We recommend this video because Mark has pitched it perfectly: he doesn’t rush he doesn’t talk down to you he lets the facts speak for themselves and he brings an air of calm authority with just a touch of wry humour to what is a rather serious subject: However, we know you would love to see what it does and how it works, so here is a video made by a our friend and colleague Mark Rickus, of Sophos Support.

We therefore recommend that you don’t try the malware out yourself, even if you have a sample and a computer you don’t care about, because you can’t easily test it without letting your computer converse with the crooks. You may want to keep the article open in another tab or window to refer to while you read this page.ĬryptoLocker reveals itself only after it has scrambled your files, which it does only if it is online and has already identified you and your computer to the encryption server run by the criminals. It covers: how the malware “calls home” to the crooks, how the encryption is done, which file types get scrambled, and what you see when the demand appears. → Our detailed article is suitable for non-technical readers. To understand how CryptoLocker goes about its dirty work, please see our step-by-step description. The fee is $300 or EUR300, paid by MoneyPak or BTC2 (two Bitcoins, currently about $280). The decryption key is unique to your computer, so you can’t just take someone else’s key to unscramble your files. 72 hours, or three days) to pay them for the key. The criminals retain the only copy of the decryption key on their server – it is not saved on your computer, so you cannot unlock your files without their assistance. (These threats can usually be unlocked without paying up, using a decent anti-virus program as a recovery tool.)ĬryptoLocker is different: your computer and software keep on working, but your personal files, such as documents, spreadsheets and images, are encrypted. Some ransomware just freezes your computer and asks you to pay a fee. It also explains how to improve your security against this sort of threat in future.ĬryptoLocker, detected by Sophos as Troj/Ransom-ACP, is a malicious program known as ransomware. The article tells you about prevention, cleanup, and recovery.

This article explains how the CryptoLocker ransomware works, including a short video showing it in action.

How to decrypt the crypto locker virus