Sysgop01@india.com – CryptoLocker replica ransomware decryptor and removal

The sysgop01@india.com ransomware, also known as SysGop, PClock or CryptoLocker, is currently in active rotation, so learn how to avoid it and decrypt files.

In-the-wild reach of the SysGop ransomware strain is broadening. Its proliferation appears to feature no restrictions geography-wise, infecting English-speaking Windows users along with people whose operating system localization is Russian. The latter targeting principle, by the way, is a taboo for the vast majority of crypto ransomware developers and distributors. While intending to cover as large an audience as possible, the creators of this newest CryptoLocker copycat have apparently invested a great deal of intellectual work in their extortion activities. The cryptographic part of this pest’s modus operandi is immaculate, so security analysts are still at their wit’s end trying to find a workaround that would allow victims to decrypt their data for free. Meanwhile, those infected are forced to contact the threat actors at sysgop01@india.com or sysgop02@india.com for payment instructions. In return, they find out that the only viable way to sort things out is to submit a ransom of 0.6 – 1.6 Bitcoin.

When confronted with this sample, users discover that their personal files got crippled beyond recovery, while filenames remain intact. The crypto entropy is on the inside, which makes it impossible to open or edit the affected entries using commonplace methods. Once the encryption phase of the attack has been performed, this CryptoLocker replica displays a warning window. Although it looks somewhat old school, its functionality is sufficient for the extortion. The interface reads,

Your personal files are encrypted!
Support e-mails: sysgop01@india.com, sysgop02@india.com.
Your personal files encryption produced on this computer: photos, videos, documents, etc. Encryption was produced using a unique public key RSA-2048 generated for this computer.
To decrypt files you need to obtain the private key.

The screen also provides the size of the ransom and the time left before the private key is destroyed. Victims can choose their preferred language and click the “Show files” button to view the list of all encoded files.

Very similar, yet not identical, information is included in ransom notes that the SysGop / CryptoLocker leaves on the desktop and inside folders with skewed data. These manuals are called “Your files are locked !.txt”, where the number of “!” signs may vary, ranging from one to five. As opposed to the GUI, the TXT files contain a Bitcoin address to send the specified amount of digital cash to. At the end of the day, the victims have to complete the payment transaction and report this to the attacker using the appropriate email address. Then, the adversary is supposed to provide the automatic decryptor along with the private decryption key. Ideally, this should work, but it’s unreasonable to capitalize on the bad guys’ promises.

The sysgop01@india.com / sysgop02@india.com ransomware has been hitting users predominantly via spam. Unsuspecting people receive emails with subjects like “Parcel delivery problems”, “Fax transmission”, “Photo”, “Purchase Order”, “ISP complaint”, “Invoice” or similar. These messages go with attached WSF or JS files which, when opened, download the ransomware and run it without the recipient’s awareness. Therefore, users are recommended to strengthen their email system’s anti-spam settings – raising this bar should filter out these sorts of rogue emails. If this ransom Trojan is already on board and wreaking havoc, start the troubleshooting with the steps highlighted in the next section of this post.

Sysgop01@india.com / CryptoLocker ransomware automated removal and data recovery

When faced with ransomware like Sysgop01@india.com / CryptoLocker, one of the best shortcuts in terms of removal is to use Combo Cleaner, a lightweight and incredibly effective application with PC security and optimization features under the hood. It detects and thoroughly deletes threats while giving you insights into the overall health of your computer.

This program’s protection power spans modules that forestall all known types of malware, including ransomware and browser hijackers, and take your online security to the next level by blocking phishing sites and other suspicious web pages. Follow these simple steps to eliminate the infection for good:

1. Download Combo Cleaner installer.

Download Sysgop01@india.com / CryptoLocker remover

^{Combo Cleaner scans your PC with no strings attached, but you’ll have to buy its fully functional version to remove the threats it detects. The disk optimization tools that find large files and duplicates are free to use.}

2. Open the CCSetup.exe file to get started. Several subsequent screens will allow you to make initial customizations so that the program works exactly as you need from the get-go.

3. The installation will be followed by an update of malware signatures. Once this process is through, click the Start Scan button in the left-hand sidebar.

4. Combo Cleaner will then check system locations that are most often polluted by Windows malware. The first scan can take a while to finish.

5. Combo Cleaner will display a system tray notification as soon as the scan is over. Click the Resolve found threats button to view the results.

6. The scan summary shows the names and types of the detected threats as well as their statuses and locations. Click the Remove all threats button and follow further on-screen prompts to get rid of these items.

Data recovery toolkit to the rescue

Some strains of ransomware are known to delete the original files after the encryption routine has been completed. As hostile as this activity appears, it can play into your hands. There are applications designed to revive the information that was obliterated because of malfunctioning hardware or due to accidental removal. The tool called Stellar Data Recovery features this type of a capability and therefore it can be applied in ransom attack scenarios to at least get the most important files back. So use the app to get an idea of what data can be restored and let it do the recovery job. Here is a step-by-step walkthrough:

1. Download and install Stellar Data Recovery.

Download Stellar Data Recovery

2. Open the application, select the types of recoverable files to look for, and click Next.

3. Choose the areas you want the tool to recover from and click the Scan button.

4. Having scanned the specified locations, the program will display a notification about the total amount of recoverable data. Close the dialog and click the Recover button. This will hopefully help you get some of your valuable files back.

Sysgop01@india.com / CryptoLocker ransomware manual removal and file recovery

Some ransomware strains terminate themselves after completing the encryption job on a computer, but some don’t. Furthermore, the Sysgop01@india.com / CryptoLocker virus may prevent victims from using popular antimalware tools in order to stay on board for as long as possible. Under the circumstances, it may be necessary to utilize the Safe Mode with Networking or System Restore functionality.

Be advised that even after the ransomware is removed, files will still be encrypted and inaccessible. The malicious code cleanup part, however, is important because it keeps a relapse of the infection from occurring further on and eliminates all opportunistic malware.

Ways of non-ransom recovery of CryptoLocker-encrypted files

Cracking the crypto used by this ransom Trojan is more of a science fiction thing rather than an attainable prospect for the masses. This is why the troubleshooting in predicaments of this sort is a matter of two approaches: one is to pay the ransom, which isn’t an option for many victims; and the other is to apply instruments that take advantage of the ransomware’s possible weaknesses. If the latter is your pick, the advice below is a must-try.

Ransomware Prevention Tips

To avoid Sysgop01@india.com / CryptoLocker ransomware and other file-encrypting infections in the future, follow several simple recommendations:

These techniques are certainly not a cure-all, but they will add an extra layer of ransomware protection to your security setup.

Revise your security status

Post-factum assessment of the accuracy component in malware removal scenarios is a great habit that prevents the comeback of harmful code or replication of its unattended fractions. Make sure you are good to go by running an additional safety checkup. Another benefit of using the antimalware tool is that it will keep ransomware threats from intruding on your computer further on.

Download Sysgop01@india.com / CryptoLocker removal tool