This little detail slipped through their fingers... TOO LATE!
(I actually hid this post when I understood that it might alert the crooks. But SYMANTEC did!)
This is the exact path where your keys are:
Windows XP
(I actually hid this post when I understood that it might alert the crooks. But SYMANTEC did!)
This is the exact path where your keys are:
Windows XP
C:\Documents and Settings\<USERNAME>\Application Data\Microsoft\Crypto\RSA\S-1-5-2...
Windows 7
X:\Users\<USERNAME>\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21...
(X stands for your hard-disk letter, which is commonly C in most computers)
 |
| HEXCMP highlights in red the differences whereas identical bytes remain white. TCP/IP dumped data is identical to the key found on Disk. |
The private key is encrypted via DPAPI (Data Protection API). There are many RSA keys in that folder though, but you can still find them by sorting these files by date. If you don't remember the date you got infected, see your screenshot at the crook's webpage or search for the oldest HOW_DECRYPT.TXT file in your system.
I'll update this blog soon!
I've got some nice small files, the key, and some timestamps... how should I get them to you?
ReplyDeleteNot seeing nearly enough thanks being given to you for your hard work and efforts to remedy this douchebags handiwork. Excellent work man, and good luck with your efforts!
ReplyDeleteI greatly appreciate all of your hard work, and if I can help in my limited way, please let me know.
ReplyDelete