Free Service Helps CryptoLocker Victims Recover Files

FireEye and Fox-IT have teamed up to provide a new service to assist users whose computers have been infected with the notorious CryptoLocker ransomware.

CryptoLocker has been designed to encrypt the most important files found on infected computers and keep them that way until victims pay the ransom demanded by the attackers. The threat has helped cybercriminals make millions of dollars from internauts and companies located all over the world.

In June, law enforcement agencies and private sector companies announced that a major takedown operation targeting the Gameover Zeus botnet had also hit CryptoLocker. While new infections have been prevented, there are still a large number of users whose files remain encrypted.

FireEye and Fox-IT have managed to obtain many of the private keys associated with the malware, so they’ve launched a free service which they’ve dubbed DecryptCryptoLocker. The service provides users with the private keys needed to decrypt the files encrypted by CryptoLocker, and assistance on how to use them.

In order to recover their files, victims must first identify one encrypted file that is unlikely to contain any sensitive information. They must upload the said file to the DecryptCryptoLocker portal, and provide an email address to which the private key can be sent.

Users are then instructed to download a command-line tool called Decryptolocker.exe and wait for the key for their encrypted files to be delivered via email. Once the key is obtained, the tool must be executed in the Windows Command Prompt by using the following syntax: Decryptolocker.exe –key “”

In a blog post published on Wednesday, FireEye has clarified that there are several CryptoLocker variants and it’s possible that the DecryptCryptoLocker tool will only work for some of them. Furthermore, while the companies have obtained a large number of keys, there’s no guarantee that they’ll be able to help all victims.

“We are excited to work with Fox-IT to offer a free resource that can help thousands of businesses affected by the spread of CryptoLocker over the last few months,” noted Darien Kindlund, director of threat intelligence at FireEye. “No matter the type of cyber breach that a business is impacted by, it is our goal to resolve them and get organizations back to normal operations as quickly as possible.”

“The criminals continue to push the boundaries; Fox-IT’s InTELL team and FireEye have shared expertise and investment to deliver a free service that demonstrates there are plenty of good guys who are there to help those who are the victims of the criminals,” explained Andy Chandler, senior vice president at Fox-IT.