Cryptolocker Ransomware on iMac - what are my options?

[OurPuma]

Hi DF

I've come across an iMac with Mountain Lion on it that has the cryptolocker desktop background on it with the message to pay up or face losing your data. The iMac owner did not have any Anti-Virus on it. He has no backup. . The owner has admitted being on 'adult' sites.

What are my options? I was aware a few months ago that you can't get the data back once this has been installed as it encrypts the contents of your HDD. Is this still the case? Can I get this key (fat chance!!)

And can i just install OSX on the same HDD from scratch and it wipes his data along with the Cryptolocker virus? That way he can at least use his iMac again....

(I am used to dealing with Windows, not OSX. )

And when OSX is re-installed - what malware/AV protection do you recommend - preferably free. I normally use AVAST Free or Kasperksy AV on Windows machines.

[DejaVu]

Cyptolocker is Ransomware. Never heard of a Mac getting infected by it though TBH.
It mainly targeted Windows systems due to some seriously easy exploits which I believe have since been addressed.

Reinstalling and wiping the Mac will get rid of it, but he will lose all his stuff (porn downloads).

The Key = https://www.decryptcryptolocker.com/

BBC SOURCE

Malware on Macs is very rare and looks like your mate has been seriously hitting some really dodgy sites to get infected with Cryptolocker.
Personally I don't think it is Cyptolocker, it's probably a fake program stealing it's Identity.

[evilsatan]

Eset Cyber Security Pro is what I use for Macs but that's because they are my preferred vendor on PCs (and I am a partner, but that doesn't affect my advice, most here agree on Eset). You can get a free trial:
http://www.eset.co.uk/Download/Software/Product/MACP

Eset, Sophos and Avast Free all scored 100% on the most recent OSX AV-Comparatives tests:
http://www.av-comparatives.org/wp-co...ew_2014_en.pdf

[OurPuma]

Thanks guys for the quick reply, I will take a look at submitting an encrypted file through that website and see what happens.

And get some malware protection on there too....and maybe check his internet history LOL

I haven't actually got the imac as yet but will get back to you when i know more.

[plug1]

If all else fails just rebuild osx from network

[OurPuma]

Ok, this is weird. The iMac works beautifully. The owner swears blind that what he saw was like a warning logo on his desktop background telling him his files were locked but I have seen none of this. Must just have been a false alarm?

I ran some virus scans with the BitDefender Virus Scanner via the AppStore, it found a couple of bugs in his Downloads folder and deleted them. Then I installed Avast Free for Mac and ran a full system scan and all was clear. Also ran CCleaner.

I have told the owner to take a screenshot if it ever happens again.

So i guess it wasn't what i thought it was... phew

[DejaVu]

I thought a Mac being infected by Cryptolocker was a bit weird.

[Mystical_2K]

was it not just a popup from a website perhaps? not a huge MAC user so not sure if that happens the same as windows