CryptoLocker such as disinfecting prevent and recover files as infected ramsomware

Hi friends, in today's tutorial we will talk about CryptoLocker called ransomware infection type. Specifically we'll see how to disinfect an infected computer CryptoLocker as this ransomware prevent infection and how we can recover your files with CryptoLocker.
What is CryptoLocker?
As I said above this is a Class infection and once infected with ransomware CryptoLocker this search and encrypt files on your computer. It encrypts files that are *. Odt, *. Ods, *. Odp, *. MDGs *. Odc, *. ODB, *. Doc, *. Docx, *. Docm, *. WPS *. xls, *. xlsx, *. xlsm, *. xlsb, *. XLK, *. ppt, *. pptx, *. pptm, *. mdb, *. accdb, *. pst, *. dwg, *. dxf, *. DXG, *. wpd, *. rtf, *. wb2, *. mdf, *. dbf, *. psd, *. PDD, *. pdf, *. eps, *. ai, *. indd, *. cdr *. jpg, *. jpe, *. jpg, *. dng, *. 3fr, *. ARW, *. SRF *. sr2, *. bay, *. crw, *. cr2, *. dcr, *. KDC, *. erf, *. mef, *. MRW, *. nef, *. nrw, *. orf, *. raf, *. raw, *. RWL, *. rw2, *. r3d, *. PTX, *. PEF, *. SRW, *. x3f, *. der, *. heaven *. crt, *. pem, *. pfx, *. p12, *. p7b, *. p7c
Once the files have been encrypted, you will not be able to open, use or view these files. Although at one time CryptoLocker will give "chance" (false) will recover the files by paying 300 300 dollars or euros in return for which you receive a key to decrypt your files will not advise you to do this! No one will guarantee that you get really decryption key and you stay without all the money from the card or your bank account.
What if I CryptoLocker infection?
We recommend that you unplug the computer all perfifericele (printer, fax, USB stick, SD card, external hard drive and other storage media), unplugging the internet from the infected computer network card to the network and not spread the infection to other computers connected to it. Also not connect removable media (USB drives, memory cards or external hard disks) to the infected computer.
How to CryptoLocker disinfect an infected computer?
The method by which you can get rid of this infection is quite simple, it is presented in detail in the video tutorial. The first step is to enter Safe Mode as shown in the video tutorial. Regardless of the version of Windows used, you can do this by pressing the Windows + R keys and in the Run box type "msconfig" then press the Enter key. In the window that appears, go to the Boot tab and check the Safe boot box, then click on Apply and OK and restart the computer, which will enter Safe Mode on its own when it returns from restart.
Another way you can get into Safe Mode is to restart the computer and immediately after you see the logo motherboard manufacturer, repetitive key press F8.
Once in Safe Mode you will need to access the Registry Editor to delete the entries that CryptoLocker makes in the operating system. Press the Windows + R keys and in the Run box write "regedit" and press the Enter key.
Usually you have a few key CryptoLocker the following locations:
HKEY_CURENT_USER \ Software \ CryptoLocker
HKEY_CURENT_USER \ Software \ CryptoLocker_0388
HKEY_CURENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run
HKEY_CURENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ RunOnce
After I cleaned registry entries will be doing CryptoLocker visible extensions for files, folders and hidden files and folders protected by the system. How does this work was shown in the video tutorial.
We will access the folders "C: \ Users \ YourUserName \ AppData \ Local" as well as "C: \ Users \ YourUserName \ AppData \ Roaming" and delete any file with a dubious name with the extension .exe. Usually the executables used by CryptoLocker and other types of infections have no meaning in their name, for example they can be called "aldkkgjhoipporh.exe"
After I finished making these steps will need to restart your computer. When you return from restart download and install Malwarebytes, It's run and do a scan. After completing the scan found infections removed from its interface.
How to prevent infecting your computer with CryptoLocker?
To prevent infection CryptoLocker is good to have an antivirus, antimalware, or a security suite updates database containing signatures for viruses to date. Many users are careless and quiet just because I see an antivirus icon in the system tray (bottom right of the screen next to the clock) without ensuring that it is functional or if and when he did the last time updates containing virus signatures .
An extra measure to prevent infection is also CryptoLocker CryptoPreventA small utility that can be installed or can be used as a portable application. CryptoPrevent make some changes in Group Policy to block execution rights executables fate in the% AppData% and%% localappdata and protect against exploits enabled RLO (Right to Left Override)
This tool should be used with caution because a file can block legitimate and may be in% AppData% or% locaappdata%. If it happens that a legitimate file to be locked, you can open the application interface and add the file CryptoPrevent in White List (white list) that will contain a list of files added and you will be entitled to be carried.
How CryptoLocker recover encrypted files?
Unfortunately CryptoLocker recover encrypted files is not guaranteed by any method or software perfectly. It's all about the settings you had and have in operating sistemulde. If you were to infect you all the time System Restore and Previous Versions off, you can not recover encrypted files. System Restore and Previous Versions activated left will allow you to return to a previous state that was the file before it has been infected and encrypted. You can still use Shadow Explorer to learn whether there earlier operating system for encrypted files. If you find one or more files in an earlier infection and you want to restore, right-click on them in the application interface ShadowExplorer option from the context menu and choose Export.
The final conclusion is one. A BACKUP that many users avoid doing it, you would be scutitit all these headaches. Backup files even for vital you keep copies even 10 different locations if needed because you never know how you can lose, either through a bad infection like CryptoLocker, either by a natural disaster (disaster ), theft or simply hard drive gives you someday. There are hundreds of free backup solutions, we have a lot of tutorials on the subject matter you want to save backups of local or cloud services.


Related Tutorials

about Adrian

Flemish information and knowledge, I like everything about art and share my knowledge with great pleasure. Those who give themselves to others will lose themselves but usefully, leaving something useful fellows. I enjoying this privilege, I will never say "do not know" but "not yet know"!


  1. In tutorial about everything that is in the C partition with the extension mentioned are infected (encrypted) with criptolocker, well if we all files, personal folders (pictures, etc..) In another partition can infect them both.? Then it's much easier to solve the problem.

    • Adrian Gudus said

      I propose to look at the tutorial more carefully and without having to rewind!
      I said to delete everything is in C drive or whatever is in the C partition with. Exe be deleted. You must delete only what lies in the locations mentioned in the tutorial, in two hidden folders (as mentioned in the text above tutorial that I recommend you read)
      Infected files and encrypted format. Exe!
      Disinfection is to eliminate registry and some executables (used CryptoLocker) with random name found in two locations mentioned in the tutorial
      If you scroll tutorial and it does not read the text above entirely of convenience or what ever, it is not my problem! Iff not want to understand, to watch and have the patience to digest all the information, it means that you do not need, do not want and therefore I explain why the comments the same things already explained in a tutorial over 30 of minutes and a few good lines of text written above it.
      All your fault and ignorance I fall That's arrogant.

  2. Nene, I didn't ask you if it should be deleted from the game, because I think I spoke quite clearly, did I write in Chinese? I asked if I have a document, a picture or anything else with the extensions mentioned above, in another partition other than C it risks being infected (encrypted) with crytolocker DA or BA if not then you do nothing but disinfect possibly a restore or whatever you do it. In the tutorial you said that everything in game C with the mentioned extension is encrypted or you don't know what you said. And one more thing, to know that I didn't run a second …… nene!

    • Normally, if one who writes malware you want to access other storage locations, and the security of the operating system is low, can access all partitions.
      It is best to breathe in yogurt…
      Adrian's tutorial is pretty clear, if you apply logic can draw other conclusions.
      Malware's behavior is hard to guess, it can change from one day to another, from one system to another. Now it who wrote it and what is hidden intentions.
      I repeat.
      When we talk about viruses, spyware, ramsomware etc 'behavior can not be clearly framed. Today you affect one partition, all partitions tomorrow.

      • Cristi I see you pretty smart man, your colleague's was hard to give an answer at Putnam like you.?? Him all the time about not just run in place to give an answer to the question.
        As boy with snot in milling below so do not send it just talk to infants.

    • May Mucea do not get that you're a little slow in the head and impertinent. That it "is not bad if it's bad enough and arrogant"!

  3. software to decrypt infected files there and if so would take much on a normal pc decryption?

  4. Interesting and useful tutorial.

    If you can make a tutorial about Android namely how can I reinstall android 4.04 (it comes by default) on a Samsung Galaxy Tab 2 P3100 after an update to 4.1.3. (Restoring the default option in the settings by factory, they only keep 4.1.3 and delete only software, in my case). Thank you!

  5. solving the simplest hassle free is to install the first time after a fresh install sisrestore windows and every time you use sisrestore problems that buteaza first at Windows startup and you drop simple. of descarcacati here »» » luck

  6. Adrian sailor said

    My comment was lost in nothing….

    • He didn't get lost in nothingness, I deleted him and he probably went into nothingness. In fact, it is still on disk in the data center, only the entry has been deleted, if ………….
      Let's go back….
      Please do not leave links that refer to specific sites can not be verified easily. These sites may contain malware on other pages.
      Put yourself in our place, we can spend many 10-20 minutes to check a site, just so someone can link.
      If we talk about well-known, serious sites, which neither now nor in the future will be a problem, it's ok for obscure sites….
      We want to keep this place ( clean, clean means that there is no malware and no link here does not refer to a site where it can be malware.
      Therefore do not and will not do link exchange with any website, even if it would bring us benefits.
      Trust is hard won and easily lost!

  7. Hello Cristi How can I copy a Windows 7 Professional from Microsoft on this link,
    I tried a few times and it doesn't work, I don't know what subscriber they need, because I'm tired of them ?! If possible a tutorial on such a topic…

  8. 5 minutes ago, a pop-up appeared, saying "give it to the police" .com for illegal download and I have to pay 300 RON through paysafecard. Interesting, good that I was in a virtual environment 🙂

  9. Hi Cristi …… For a few months now I've been taking something in stride and in most of the pictures I have (I'm not in partition C) Dirty Decrypt appears instead of photography ……. Is there a solution for this problem? …… .. Thank you very much!

  10. narcis2017 said

    I have a problem with my computer if I can my ajuta.calc is 3 ghz intel core cpu i21003.10-box integrated lga1155 ASRock skt61 h1155m-s pl asus ati radeon video card hd5450 1024mb ddr3 64bit. the problem is when the light does not turn on the computer and restart but still the CPU Cooler starts and stops starts and stops and so on. and if I have all the cables out of the hard and cd rw or pulled enjoyable stay and I introduso and eventually starts but if I restart tracing starts but no video card just go with the video card built into the horse and if you leave several hours when it again starts harder external video card but if I restart again not just go with the video card built. I changed the source and now the computer starts fine just the video card is the same as before only works when you turn on but after restart or if you switched it back off and not go just video card built into the motherboard. I hope you can help me with something I did update the bios but nimik. thank you

  11. narcis2017 said

    3.10 ghz MNAM sorry I missed parted above

  12. The problem is simple.
    Once the virus, if you have not done your Backup goodbye to files.
    Disinfection is one, and decrypt data recovery is different.
    It is likely that not even they Crypt only alter their work as serious.
    Phase happened two companies whom encrypted databases.
    Now they work for 6 months the girls did not have in their lives. So that. Backup, Backup, Backup, Backup possibly versioning / snapshot and random rotation.
    Not recommended backup external hard drives connected directly to the system or network hard drives mapping.
    Are altered all files with the extensions given by Adrian dint any location of the operating system.

    Backup is best to do a backup software that can bind to a local account even ftp user and password. This avoids connection mapped drives that are equally vulnerable.

    • Hello,
      Can recover all files without BACKUP.
      On the Internet are simple recovery solutions.
      A beautiful day!

  13. I forgot to say, if that has not been said. Can not open or under Linux or UNIX.

  14. Hi, I did what you said but I do not appear to me in any cryptolocker software .. although I can not open any file extension eg pictures, music, etc.

  15. I did everything you told me but I can not find files in software Krypton
    I think the perfectionalizat virus and not go your way if you can give a teamwiever to see what can be done. Files are encrypted with Ezz, something new

  16. Hi !!! This virus is similar to help_decrypt ??? cryptolocker for me that I gave virus and not know how to decrypt files encrypted !!!!! can you help me with some advice ???? important documents were lost !!!! Thank you !!!! a pleasant evening !!!

    • help_decrypt is a file of CryptoWall, Cryptolocker similar virus. You can try to remove the virus with the help of SpyHunter. A tool downloaded here:
      To recover your files you can try a soft recovery as Recuva. See you recover more tutorials on here on site. You can try to recover files because CryptoWall delete the original file then replacing it with an encrypted copy.

  17. Hello! I got a virus, in which im appear on the desktop a message box with a timer with a minute trickling seconds and told me that if you do not pay a sum in an account I will block and delete all files. I managed to get rid of that virus immediately in exchange can not open any picture on PC. It has the same name, size, format but when I give my crash open something like the format is not supported and I no longer open. And it sucks that I went all the personal archive of photos. I fostmatat PC vain. Thanks.

  18. hello, I love what I do here, but i do not see anything in ShadowExplorer, Why?

  19. Nothing appears to me in ShadowExplorer either… can another program similar to ShadowExplorer tell you?

  20. I was infected with a ransom. put before filename: oorr.
    Does anyone have any idea? tb about this?

  21. Hi Adrian, I also have a bug a while ago, I was infected with a help decrypt virus, I had a separate hard drive for pictures and personal videos, which I connected to the computer only when we added something to it. The hard drive was also corrupted. all encrypted photos and videos… .my brother removed the hard drive from the computer and formatted windows but on that hard drive I still encrypted the photos
    Question can recover photos of him having a system restore us something or other

  22. neluvale62 said

    hello… with a tight heart I tell you like me..I don't know how the hell I was infected with "Help your fille"… and my son reinstalled windows [xp] .. but I can't open the pictures and music anymore… .question: more can I recover the pictures? and how exactly?… .answer please…

  23. Hi, I was recently infected with the "locky" virus. All pictures, my documents have been modified and encrypted. With the help of the "recuva" program I managed to bring their names back but I can't decrypt them. I got the virus from my mail, both my PC and the external HDD were infected. I formatted the PC but I can't afford to lose the documents on the hdd. Do you have a solution?
    Thank you very much.

  24. Hi .. Unfortunately I followed all the steps taken by you but unfortunately my files are not "decrypted" .. Please help me with an answer to the email address: [email protected]

  25. George said

    I found the decryption solution….

  26. caesarbalro said

    decryption solution?

  27. Too bad no one says the solution ..

  28. I got the pictures NOT IN C AND D is encrypted, can restore them

  29. Hello,
    Decrypting files is trivial.
    NO longer a problem so serious.
    Can recover all files.
    A beautiful day!

    • How? Now there details!

    • How to proceed with a virus that encrypts the contents of files on a computer or external hard drive, adds the ecyfaf extension to infected files, if you change the file name deleting the new extension recognizes the previous type of file, but the files for example have ciphertext and illegible , and pdfs open an error?

  30. How to proceed with a virus that encrypts the contents of files on a computer or external hard drive, adds the ecyfaf extension to infected files, if you change the file name deleting the new extension recognizes the previous type of file, but the files for example have ciphertext and illegible , and pdfs open an error?

  31. Geo Nitu said

    Hello, I have a problem with my files were encrypted. I think I made a big mistake, download some music and I woke up the second or third day I opened the computer, I can not see anything. I also did a computer backup but in vain. What's worst is that we had 3 external hard drives connected to the PC and everything in them is now encrypted. Music I could retrieve it with Format Factory, but family photos and movies (which I like to take them anywhere) did not work. All of them have been infected and have the RUMBA file extension. The rest does not interest me, I already formatted the PC, I itereseaza family photos and movies with people dear to me. Can you help me with some advice? How can I recover those files if my PC no longer has problems? Thank you, have a great day!

  32. Geo Nitu said

    Hello, I'm still waiting for an answer to what I wrote above, for the type of files it says "RUMBA File (.rumba) Files exist all, but I can't open them. Those that are .mp3 can only be listened to in Windows mwdia playwr. But what do I do with movies and family pictures? Please help !

  33. Hello My name is FERARU DAN from Timisoara and I have a virus that added me to the .SETO terminations. With SHADOW EXPLORER I managed to recover only from partition C and the rest of the partitions or hard drives did not. How do I manage to see what it is and to recover what it is like on partition C. Thank you very much for your help. With regards FERARU DAN


  1. […] Itself, can't decrypt our files. Crypto Trojan infections, similar to Locky and CryptoLocker, have reached Android. Triada ransomware affects phones with Android 4.4 or older. [...]

  2. […] CryptoLocker, how to disinfect how to prevent and recover files infected with ramsomware […]

Speak Your Mind