Removing the Maktub virus

[Twitcher 10]

Anyone had experience of this vile ransom encrypting virus.

 

Currently considering spyhunter to eradicate?

[IT-Smith 10]

Malwarebytes Anti-Malware detects this threat as: Ransom.Maktub.

 

https://blog.malwarebytes.org/threat-analysis/2016/03/maktub-locker-beautiful-and-dangerous/

 

https://www.malwarebytes.org/antimalware/

 

It will just clean the virus of your PC, not decrypt your files.

 

I would dban all harddrives in the PC, and reinstall to make sure it is gone. And scan all other PC's on the network if you have any.

 

http://www.dban.org/

[Jomie 30]

The Radio 4 programme 'You and Yours' discussed Maktub today. The programme is well worth listening to and it can be found on Listen Again. It is well worth listening to.

[geared 298]

You can't 'clean it off' yet, it encrypts your files and you need the decryption key to undo it's work.

 

Usually AV firms will crack the encryption and release a free program to get your files, but it will take some time.

 

Until then you can't and shouldn't use the computer, shut it down and leave it be.

or wipe the hard drive and install a backup you made??

or wipe the hard drive and install a fresh version of windows.

[Obelix 11]

I wouldn't expect the AV firms to crack the encryption. Properly done this sort of attack is not undoable. There have been a few cases where the code is sloppy and the decryption keys can be found but they are rare

 

If you don't have backups the only way you are going to get the data back is to cough up to money, distasteful as it sounds.

 

Otherwise if you do have backups - it's make sure they are safe, and then wipe everything with Dban or similar tools, and rebuild and restore from backup. Neither are fun propositions though

[Jomie 30]

For those who aren't aware of how this can be prevented from taking over a computer:

* Never click on an attachment in an email unless you are expecting it and are 100% sure who sent it and why it was sent.

* The same applies even if the email contains your name and/or address.