r/computerviruses • u/LucasRFA • 12d ago
Disinfection Help I got hit by loki locker
Could someone help me? I'm a content creator and I just finished a video that took me 3 months. I tried to contact some people for help but they are charging me money.
I contact them from Telegram and WhatsApp. There is no free tool to decrypt the files as it seems.
My PC is disconnected from the internet as well.
40
u/Zeifereskara 12d ago
How did you get hit by Loki Locker?
53
u/LucasRFA 12d ago
Probably by downloading cracked filmora months ago. I'm reckless.
Never doing that again. I'm fully responsible
29
u/choppytaters 12d ago
I think after this you should just buy a copy of davinci resolve
30
9
2
u/LucasRFA 12d ago
I don't know if I'm gonna keep editing my own videos from now on, I just edited by pure necessity and demand. I dislike kdenlive and I have no experience using davinci, my videos are heavily edited (I do video essays) and Filmora did the job very well.
I was just gonna finish this video, make a backup and format it. As soon as I finished and went to sleep, the next morning I get greeted by the ransomware.
I dual boot with Linux because I have a Steam Deck OLED, but my Linux side got corrupted, so I had to cope using Windows for a while before reimaging the SSD entirely.
Guess I didn't finish it in time huh.
2
10
32
u/rifteyy_ Malware Removal Expert 12d ago
LokiLocker is a Ransomware-as-a-Service (Raas) written in .NET and targets Microsoft Windows devices. The malicious software uses AES and RSA encryption, is protected with NETGuard and KoiVM, and threatens to delete files and overwrite the MBR if the ransom isn't paid within the specified timeframe. LokiLocker achieves persistence by creating a scheduled task to execute at every logon, adding an entry under the Run registry key, and adding a copy of the malware to the Startup folder.
It's likely that the files aren't possible to be decrypted.
6
u/LucasRFA 12d ago
Is there anyway to restore to an old version of the files? Or at least recover them after formatting my system?
12
u/cyberwraith81 12d ago
Did you have back ups not on that system. If yes than yes. If no, you learned why you should back up important files on external media.
7
0
9
u/Ok-Designer6753 12d ago edited 12d ago
Lets say i get this in my pc but i have nothing important on my pc , can i not just delete windwos and install it again and be fine?
8
u/Octoomy 12d ago
A full format and reinstall would work
2
u/Ok-Designer6753 12d ago
Nice to know , so i dont have to worry ablut this loki
1
u/Active_Homework4950 12d ago
You’d want to change all passwords and what not as well. Assume they have access to to anything and everything just to be safe
6
u/Round-Diamond-9348 10d ago
I got hit with a .eight malware years ago. Got my entire NAS. I kept the encrypted files and since the majority was media, reclaimed it. Though it cost me time and a copyright lawsuit in the end. Long story short, a number of years later Japan police released a .eight decrypter and I was able to get my personal data back. I know it doesn't help now but keep a copy of any important data and likely you'll be able to retrieve it one day.
2
3
u/uuniherra 12d ago edited 12d ago
Check if it has been cracked yet, and get the decryptor, also do a clean install of windows. And reset your passwords. Let this be your reminder to always back up your files.
Edit: It hasn't been cracked yet so copy the encrypted files and hope for a day it has been decrypted...
Remove it from the internet, it can spread through your local network.
AND REINSTALL WINDOWS THROUGH USB!!
1
u/Odd_Act_7673 12d ago
Just curious any idea where the virus came from?
1
u/LucasRFA 12d ago
I have no idea. I'll check this out with some guys my friend knows. They are experts in cybersecurity and will try to help me this weekend
3
u/Odd_Act_7673 12d ago
The files would have locked instantly after you opened the infected file unless it had a delay timer
2
u/Odd_Act_7673 12d ago
Did you download any .exe files recently?
3
u/LucasRFA 12d ago
I didn't. As I said in another response: maybe it has something to do with the cracked Filmora I downloaded months ago
3
u/Odd_Act_7673 12d ago
Yes cracked software now adays is almost always binded with malware that is like a bot loader let's them mass control PCs and then they silently install other files.
7
u/jordyytje 12d ago
Months ago? My biggest nightmare is having a virus that is currently slumbering on my pc lmao. Always check for stuff like task manager/any info being send out to weird IP addresses etc, still always feel hella unsafe lol
2
u/Odd_Act_7673 12d ago
Yes I keep a tab on the traffic that's the best tell talk sign inbound and outbound packet logging
2
u/Relative_Structure_1 12d ago
Op said it might been almost a year too😭 this made me anxious
1
u/Significant_Shop249 11d ago
yeah honestly that's crazy, might start reinstalling windows periodically cuz wtf
1
u/mildly_perturbed31 11d ago
at this point, there is only 2 things, either the ransomeware overwritten the files(many ones do it as they never care about unlocking the computer back) or actually encrypted it, if 2 is the case you may get to recover keys, you should find reports or ppl that have rev engineered the ransomeware to know how it encrypts and make a decryptor for it
1
1
u/Mulhequi-PT 1d ago
Oi, tu é br ou tou esquizofrénico?
Se for deve ser mais fácil explicar, mas se puder responde em pt ou br.
Tu has been infected by a ransomware, a virus that locks your files and asks for a payment or in monero (cryptocurrency) or bitcoin (cryptocurrency), almost always he just wants to scam you and doesn't give you back, so you lost everything, I don't know if you also lost bank or personal data but it's unlikely. But that's all :) Now just reinstalling Windows and praying.
bye
1
u/LucasRFA 15h ago
Sim, sou brasileiro.
Há um engenheiro de cibersegurança que está me apoiando IRL. Ele fez a cópia da imagem e vai tentar recuperar aquilo que conseguir.
Já pesquisei extensivamente acerca do ransomware, inclusive em fóruns mais ocultos. É um caso perdido, praticamente.
1
u/AutoModerator 12d ago
Request help with FRST and SecurityCheck from the trusted helper team
Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.
If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:
- From a different and clean device, change all your passwords:
- Disinfect your device from malware
- Preferred method: Perform a clean installation with a USB
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
61
u/FERAL_WASP 12d ago
Most of the people who make these ransomwares don't actually bother to make a way to decypt the files. They have no reason to. The victim paying them is the only thing they care about, so once payment is made it makes no difference to the hacker if the files are actually decypted or not.