5

A ransomware appears to have been circulating for the past few weeks. It encrypts data files and creates a BUYUNLOCKCODE.txt ransom note in all directories where a file was encrypted.

This buyunlockcode.txt file contains instructions and an email that you must contact to receive payment instructions. Known email addresses are nick.jameson@expressmail.dk and ChiuKhan@tom.com, though these will most likely change over time. At this time, the ransom amount is unknown.

The text of the BUYUNLOCKCODE.txt is:

Hi, your ID = JSOXXXXXXXX

All important files were encoded with RSA-1024 encryption algorithm. There is the only way to restore them - purchase the unique unlock code.

Warning! Any attempt to recovering files without our "Special program" will cause data damage or complete data loss. As we receive your payment, we will send special program and your unique code to unlock your system.

Guarantee: You can send one of the encrypted file by email and we decode it for free as proof of our abilities.

No sense to contact the police. Your payment must be made to the e-wallet. It's impossible to trace. Don`t waste your and our time.

So, if you are ready to pay for recovering your files, please reply this email ChiuKhan@tom.com

Then we will send payment instructions.

Does anyone have any idea how to solve this problem?

Improve this question
12
  • 2
    If your files are already encrypted you don't have any options except to pay. If you have an offline backup of your files that is one of your only options.
    – Ramhound
    Jan 12, 2015 at 12:54
  • 2
    In all the cases I've looked at, the senders of the ransom have actually lived up to thier promise and sent everything needed to undo the encryption. Most of these gangs actually run these schemes like a business, and as such want to be respected by thier peers. Groups that do this, and screw people over actually get run out of the scene quite quickly, there is quite a strong code of ethics among them all, even if what they do is a very bad thing.
    – shawty
    Jan 12, 2015 at 13:25
  • 3
    @hsawires - You are worried about a backdoor client when you are already infected. The message they display pretty much says that your already infected with an infection that provides them a backdoor to your system ( since they have the ability to send additional payloads ). While your concern that sending them money is justified if you don't have a backup of those files, and the monetary lost of those files is greater then what they are asking for, then you don't have any other option.
    – Ramhound
    Jan 12, 2015 at 13:54
  • 1
    Remove the machine from the network. Pay or don't - that risk is up to you. Then, think how you got the infection and learn from the mistake (if you know?). Either way, nuke the machine, meaning, a total reinstall and then, as Ramound suggests, get your files from a backup. Remember, even if you remove the virus, you don't know what the virus did - yes, you know if encrypted files, but you don't know if it did anything else! Hence why a re-install is so important.
    – Dave
    Jan 12, 2015 at 14:28
  • 2
    @hsawires - If your accounts were not Administrators and you had ShadowCopy enable, its might be possible to restore your files, files encrypted by a similar malware Cryptowall ,can be recovered by using that feature. Its worth a try.
    – Ramhound
    Jan 14, 2015 at 13:11

2 Answers 2

Reset to default
3

Your question is

How to remove BUYUNLOCKCODE Ransomware

The answer: Use an antivirus program.

However, your post has other questions. You have no idea what other things the virus could have done to your machine. Just because you can see the files are encrypted doesn't mean it hasn't done anything else you're not currently aware of.

If the files are encrypted, you can't get them back (I use the word can't loosely, I should say highly unlikely (near impossible, especially without the right equipment and knowledge (and time))). This is why you would have to pay for the key, but there is the doubt you will get the key even if you do pay. However, it's usually in their interest to restore the files as it gives the attackers a (ironically) trustworthy reputation that they stay true to their word (meaning other victims will pay).

Regardless, after you get the files back or not, you need to wipe the machine, reformat it totally. Then restore the files from a back up (or at least from now on, always have a back up).

I should also point out when infected with things like this, it's very important to remove the machine from the network as these types of viruses often spread easily.

Improve this answer
5
  • as fa as i know. it is not what we call it "virus" as it known . it is a kind of a thired party routine using the browser to execute the encrypt software in the system to encrypt any opened document. but your answer is not helping "removing", your answer is helping to accept the damage :) . and it sounds to be the only way.
    – hsawires
    Jan 12, 2015 at 15:01
  • 2
    You can't (as far as I know) encrpyt files via the browser. First off, it's not possible using things like JavaScript (HTML5 provides a file upload but only upload). I guess it could be done using exploits in either Flash or Java but what you've described should have triggered your AV... Whilst it could be due to something in the browser like a plugin, this is IMO a virus (or at least malware (malicious software)). I'm sorry there is no good news for you :(
    – Dave
    Jan 12, 2015 at 15:16
  • Thank you Mr. @Dave ... is it possible to write a process protecting and defeating such a kind of malware? for sure there is some precautions before infection and some proceedings after infection. something at least to stop spreading the wildfire. Thanks in advance.
    – hsawires
    Jan 12, 2015 at 15:50
  • 2
    @hsawires - The best way to prevent this type of infection is top stop any connection from domains known to serve malicious software. Your current security software does not do that.
    – Ramhound
    Jan 12, 2015 at 17:25
  • 2
    The ransomware in question is actually a trojan, written in C and then double packed using the UPX file packer. The payload is delivered by appending it onto the end of a gif file who's headers are then forced to cache the image. The user of the page is then tricked into executing a rat (Remote access trojan) which then looks in the cache (Obtained from the sniffing the browser UA) extracts the packed code from the end of the gif, and executes it, at this point it's game over because you now have a platform that's re-usable, hence why I recommend getting files onto a clean PC.
    – shawty
    Jan 12, 2015 at 17:33
3

It's not good news I'm afraid, but there MIGHT be some things you can do to help.

The first thing you need to do is to take the infected operating system offline.

There's a very good chance that as well as encrypting the files, the perpetrators have also installed some software which will be loaded into your operating system when it's booted up, this software will most likely be set up to watch the encrypted files, so that if they are tampered with it can take appropriate action.

What you need is a clean windows PC that boots up with no infections present, then you can take the hard drive from the infected PC and install it into this clean PC.

You must make absolutely certain that you DO NOT run anything on the infected hard drive, and this means also things like word documents, html pages, java script files as well as the obvious ones like EXE files.

Copy the files that you want to recover (Don't bother with operating system/windows files or program files, you'll be re-installing those later), even if the file is encrypted you might stand a chance of discovering the encryption key.

Once you've copied the files you want to try and recover, disconnect the infected hard drive so there can be no accidents in getting the virus onto the clean PC.

From that point on, if the files you've recovered are not encrypted than great, back them up safe, and thoroughly wipe the infected hard drive, re install windows and your apps and copy your recovered files back.

If the files you recovered are encrypted, then you need to find a way of working out exactly how and a way in which you might be able to undo the encryption.

The important thing here, is to get the files onto a clean computer, while it's not a full solution, it should get you at least to a position where you can examine and attempt to undo the encryption without fear of loosing your operating system all together.

Once you have your files on a clean PC, it might just be a case of finding a program that decrypts files encrypted with RSA-1024, and tries different codes until it finds one that works.

If you have any programming skills, windows has built in operating system routines in the .NET framework that can decrypt RSA data of different types, you might be able to write a small program that goes through trying different codes.

It would also help if you knew the format of "A code", is it just a straight number, is it a string of numbers and letters, if you know that it's always 6 digits then all you have to try are combinations from 000000 to 999999, sure it'll take a long time but if your file is important then it's time well spent.

Remember too that many of these criminal gangs are users of the malware, and not the creators, so many of them are actually just "Business Minded" looking to make money, this means there going to rely on what the malware can do, but generally won't be in a position to make it do anything extra.

This means if you can shut it down, then you at least remove their ability to further control the situation, and once you do that, then you generally remove their ability to kill everything on the PC should you not pay.

If you do end up paying and get a code and app to remove it, post it somewhere for others to use, I've heard of a few cases where the same code will unlock multiple infections due to the way the software works, so the more of these codes and unlockers we push out into the public domain for others to try, the harder we make it for these people to hold folks to random.

In summary, before you attempt to do anything, get your files onto a clean PC, only then can you begin to move forward.

To the best of my knowledge, at present there is NO UNIVERSAL FIX to reverse this malware, there are tools to remove the infection, but these tools still leave the user with encrypted files.

Improve this answer
10
  • 7
    Please don't tell me you are actually trying to suggest that attempting to brute force a passphrase of an unknown length is actually going to be possible? Most of this answer isn't technically correct, for instance the ability for .NET application to decrypt RSA encryption, you have to provide the passphrase/key.
    – Ramhound
    Jan 12, 2015 at 13:57
  • Actually yes I am, what's wrong with trying to brute force? Nothing at all. It might take a long time granted, but applications like john the ripper running on a suitable GPU can perform anywhere from a few hundred, to a few thousand attempts per second, I know because I've tried it, and what's more I've had limited success too, not with this case but certainly with similar encrypted files problems. With that out of the way, let's move on to your comment about a .NET application not being able to perform RSA decryption. Sorry to say this, but it is you who are wrong. (cont)
    – shawty
    Jan 12, 2015 at 17:18
  • 3
    RSA was broken years ago. There are optimised algorithms and specialised hardware configurations used to speed it up. By using multiple machines you can produce rainbow tables in the manner of L0pht crack to speed things up.
    – Stevetech
    Jan 12, 2015 at 17:40
  • 3
    read this security.stackexchange.com/questions/47497/… RSA has been broken on numerous occasions. It's not trivial but it can be done.
    – Stevetech
    Jan 12, 2015 at 17:50
  • 1
    As far as I can see there are no inaccuracies in my post, the only thing that seems prevalent here is the fact that you disagree with what I'm saying. None of it is in anyway shape or form technically inaccurate. Not to YOUR liking, I agree, and as I know all to well there will always be people who disagree with my outlook on things beacuse I'm the type of person who's happy to go out on a limb, on the off chance that something might just work, NONE of it however is technically inaccurate and unless you can actually point me at a technical article from a trusted source that says otherwise
    – shawty
    Jan 12, 2015 at 19:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.