Post CBT Locker

[xXDeltaXx]

I guess this is the best place to ask...(?) Or, can someone be kind and move it to the best place

 

I've got a work mate's laptop which has been infected with CTB Locker... any suggestions?

 

I had a read around before turning it on, and have killed any exe I could find from safemode with command prompt, then have installed a few anti malware / anti spyware programs & it seems that the infection is now gone. However, obviously, there's still a load of encrypted files.

 

I know that the OS is probably shot and will need a reinstall (Windows 8...), but I had hoped to try and get anything back that I could before wiping. Some files are not encrypted, so I'd hope that they are OK. I had heard (wrongly, it appears) that the encryption needed to create a duplicate which was encrypted, and then delete the old one - so a recovery program (Recuva for example) may be able to get said files back. Either Recuva isn't good enough, or that is not true in this case.

 

In short, can anything be salvaged? Can anything that has been encrypted be recovered? The files are ".bqfzddk" if that contributes anything useful... Yes, I am going to wipe and start a fresh.

 Thanks

 

[Guest]

This may help. CBT's are notorious for their difficulty to remove.

 

 

If no luck then boot through a linux live CD and delete the CTB locker files.

[JeffreyEagan]

My question is how do you even get CTB locker.

[adman29]

My question is how do you even get CTB locker.

Very carefully my friend, very carefully. 

(Usually through different exploitations in websites, and clicking on really sketchy links)

[TDP_Equinox]

If they are actually encrypted, forget about it. They are gone. 

If they are just hidden, then you can easily get them back with a live linux distro. 

[TDP_Equinox]

My question is how do you even get CTB locker.

By clicking without reading. So much freeware comes with stuff like this and people see free and just click click click without reading. 

 

[xXDeltaXx]

Yeah, he doesn't know how he got it - thinks maybe something from Alibaba.com... not sure if he fully understands how it will have been triggered.

Thanks for the help / confirming what I thought the situation is.

[TDP_Equinox]

Yeah, he doesn't know how he got it - thinks maybe something from Alibaba.com... not sure if he fully understands how it will have been triggered.

Thanks for the help / confirming what I thought the situation is.

Don't forget to mark the topic as solved!