Unlike the crooks SophosLabs found who are trying to copy CryptoLocker but without actually encrypting your files, CryptoWall’s encryption can’t be reversed without the key. This website (blocked by Sophos) includes links to payment options, and offers you the chance to “Decrypt 1 file for FREE”: We are present a special software - CryptoWall Decrypter - which is allow to decrypt and return control to all your encrypted files. In broken but intelligible English, the website tells you: Leave it too long and the price to decrypt your files doubles: If you do go to the payment website, you come to a screen that shows a clock counting down the time you have left to pay the ransom. The message gives instructions on how to use the Tor anonymizing proxy to access a website where you can pay to unlock your files: Despite losing data, police in the New Hampshire town of Durham showed a bit of public resistance to the crooks, announcing that they were “definitely not paying any ransom.”)

If you see a message like the one below, you’re in trouble – many, if not most, of the data files on your hard drive or any connected drives will be scrambled, and it’s simply not practicable to crack the encryption used by the crooks. SophosLabs threat researcher Anand Ajjan says CryptoWall has the same code as CryptoDefense, and only differs in the name. New variants of file-encrypting ransomware called CryptoWall and CryptoDefense have been popping up since at least April 2014. With many victims paying up, ransomware is a lucrative business for the crooks, and CryptoLocker has inspired copycats who want in on the loot.

Well, any celebration over CryptoLocker’s demise is certainly premature – encrypting ransomware is alive and well. When an international law enforcement action earlier this month knocked out the Gameover botnet, one happy consequence was the takedown of the servers that the CryptoLocker ransomware needed in order to do its dirty work.

Does avast pick up crypto locker virus