Rew, sorry you got hit by this nasty POS. A word of advice for anyone. This malware generally gets distributed as an attached ZIP file to an e-mail. Many of these bogus e-mail messages state they are from American Express, Federal Express, UPS, DHL, a number of major banks or other credit cards.

Never open any e-mail from the above. If you are getting a package sent to you, especially with the holiday season approaching, always go to the website of the delivery company and enter your tracking number.

Sigh.... I just had a friend who dished out $5000 to his "security company" The way I'm getting the story is he has some sort of internet monitoring or some such jazz...hmm... Well, last night they had a pop up thing that wouldn't come off, then this company called them and told him that some Russians were trying to hack his accounts and they could help him if he bought lifetime protection, to the tune of $5000.
Now I said, " sounds scammy to me" esp. since he was reading account numbers for them to check. But he wasn't listening. I'm thinking Lifelock is way cheaper and so is a new laptop.
Crazy, ain't? SMH

faeryedark, I agree with you, his "security company" or someone posing as them, ripped him off BIG TIME! He should have hung up the phone and called the company back himself just to be sure.
I would have just alerted any bank accounts, etc by phone, bought a new laptop, and destroyed the old one.
I have a question, how did they know your friend had that kind of money? They most likely already had checked his accounts.

Oh, he told them. Like I said , he was there reading off account numbers etc. He's a smart guy in some ways but not in others if you kwim

If you are infected with this virus---or a bunch of viruses--- just restore your computer to the state it was when you bought it, then recopy all the pictures back to the hard drive.

Don't throw away your computer!!!! Just do this.

Here is how you restore it-------Most modern computers have an "image" of the hard drive just as it was when it was bought located on a place on your hard drive. Not to get technical, but that image is on a "hidden partition." To restore the computer to factory defaults---just as it was when you purchased it----you have to access that partition and allow the computer to restore it.

To access the hidden partition---and the image you need to restore your computer----you first have to shut down your computer. Turn it off completely. When you turn it back on, according to the type of computer you have----Dell, Asus, or whatever----you press a certain key on the keyboard----F11, F2, F10 or whatever the manufacturer says-----and it will take you to a screen which will allow you to restore your computer to its original state.

If you do not know the key to push to get the process started, do a Google search using another digital device which has internet access.

Press the key---you have to start pressing the key as soon as you turn your computer back on; just keep pressing it once every second--- and follow the directions on the screen. This might take 30 minutes but let the computer do its thing. When it is finished, it will reboot and PRESTO, your computer will be just like it was when it was new.

The virus will be gone, BUT BUT so will all your pictures, too, so if there is anything you had on the hard drive, it will be lost. BUT we did remember to save all those files to an external drive or a flash drive, didn't we?? Once your computer is in its original state, you can copy the files you had saved to the external drive back to the hard drive of the computer.

If you want to get really cocky or fancy, it would not hurt to also have a backup copy of your favorites or the address book---along with your contacts--- if you use an email service that is not web based. They will be gone once the restore program formats the drive and places the original image back

You will also have to reinstall any programs you had installed after you bought the computer.

This is also a poor mans way of fixing a computer that is so bogged down with viruses and unwanted programs that it has become slow. I call it the "nuke" method, kind of like dropping an atom bomb on a Wal Mart parking lot. The restore program destroys everything on your hard drive and replaces it with the new original date.

And you thought you had to be a computer whiz to fix your computer!!!!

rewdiazepam

Thanks for the info:)
A trick that has been used hear is that you will get a cold call from say Microsoft or whatever phone company your with telling you that your computer is infected and they can tell you how to fix it.....do not do this! It allows them to gain access to your computer remotely and has cost people a lot of money. If you ever get a call like that hang up on them......or use them for stress relief like I do!

I have repaired computers and fought countless viruses for many, many years and it's always at the point, where all is lost, that it finally sinks in... BACKUP REGULARLY! People don't begin to do this until something terrible happens! Sometimes I was not able to recover the data but most of the time I was able to. This Crypto is one of the worse as the data is there but encrypted. Just about everyone's PC I've worked on get infected by ignoring some simple rules.

1. Don't read your email with preview mode enabled (It's the same as opening the email.)

2. Always check the sender's email to see if it's someone you know or it's from someone that makes sense with the title of the email you're receiving (An email from USPS won't be coming from Uganda!)

3. Government agencies do not use email to contact you with an attachment... EVER! unless they've arranged it with you in advance by phone. Question every attachment that you are not expecting!

4. Junk mail is sent to junk mail folder based on your ISP provider's broadband filters of known junk mailer's addresses. You may occasionally find an email address of someone you know who is NOT in your address book in junk mail. Confirm with that person first before opening it then add them to you address book.

5. Never put anything on your PC that you wouldn't throw in the garbage! What I mean is if it's important then back it up immediately to CD or another hard drive, print it or use an offline storage site. Even saving to an email folder of a reputable email service is backing it up offsite.

6. Always be wary of plugging in someone else's flash drive to your PC, especially from schools where kids don't care where it's been. (A lot of viruses come from schools!)

In Rew's situation I would not be affected because I make a exact mirror copy of my C: drive every week to an off site location. At worse case I would lose whatever I saved on the C: drive in the prior week. I would simply say goodbye to Crypto and over write the entire C: drive with the last backup and be back in 15 minutes.

CD's & DVD's are less than a dollar apiece. It took you years to save all your photos, data, etc. Isn't that worth a few pennies a week? External hard drives have also dropped way down in price and so long as you keep them UN-plugged, plugging them in only when you want to save something, the likelihood of losing it is very low (but not impossible!)

This plan isn't perfect but it's worked for me for many years. (Plus I learned from all the infections people have brought to me over the years!)

Oh... and always keep your anti-virus up to date! There are several very good free versions out there. If you still want to review an attachment save it to disk first. Then right click on it and scan it with your anti virus program. 99% of the time you catch it before it bites you!

There is more you can do other than System restore...

first Malwarebytes will remove it... http://www.malwarebytes.org, it has a free version...

then you can do some of the suggestions here... and recover your documents... http://www.precisesecurity.com/rogue/remove-cryptowall

Backing up your data is imperative if for no other reason but in the event of a hard-drive failure. I am in IT this is what I do for a living and I can not tell you how many times that users have come to me because their drive failed, but never backed up their files to any of the network servers that are provided for them to use and that are backed up every evening as well... then they lose everything on their C drive.

Not all things can be recovered from a failed drive. Well they can, but not with out thousands of dollars.

We had something similar get to one of our network drives at work, it came in via a thin client, infected the client and then started working on one of the network drives. since the thin client is write protected the virus was eliminate upon reboot but not before it had done its damage. We were able to just restore from back up, but for the home user, it is a bit more complicated.

If anyone has any questions please let me know...

System Restore would not work in this case as the files used to restore would be encrypted..... You need to do a complete hard drive wipe....

The site that was originally posted on the first page started out by doing a system restore... which is wrong... and you don't need to do a complete harddrive wipe, that is excessive.

I will withhold any responses of my 31 years experience to those on this board who tell me hey are better qualified..

I'm not here to argue. and I'm sorry if I ruffled anyone feathers.
Anyone who wishes my PM me with questions and I'll gladly respond...