Bitcoin Forum

Have heard that kind of hacking software before, which encrypted all files on my computer, and when my brother have been using the computer (or course carelessly), it is hacked and they demand a 1.2BTC ransom... These are just one more bad news of BTC, and even make my family members have even worse image on bitcoin... And we decided not to pay the coins to the hacker as all important files have been backed up.

Whay do you think?

If all the important files have been backed up, don't pay those assholes.
This will only encourage them to do this more.

I'd recommend you to upload a single file online and create a new thread here, so that people can help you decrypt them.
Just a tip
@Cryptoheadd

I think you are choosing the right thing to do, especially if all the important files you have there, you have some back up of them. Still the hacker have all your sensitive data in case he is in possess of your PC. I think you are using a Windows as thats an easy hackable OS. 550 USD is not a small amount they are asking. Hope you have nothing in your Windows PC regarding a wallet with bitcoins or they will be gonne in no moment, but I think you have not there.

This shows to us others to keep our coins in cold storage.

Do you remember how did you got this ransomware, where exactly? This is bad for bitcoin community and bitcoin itself, so people will be skeptic to use bitcoin as they can be 'hacked' anytime by these hackers. Have you tried Kaspersky Ransomware Decryptor ?

You are lucky you got your important files backed up.
You will have to educate your brother about safely using a computer.

Cryptolocker :(

Are the files backed up anywhere else, and are the files valuable (work documents, personal media)? I stopped following this a while back, but I think there was a service that could recover these files for free. If not, and the files are valuable enough, you could actually pay it, as some businesses have done (the ransom was less than the opportunity cost of losing the data.

Good luck, and bummer dude  :'(

I feel sorry for you , but the fact he asked for Bitcoin means that he knows you are using Bitcoin in the first place which leads us to :

1. It's someone you know and he hacked you somehow/made you download something/had your computer access.
2. You downloaded a malware (or a shitcoin wallet which contain a trojan).

Either way , you should be more careful and don't download random stuff . It's always bad publicity for Bitcoin when we see this kind of stuff but well .. there is nothing we can do about it .
In the other hand , If we compare hackers that asks for Bitcoin ransom and who don't , we will see that those who don't are much more but simply ask for something else instead of Bitcoin so blaming Bitcoin won 't change anything . It's not anyone fault if people have a closed mind .

Mostly likely a ransomware.Answer a few questions to help me understand what exactly could be a solution.
-Do you use tor or did your brother use it?
-Do you a good anti virus installed ,is your firewall active ?
-What browser do you use ?
-Do you mind showing us a screenshot ?

i am sorry to hear about this.

but thid has nothing to do with bitcoin. it is like any other ransom. it could have been done using fiat just the same way and that wouldn't have changed anybodys view on fiat.

This should be a warning to everyone not to store their Bitcoin wallets on their main work computer because no one is safe from this happening to them sooner or later. I would do a complete wipe of the hard disk and reinstall a fresh copy of the OS. I would recommend to password-protect your system when you are away if you have doubts someone close to you may have tinkered with your computer. Also don't mention to anyone that you are a Bitcoin user  ;)

Don't worry about it, if your files were backed up you'll be alright. Perhaps you should see this as a good chance to boost your security and privacy, tell your family that too. After all, bitcoin is money, and if you're keeping money in your computer you'd better learn good security practices. Family members of mine have never caught a virus on their computers after I helped them with software and advice.

Its quite some answers for this situation that name TOR has to do with it. I think if you use TOR not as you should you can get any malware or keylogger as long as you are using Windows. I would like to point out that , when anyone uses TOR, don't open up any other browser for clear web together with TOR already running. TOR is made to be run by only itself if you wanna do your job without risking to get your computer infected.
Regarding antivirus and firewall they cannot stop all the malware unfortunately, but I hope OP as you are asking tells us more details. This is an interesting case to me.

Dont pay for it i already experience that all my files are lock by ransomeware trojan.. i tried two tools which can resolve your issue.
Try this free tools from kaspersky https://noransom.kaspersky.com/
After scan my computer by that tools all my files are back but the notes for every folder which is saying before you can recover your files you should need to pay to get a private key or password.. Dont pay for it..
also try to update the antivirus do you using or install kaspersky total security and scan the whole computer..

Well first if you backed up your files you don't need to worry, just don't pay. Reinstall your window's and buy some good protection. There is high chance that thief is someone you know, so when you finish everything don't share important informations with anyone.

If you wish to find out who is it, create diversion. Tell different story to every person. When you see something happening you will know exactly.

Good luck.

I think you ought not let your brother use your computer anymore.   Not sure how that hacking works--did they steal files or bitcoin?

Hopefully you do not have to much personal information in play that they could move into a deeper issue,hopefully they just move on as this scam seems to be highly successful with people. It really sucks to think that it could be some one you know as Omega pointed to.

Atleast this is a sucess history against the hackers,usually the attacks gets all the data and people pay them to recover and keep vulnerable to another attack on the short time,the extorsion will always happen if you pay them.And  well is bad for the image of bitcoin,your family now knows that besides bitcoin its amazing and good there are people damaging it without look behind.

Right. And a mugger could have used a pillow to smother you, but, for reasons that remain a mystery to me, he chose a Glock.

You seem really intellegent as you have put backups of all those important files which is very important. And also its better not to put personal files in working laptop as most of us earning online are always target of those hackers. I have also got affected by malware few months ago but i also don't pay them and format my laptop. >:(

 I think that if the hacker had asked for cash, even make your family have a worse image on cash!  Then no one work because fear on cash and they all starve because have no cash to buy nothing.
Come on man - make your family smarter.  Explain to them how bitcoin is not the cause of this problem.  Then put a free internet security program on your computer:

Avira (http://www.avira.com/)
360 total security (http://www.360totalsecurity.com/en/)
Comodo (https://www.comodo.com/home/internet-security/free-internet-security.php)
Panda (http://www.pandasecurity.com)

You should never have important information on a windows machine. If you can't afford 2 computers (because only total isolation is safe) you can just get constant backups on your usb pendrive of any sensible data, so if some fucker encrypts your computer you just have to format it and they will get nothing out of it. Also install malwarebytes anti ramsonware software.

 Given that a mugger is someone who attacks and robs a person in a public place, I'd say he was probably hard pressed to find a pillow and you lying conveniently on a surface conducive to smothering.

no, he will use a piano wire. it is more effective!

I think that your family cannot blame Bitcoin for insufficient security on your machine and criminal assholes. Remind your family that even central banks get hacked these days   ;D

Put a security software on the machine, store important files on external drives or backup them frequently.

It is very important to store data files on a different drive or partition than the operating system (Windows in your case). This way Windows stays relatively thin and you can do an image backup of your C: drive on a regular basis, e.g. by Norton Ghost, onto an external disk. How regular? Just ask yourself how far you can go back without too much pain. For example, 3 months for the operating system and 1 week for data sound reasonable.

This saves you alot of work in cases like this.  ;)

No matter how hard you try, things like this happen so good backups are the only way to go.

100%, always have your most important files stored on one or more drives in case anything happens to your computer, or someone ends up encrypting your files. At 90% of businesses, they have all of their files backed up and stored at multiple, typically varying locations, and are prepared for something like this most of the time.

If you don't have a backup, you might as well re-install windows so that they can't get anything more out of it. It isn't worth trying to fix unless you're very confident you'll be able to get around the encryption and get your files back.

You mean a Glock is a more practical choice? Not sure I understand what you're trying to say.

This one clearly preferred bitcoin a Glock. Neckbeards aren't that good with plano wire, requires actual physical prowess.


Cash is less practical than assaulting your mugging victim with a pillow, that's the whole point.
How do you think the cash ransom demand would look?
"Please deliver a brown paper bag full of banknotes to apt. 2, 1313 Mockingbird Ln, Cashville, OH?"

 That's too bad because it was sarcastically humorous much like your post yet more so.  It's okay, others will understand.

Nah, that's just stupid. Of course mugging someone with a pillow is much more likely to result in utter failure, just as asking for cash will result in cops, not the desired bag of filthy gubermint scrip, appearing at your door. Duh.

Those free anti virus for me is not working when my laptop is infected with ransomeware.. better to install kaspersky total security and the link i given from the first page which is the decryptor to recover all files and removes the trojan virus and ransomeware..

This shows the importance of backing up files.
I think that there would probably be a way of returning the files from encrypted ones if you know the contents of the files from a backup then it is eaiser to restore them all.
I think these type of mechanisms would use minimalistic ciphers for encyption to confuse people, hoewver, these are easily reversed.

This ransom ware is getting to be prevalent more and more these days.
I have heard them in the news at least three times in the two weeks.
Why aren't people investing into buying antivirus/anti malware software is beyond me.
And not relying on free trial versions, as that is only half the software's protection, is your first step too not getting yourself into this type situation in the first place.

Try using vitustotal.com which tests viruses agains all free software and offers some symantec insight into diferent files directly from the internet.
This takes up no space on your computer and means that you may not have to download and install anything or download potential threats.
If you do want to pay I would recommend Norton from Symantec^tm that seems the best paid one at the moment.

Most people use Windows; OSX and Linux are the minority, it would be helpful to list ways to secure Windows best as possible. I will start the discussion if you are using Windows. If you are using Windows 7 the best advice I can give you is not to update to Windows 10. Stick with Windows 7 for improved privacy.

1) Use Firefox, not Windows Explorer or Chrome. Go to Tools > Addons > Plugins and disable Shockwave Flash to prevent malware delivered by Flash banners. At the minimum use uBlock Origin extension to block all other ad banners.

2) Use a top rated security suite like Kaspersky Total Protection. Even with Kaspersky use good hygiene. Never click on links or banners in emails or heaven forbid open an attachment. Even friends can pass on a virus or trojan by forwarding a bad email. Most malware is delivered by email, not websites.

3) If you have more than a few bitcoin use a hardware wallet like Trezor.

4) Make a system restore disc and store safely in case you have to reformat your hard disk and restore from a backup. Get a 2-5 TH backup drive so you have plenty of space for multiple backups and backup weekly.

so in the end, you have not any problem, just reinstall and problem solved.

but i got what you are trying to say, dont worry, problem dont come from bitcoin, problem come from people who demand it, you and your family members should distinguish it.

Ransomware hackers don't care if their victim is a bitcoin user or not. They want to get their demands in the easiest and most untraceable way possible, so bitcoin. If they posted a PayPal acct number, wouldn't that be dumb for them to do so in the first place?

1. Improbable, but still possible. But why would they (someone he knows) would even do that in the first place?

2. Malware is the culprit here, of course. Maybe the user of the machine forgot to turn off javascript and carelessly accessed the deep web. Most of these ransomware exist in the deep. Also, flash-based malware (malware that can be injected if a user clicked a flash image/object) are around the web, too, so disabling flash could help you minimize the risks of being infected by a malware.

Since OP backed up all important files in his pc and recovered it, this should be a lesson to all. Always do a backup of your important files (especially your bitcoin wallet keys) on a piece of paper or in a hardware wallet.

A shared computer is only as secure as the least careful user.   That user might download a downloader exe or use flash because they require it on some random site as Administrator on Internet Explorer. 

sdp

So how did the ransomware get into the machine? Someone might learn something if you enlighten us.

I work in IT and we manage about 7000 computers. We have anywhere between 3 and 10 cases of ransomware a weak. To dispell some misinformation in this thread:
- Running just any antivrus will not protect you sufficiently. I have no experience with Kapersky but at least they actually produce some good stuff remedying ransomware / cryptolockers, so their product may help (not sure though)
- There are many attack vectors. They range from files as attachments or files being linked in emails (fake bills, fake invitations to social networks, fake pictures, etc), often java-scripts packed in zip-files, but sometimes links to executables. Also, they can enter via browsing even regular websites with any web browser (seen it happen with my own eyes), because sometimes advertisements are infected with attack vectors. Could be flash, could be java. My organisation is pretty well up to date with these things....

Then some tips:
- Use an adblocker
- Don't click on stuff that you are not certain about what it is
- Use an external drive for backup, but DON"T leave it connected 100% of the time!
- Avoid shady sites

I upgraded my windows 2 months ago and after using it 10 day I reinstalled lap top completely and return it to fabric settings. And I stayed there cause to much bed things with windows 10 happened to me.

I like you other advices, I also use firefox, have nice security, anti virus and anti malware . I don't have so much coins, but bigger part is in Trezor.. and I have several online wallets that I use for gambling and everyday transactions.

If something like this happened to me, I wouldn't pay ransom and that is my advice for OP. You have your files that is important, now start again but with better security. There is nothing else what you can do except to be more careful in the future and not let same thing happen again.
Of course paying ransom will give more power to this little criminals. They will try to do It again, so don't give them that feeling. Cut them in root`s.

This was blamed on another person so he probably does not know.

You can never be fully protected it is true, even with antivirus there are still penetrative viruses that can get into your system.
There are some reputable antivirus products but there are still security flaws, you can also not have more than one running at a time on a computer as there are confusions between the source code of different antivirus software as hey use exploritary measures which effects the usefullness of both antivirus software if installed at the same time.

That's an excellent idea. In stead of paying hackers we should all work together and put these guys to an halt. Hackers are just a small group, we as an community can an should fight back.
Your idea is brilliant. I am sure some skilled people are willing to user their skill for doing some good...

In stead of extorting others.

I think ransomware is when your system's hard drive gets encrypted by a malicious program or script and next time upon boot you can't get access to any of your files. Then a window pops up that tells you that the whole computer is locked down and you need to send a predetermined amount of Bitcoins to the hackers' wallet address. Then they will release a decryption key so that you will be able to get back your stuff which is being held for ransom on your own machine thus the name ransomware. Honestly I don't know if any of your stuff is uploaded to the hackers before the encryption commences but it won't be a surprise if it is when they can simply double dip by doing this.

Why is bitcoin to blame, you just said it was your brothers fault, if they hadnt used bitcoin as payment it would have been some other form of payment..... think before you spout stupid things.... :-X

other form of payment  LIKE? Do not name other e-currency.... :)

haha ha newb fucker watched too many pron sites with barebacking  browsing...

I heard of this years ago actually but at the time it was targeting the police and business owners. Needless to say they used to pay up to get their files back/unecrypted.

Now they're moving on to average joe, that was always going to happen I guess.

That is not a bad image for BTC it is more a bad image for the guys who are downloading crap on their machines, usually porn lol

It also used to be done with other payment methods like UKASH.

You're "important files now belong to them so hope they're not that important because they will find something to do with it that you can be sure of.

 

 ::) yep

It will benefit the community if you can name that software and post the link here so we will know.Mnay people are using this kind of software they maybe that software now,anyway if there is a back up then there are no more reason to pay a ransom,you can also report this to the authority,they might trace who this guys are ..

This hasn't happened to myself but a friend of mine and yeah, it does really suck as much as it sounds like.

http://www.bleepingcomputer.com/ is one of several good sites to browse to stay up to date on malware threats and defense.

At http://www.bleepingcomputer.com/download/search/?keyword=malwarebytes they have downloads for two Malwarebytes products that you can layer with your existing security programs. They have a beta of Malwarebytes Anti-Ransomware (free) and also free Malwarebytes Anti-Exploit that are designed to work together. You are probably already familiar with Malwarebytes Anti-Malware.

I also like HitmanPro very much. It is a paid program but they give you a thirty day free trial. It was a big help when I had to help a friend scrub an infected computer.

Malware Tips (https://malwaretips.com/blogs/remove-browser-redirect-virus/) also has a good guide to using advanced programs in safe mode.

First of all, thanks to all of your reply.

Fortunately, we have lost only unimportant files thanks to backups, and those unimportant files can be re-made.

We have used Windows 7 on our computer, and have all Internet Explorer, Google Chrome and Firefox installed. I use Google Chrome as my main browser but my brother was using Internet Explorer...

I don't know what the ransomware was, my brother said that he have been doing a project, searching for sites and that's probably one of those sites having malicious codes (or hacked). They're all not porn-related.

They have only locked some common file format, like DOCX, PDF, JPG. They don't lock EXE programs, because doing this may locked any bitcoins we have (but we don't have Bitcoin Core). On my computer there's only few altcoins installed, naming Ambercoin, CAPTcoin and Yovicoin.

Yes they want BTC just because of the anonymity feature provided by it. They have stated the they wanted 500 USD, but in bitcoins (according to the price of $420/BTC). The price information of them is outdated because 1 bitcoin worth ~$460 now!

I can't name the ransomware, they say that they've encrypted the files via Internet. I can't upload a file here, as I'm not using my computer now. Also we're going to format all hard disks (thanks to backups) and not keeping all the lost unimportant files.

Good to hear that, unfortunately, many people are losing important data because of ransomware, companies are also loosing money because of this.
A good recommendation is to always have in the cloud or offline backups of important files. Common sense is one of the best anti-virus there is.

Finally found a method to decrypt my files and problem solved. No BTC was paid. Case closed :)