This article will help users, whose files are encrypted by CryptoTorLocker2015 ransomware. Follow the guide below to successfully decrypt CryptoTorLocker2015 files
This is trojan-ransomware: if a system is infected, the personal files are encrypted and a price is demanded for the key. If you suspect that you are infected, detect and delete CryptoTorLocker2015 immediately. It was first discovered and analyzed at the beginning of 2015 and is a variant of the earlier CryptoLocker (which originated in Russia, released in 2013). In some ways it is not so sophisticated in set-up or presentation, so it is possible that this trojan is an example of ransomware being franchised – purchased on the TOR (the Dark web) by third parties and operated with the developers’ help in exchange for a cut of the ransom (as Ransom32 has been in the last year). The simplification/vulnerability that did not exist in the original 2013 version also goes to suggests that it may be a franchise model.
Although the malware has been cracked by a security researcher, it’s still necessary to start uninstalling CryptoTorLocker2015 (or CryptoTorLocker20152015, as it’s sometimes known because of the extension) as soon as possible. Like it’s predecessor, the most common method of infection is via the opening of spam e-mail attachments containing the trojan that carries the ransom software.
On entering a system, the original version would install a file in User Profile then contact the C&C (Command and Control server) to acquire a key to encode the files. Version 2015 doesn’t communicate, which led the researcher to believe the key was stored somewhere in the target system – which was found to be the case. Although there is this decoding program, there are still problems other than file recovery to consider, such as further infections being introduced and system damage, and stopping CryptoTorLocker2015 from entering a computer is much less trouble than dealing with once it’s inside.
How to detect and deal with CryptoTorLocker2015
As with many malware infestations, this trojan has certain capabilities that help it remain undetected by many security programs – and to even disallow some of them to run at all. If scanning software is installed, first try to find out if it recognizes the malware and is known to be effective against it, perhaps by entering a search on the company’s website. There are some manual detection clues to watch for: noticeable slowing of processor speed; momentary system freeze – and also the screen display; random system restarting is initiated; increase in pop-ups or other advertising and spam ‘mail. If any of these symptoms are recognized, check personal files and search for any extensions .CryptoTorLocker20152015!. If files are found to be encrypted with this extension, back up all other files with normal extensions to an external storage device. Disconnect from all internet and network connections until needed (including wireless and remote desktop protocol).
Follow the instructions below to either manually or automatically remove CryptoTorLocker2015. If you need to download an anti-malware program, it is advisable to do this from another P.C and to transfer by disk or USB device. Then follow the link for decryption software. If you aren’t in a position to deal with the situation straight away, though need to leave the P.C running, use the Restart function periodically to disrupt the ransomware’s progress. If you have back-up available for personal files, then the other option is to reformat the disk and re-install the operating system.
How to decrypt CryptoTorLocker2015 files
To fully decrypt all CryptoTorLocker2015 encrypted files, please follow these steps:
Step 1: Download the free CryptoTorLocker2015 decryption tool from here: http://ransomwareanalysis.com/CT2015_Decrypter.zip
Step 2: Unapck the .zip archive to your Desktop.
Step 3: Double-click on cryptotorlocker2015_decrypter.exe file.
Step 4: Click Browse to select the folder with CryptoTorLocker2015 encrypted files.
Step 5: Click Start decryption to begin the decryption process. Here you must wait patiently for the decrypt utility to finish its job. Please, do not turn-off the PC, nor the tool.
How to prevent CryptoTorLocker2015
There are several other possible ways of being infiltrated by the trojan, and though these vary in terms of frequency and chance, they should all be kept in mind: system vulnerability exploits while visiting dubious or compromised ‘sites – this can be covered by regularly checking for system patches and by setting the browser to warn of dubious/harmful content. Entry via fake pop-ups (e.g offering freeware updates) can easily be avoided. File-sharing on P2P ‘sites can compromise a system, and files should be examined before opening. Contact with contaminated external devices – flash drives, D.V.D/C.D, &c is easy enough to avoid.
Another common delivery method is by freeware bundles hastily installed – this is a matter of care and attention, using the approval phase to install. Manual hacks through unsecured wireless/network connections or via RDP (remote desktop protocol) can be prevented using efficient, up-to-date security software and by securing any routes into your system by using advanced privilege settings (refer to windows.microsoft.com for details). Basically – even the most virulent malware is avoidable with enough thought. Think of all these possible routes in. Use the system settings and efficient software to secure them. Then the only doorways open to threats are the ones that you can create through inattentive working methods. Keep the ransomware locked out!
