My friend needs help!

[skljom]

Hello guys. My friend recenlty got ransomware, malware or adware called Locker v4.10 and it encrypted all his .jpeg and .docx posts. I used MSE and malwarebytes but all it did is it  removed trojans and adwares and malwares, but the files are still locked and encrypted. I've tried this: http://deletemalware.blogspot.com/2015/05/how-to-remove-locker-virus-and-restore.html  but it won't work at all . . . It deleted his restore points, shadow copies and everything. He's got full HDD of his family and friend pictures, around 10 000 pictures . . . Can you help?

[Atmos]

If his files are really already encrypted then that's pretty much it. 

 

To test if the ransomware is really gone, try creating a new jpg to see if it gets encrypted.

[mrswagbhinav]

http://deletemalware.blogspot.com/2015/05/how-to-remove-locker-virus-and-restore.html

[skljom]

http://deletemalware.blogspot.com/2015/05/how-to-remove-locker-virus-and-restore.html

Tried, doesn't work...

[Firestorm]

He needs to try and find a backup of the files, if he doesn't have one, then all hope is lost. Next step is to remove them all and establish a backup solution

[skljom]

He needs to try and find a backup of the files, if he doesn't have one, then all hope is lost. Next step is to remove them all and establish a backup solution

He doesn't have backup

[TheHeloy]

it might be a little bit crazy or useless, but what you can do is try to make a dual boot and use a hdd recovery program to decrypt, access the pictures and copy them to an external hdd.

[Atmos]

it might be a little bit crazy or useless, but what you can do is try to make a dual boot and use a hdd recovery program to decrypt, access the pictures and copy them to an external hdd.

 

Unfortunately, this isn't scifi. Encryption and decryption are not as straight forward as pop culture wants to think.

When you encrypt something, you use a special formula or code, then to decrypt it, you need to have that source code or dictionary to understand what the now encrypted code means. 

there are ways around this, for a very simple encryption you might be able to get away brute-forcing a solution. (i.e. trying every possible combination of letters and characters for a set number of spaces, hoping to find the encryption formula so it is.)

 

:TLDR: He needs the special "codec" to decrypt it, or it will take a very, very, very long time.

[Gala]

Basically you are screwed because you removed the malware. There is an option to pay some cash to decrypt everything (XXX$), now you are officially fucked.