DecryptorMax Ransomware Decrypted, No Need to Pay the Ransom

Softpedia ^ | 28 Nov 2015, 10:31 GMT | Catalin Cimpanu

[Utilizer]

...

Fabian Wosar of Emisoft has created a tool capable of decoding files encrypted by the DecryptorMax ransomware, also known as CryptInfinite.

The ransomware gets its name from the fact that the "DecryptorMax" string is found in multiple places inside its source code. Additionally, the CryptInfinite moniker is also used by some researchers because the ransomware adds the CryptInfinite key to the Windows registry, using it to store a list of all encrypted files and their location on disk.

According to Bleeping Computer's Lawrence Abrams, the ransomware is spread via Word documents attached to spam email. These files pose as resumes. Users get infected via weaponized Word documents

Infection occurs when users open the document and enable Word Macros so that they can view the "proper" file. Word Macros are a known security vulnerability used by many malware developers to spread Web-hosted malware to Windows computers.

[Utilizer]

Ransomware fix found!

[Utilizer]

FYI...

[The KG9 Kid]

"Ransonware fix found!"

... At your nearest Apple Store.

[Fresh Wind]

Or for free at the LinuxMart.

[The KG9 Kid]

I agree, but Linux is for those who really need to understand what they’re about to inflict upon themselves.

[Cringing Negativism Network]

Linus is wonderful.

And free.

Only slightly challenging. It is well worth the trouble.

[Cringing Negativism Network]

Linux.

(der)

[The KG9 Kid]

Okay.

[dayglored]

Sounds pretty useful to the victims!

Handy info if you get hit by DecryptorMax ... PING!

You can find all the Windows Ping list threads with FR search: just search on keyword "windowspinglist".

Thanks to Utilizer for the ping!!

[zeugma]

The fact that word documents are still a security threat boggles the mind. Isn't at almost 2016? Microsoft:the hacker's wet dream.