posted 31 May 2015 - 08:41 AM

Looks like the program doesn't work me. I don't get it.

I use they Payment Address, it allows me to go to the next Step, I choose File Location, choose a file and press Start but after that I get this http://imgur.com/7oewZ2D,QREEJ1F



#468 syousef

syousef

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:25 AM

Posted 31 May 2015 - 08:42 AM

Thank you Nathan. I did a test on a copy of 43 files in my tmp directory. 3 failed. Would it do you any good for me to upload these?

 

--- Locker Decryption Report _ DecrypterFixer ---
 
Total Files Processed: 43
Total Files Decrypted: 40
Total Time Elapsed: 0:0:8


#469 Grinler

Grinler

    Lawrence Abrams

  • Topic Starter

  • Admin
  • 42,892 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:10:25 AM

Posted 31 May 2015 - 08:50 AM

Were the other 40 files decrypted properly?

#470 syousef

syousef

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:25 AM

Posted 31 May 2015 - 09:12 AM

Were the other 40 files decrypted properly?

 

Yes and I have had success with actual lost files now too. (Walter Lewin Physics lectures, no longer available on MIT site).

 

I haven't been able to get list decryption to work. But folder/directory definitely does.

 

There's also some improvement to be made to the interface. I have to keep restarting. 

 

Nathan has done a fantastically great job with a very fast turnaround. These are minor things he can improve (though required for large scale practical use). The real work has been done though.



#471 johnnie_walker

johnnie_walker

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:25 PM

Posted 31 May 2015 - 09:29 AM

Nathan...... i just wanna say a thousand thanks to you if you read this.......i wish i can be like u....you're so legendary for me......with your software i save my 15gb jpg files!!! although a few only error...this is just a winning situation for me....if you play dota2 pm me i will give you some of my set to you as an appreciation....and sorry for my bad english....



#472 syousef

syousef

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:25 AM

Posted 31 May 2015 - 09:37 AM

Nathan...... i just wanna say a thousand thanks to you if you read this.......i wish i can be like u....you're so legendary for me......with your software i save my 15gb jpg files!!! although a few only error...this is just a winning situation for me....if you play dota2 pm me i will give you some of my set to you as an appreciation....and sorry for my bad english....

 

Did you just run it on the entire directory? Or were you able to use the list of files option? I haven't been able to get that to work and since i've done partial recovery it's the only one that makes practical sense for me as that is what I have - a list of files I haven't been able to restore.



#473 sveed

sveed

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:25 PM

Posted 31 May 2015 - 09:45 AM

First of all, Thank you Nathan and many others envolved in help us fight this evil nasty thing.

 

Well i had my computer infected and some files encrypted with this ransom locker. I have downloaded and installed the Locker Unlocker but it seems to work only when i choose to run on directory decryption. So far i have edit the list of files and removed a few of unecessary files that were there and left just the really important files i have to restore, but it didn't work as well. I hope this bug fixed in future version because there are so many files encrypted and the directory method is not efficient in such case. 

 

Anyway, thank you very much for your efforts.



#474 evil-doer

evil-doer

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:25 AM

Posted 31 May 2015 - 09:56 AM

So I just ran the program in file list mode, since I did not delete the data files that were created. (figured they may be important for something like this). And after hitting start, immediately something popped up that said successful or something? But now its sitting there with the start button "greyed out" and a wait animation circle spinning, and it says status idle.

 

Also says encrypted files found: 0   files decrypted:0

 

And there is no log.


Edited by evil-doer, 31 May 2015 - 09:58 AM.


#475 syousef

syousef

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:25 AM

Posted 31 May 2015 - 09:57 AM

I'm finding other things are decrypting properly.

 

Unless I find other files that can't be decrypted I'm going to guess that the files in my temp directory that wouldn't decrypt were corrupt to begin with. I can't be sure so Nathan if you'd like a copy of these files let me know.

 

I need to get to bed. I can't be a zombie at work 2 weeks in a row.



#476 jeyegz

jeyegz

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:25 PM

Posted 31 May 2015 - 10:04 AM

Hello nathan, How can I make a program run by looking at the list that is encrypted?

#477 syousef

syousef

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:25 AM

Posted 31 May 2015 - 10:07 AM

I don't think list mode is working. I haven't seen anyone say they've had it work.

 

Despite Nathan's warning a few people have gone ahead and pointed it at a directory with a mixture of encrypted and non-encrypted files. I think it's safer to wait for him to release a version with it fixed.

 

Nathan's response has been very very fast. Let's give him some time.



#478 Nathan

Nathan

    DecrypterFixer


  • Security Colleague
  • 1,617 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:25 AM

Posted 31 May 2015 - 10:45 AM

Locker Unlocker Update:

 

The list mode now works correctly, and the screen freezing or failing has been fixed.

 

The application was freezing from files with a few chars in other langs (like ñ) . This is now detected and will let you know at the end that their may be some files that need to be renamed.

 

You should be able to run the decrypter in list mode successfully.

 

Good luck.


Have you performed a routine backup today?

#479 evil-doer

evil-doer

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:25 AM

Posted 31 May 2015 - 10:58 AM

And where is this updated version?



#480 sveed

sveed

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:25 PM

Posted 31 May 2015 - 11:06 AM

I re-downloaded the Unlocker from same link as posted above and still not working. Can you repost link to the updated version?

 

Thank you.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users