Endpoint Protection

 View Only
  • 1.  How to remove Bitcoin(btc) using SEP 12.0

    Posted Jan 22, 2015 03:40 AM
      |   view attached

    Hi all,

     

    How to remove Bitcoin(btc) using SEP 12.0

     

    my office files are encrypt by (eawbhcl) file format. 

    Please help..



  • 2.  RE: How to remove Bitcoin(btc) using SEP 12.0

    Posted Jan 22, 2015 03:43 AM

    You can't receover your file.

     

    See below blog

    Support Perspective: CTB-Locker and other forms of Crypto malware

    https://www-secure.symantec.com/connect/blogs/support-perspective-ctb-locker-and-other-forms-crypto-malware

    see same problem thread

    https://www-secure.symantec.com/connect/forums/nbmlqon



  • 3.  RE: How to remove Bitcoin(btc) using SEP 12.0

    Posted Jan 22, 2015 06:29 AM

    This is a variant of cryptolocker. SEP does not and cannot recover your files. Unless you have a backup, they are likely gone. Are you running IPS/firewall/SONAR/Download Insight in addition to AV?

    See these:

    http://www.symantec.com/business/support/index?pag...

    https://www-secure.symantec.com/connect/blogs/rans...

    https://www-secure.symantec.com/connect/forums/new..

     



  • 4.  RE: How to remove Bitcoin(btc) using SEP 12.0

    Posted Jan 22, 2015 11:47 AM

    Hi aprasanna,

    This is indeed the malicious campaign which Symantec has been warning about.

    New article: CTB-Locker and other forms of Crypto malware
    https://www-secure.symantec.com/connect/forums/new-article-ctb-locker-and-other-forms-crypto-malware

    Please see if you can identify the incoming mail, typically pretending to have a fax attachment, which caused the infection.  If this is not already detected, please do submit it to Security Response!  This will not help to decrypt any documents already sabotaged (those need to be restored from a known good backup) but it will help to spare others from falling victim to the same threat.

    These articles may help as well:

     

    Recovering Ransomlocked Files Using Built-In Windows Tools

    https://www-secure.symantec.com/connect/articles/recovering-ransomlocked-files-using-built-windows-tools

     

    Ransomcrypt: A Thriving Menace (aka Cryptolocker: A Thriving Menace)

    https://www-secure.symantec.com/connect/blogs/ransomcrypt-thriving-menace   

     

    Cryptolocker Q&A: Menace of the Year

    https://www-secure.symantec.com/connect/blogs/cryptolocker-qa-menace-year   

     

    First Response to: Cryptolocker \ Ransomcrypt\ Encryptor

    https://www-secure.symantec.com/connect/articles/first-response-cryptolocker-ransomcrypt-encryptor

     

    Also:

     

    The Day After: Necessary Steps after a Virus Outbreak

    https://www-secure.symantec.com/connect/articles/day-after-necessary-steps-after-virus-outbreak

     

    And:

     

    A good Connect forum thread on how to protect yourself: https://www-secure.symantec.com/connect/forums/cryptolockercryptodefense-defenses

     

    With thanks and best regards,

    Mick