Malware: CryptoLocker

Question

The forums is buzzing with this new malware doing the rounds called CrytoLocker.  Encrypting your files after a set time unless your pay a ransom.
I have tried to find some kind of resolve on the Microsoft sites, google search etc without success.  My Question is simply this:
Does SCEP detect this malware?  If so what does SCEP ID the malware?  Some entities state that your files can be de-crypted, is this true?  If so what is the process?
Many thanks
Avron Lucas
IT Security Consultant
Pick n Pay
Cape Town

Answer 1

Hi,
Based on my research, this malware has already been detected by MS. And the malware has a very high level in MS.
Detailed information for this malware is in the link below:
http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fCrilock.A
http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan%3AWin32%2FCrilock.B&ThreatID=-2147283704
Additionally, it is encrypted by RSA2048. It is difficult to de-encrypt the file if you do not have private key.
You can also refer to the link:
http://social.technet.microsoft.com/Forums/en-US/9ebd3aad-2f1a-4309-a274-9355c37c9a6a/deencryption-of-cryptolock-ransomware-encrypted-files?forum=perfmon
Best Regards
Quan Gu  
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.