The Anti-virus Times

Thursday, October 20, 2016

Take a look at what users who’ve suffered encryption ransomware attacks write about. Many messages show what one should NEVER do!

• In fact, no anti-virus was installed on the user's machine. I will get this fixed when I sit down and talk with this user. Please help! Thanks in advance.
  Russia
• Downloaded an archive file from an email. After that, all my Word and Excel documents and images were encrypted; the extension was 1TXT.
  Russia
• The encrypted files have the extension 1txt. Opened a dubious email and everything started being encrypted.
  Russia
• On 10/10 at around 11:00 AM, I received an email in my Yandex mailbox, opened it, and the encryption happened.
  Russia
• Today, I opened an attachment and all my DOC and XLS files got the extension VAULT.
  Russia

• Here is the text of the message I received: "Dear entrepreneur!. We hereby notify you that your Company *** with the registered address *** is violating the laws of the Russian Federation. (art.336.16 of the Russian Federation tax code). We attempted to contact you by phone (…), however, no one answered our calls. Please review your case materials attached herein. [!] NT-Print.docx
  The file that corrupted all my data has the following name: 749f

  Please, see what you can do. We will pay you for your work. Thanks in advance.
  Kazakhstan

• Any assistance on your part will be welcome because I couldn't decrypt the files on my own. You are my last hope. Do what you can.
  Russia
• I received an email, opened the link, and a program was launched. After that virtually all the files on my computer became encrypted and their file name extension was changed to .1txt. I tried to change the extension, but the files wouldn't open. Please help. Unfortunately the hard drive is already formatted and a new operating system is installed.
  Russia

• I really need your help.

  I discovered the malware vault on my computer.
  It encrypted my Microsoft Office documents and photos.

  The problem was that no password prompt was displayed. First I had to install their browser and open a URL, but I didn't want to do that.
  I can't attach a screenshot because, after installing dr.web, the anti-virus is blocking them.
  I can only attach vault files. I've found a few of those: hta, vault.key, confirmation.key.

  Many thanks for your help.
  Please advise what I should do.

  Russia

• Encryption ransomware has attacked my computer.
  The message text is as follows:

  ATTENTION!
  Your computer was attacked by trojan called cryptolocker. All your files are encrypted with cryptographically strong algorithm, and without original decryption key recovery is impossible.
  To get your unique key and decode your files, you need to write us at email written below during 72 hours, otherwise your files will be destroyed forever!

  Russia
• The system was infected at the time I was looking for WiFi scanning tools.
  Spain
• Malware got into my system via the local network. A message was opened on another machine and all the hosts on the network got infected
  Russia
• Hello. I received an email, opened it, and my system got infected. No ransom demand was displayed. [name of another anti-virus] sprang into action, but none of my Word and Excel documents would open, and their file name extensions changed to *.doc.vault
  Russia
• I never used an anti-virus (Editor’s note: an archive was simply attached to the request)
  Russia
• Please i need help to rescue my infected files and i don't have a backup of this. Thank you
  Brazil
• Please help restore files that have been encrypted by the malware VAULT
  Russia
• As usual, I got infected with Vault via email; managed to delete it when 90 percent of my files were already encrypted.
  Russia
• Hello! Received an email on my office machine, opened it, and was disappointed!
  Russia
• I carelessly opened a script I received by email (the sender’s address was on my trusted list). Please help.
  Russia
• Hi, the files are infected with Crypt0l0cker. Before the infection, there was NO anti virus software on the computer. Norton Internet Security was purchased - when it was being installed, Crypt0l0cker appeared. Norton then removed the Crypt0l0cker virus. But the files remain encrypted.
  Australia

• Sehr geehrte Damen und Herren,

  Bitte testen Sie, ob Sie die Möglichkeit haben diese Dateien zu entschlüsseln.
  Danke

  Austria
• All the databases on the server have been encrypted. The encryption occurred on about 08.10 -09.10
  Russia
• Good afternoon! An employee received an email with an attached archive file. The message was marked as urgent. The archive contained a .js file. After that the malware VAULT infected the system, encrypting all the files. Help cure and decrypt the data. I deleted all the VAULT files (except those that were encrypted). Samples of these files are attached to this message.
  Russia
• Office and .jpg files have been encrypted; the extension .vault has been appended to the file names. vault.key and vault.hta and 3 encrypted files are attached to this message. Help!!!!
  Russia
• Hello! [name of another anti-virus] missed a Trojan, and it has encrypted my files (JPG photos and PDF, DOC, DOCX documents). Please help me recover them. Two samples of encrypted files and their unencrypted copies are attached to this message. Thanks in advance for any help!
  Russia