DeriaLock Ransomware Data Recovery

What is DeriaLock Ransomware?

DeriaLock Ransomware is a type of malware that encrypts your files and demands a ransom payment to decrypt them. This ransomware is fairly new, first appearing in November 2016. DeriaLock uses the RSA-2048 encryption algorithm to encrypt your files, making them impossible to decrypt without the proper decryption key. Once your files have been encrypted, DeriaLock will display a ransom note informing you of the situation and demanding that you pay 1 Bitcoin (approximately $725) to receive the decryption key. DeriaLock also threatens to delete your backup files if you do not pay the ransom within 5 days.

How does DeriaLock end up on your computer?

DeriaLock Ransomware is usually spread through email attachments or malicious websites. DeriaLock will masquerade as a legitimate attachment, such as an invoice or shipping notification. When you open the attachment, DeriaLock will begin encrypting your files. DeriaLock can also infect your computer if you visit a malicious website that contains exploit code to take advantage of vulnerabilities in your web browser or plugins.

What types of files does DeriaLock encrypt?

DeriaLock Ransomware will encrypt most types of files on your computer, including documents, images, videos, and more. DeriaLock will add the “.deria” extension to the end of each encrypted file.

What was the biggest DeriaLock attack?

The DeriaLock Ransomware strain was used in a ransomware attack against the San Francisco Municipal Transportation Agency (SFMTA) in November 2016. The attack encrypted 2,000 computers and servers, causing major disruptions to the public transit system. The attackers demanded a ransom of 100 Bitcoin (approximately USD 73,000) to decrypt the files. The SFMTA did not pay the ransom and was eventually able to restore its systems from backups.

How can you protect yourself from DeriaLock?

The best way to protect yourself from DeriaLock Ransomware is to have a reliable anti-malware program installed on your computer and to stay away from questionable websites and email attachments. You should also regularly back up your important files so that you can recover them if they do become encrypted by DeriaLock or any other type of ransomware.

What should you do if you’re infected with DeriaLock Ransomware?

If you’re infected with DeriaLock Ransomware, the first thing you should do is disconnect from the internet to prevent the ransomware from encrypting any more of your files. Then, you need to use a reliable anti-malware program to remove DeriaLock from your computer. Once DeriaLock has been removed, you can use a file recovery program to try to restore your encrypted files.

SalvageData data recovery software is built to help you.

Should I pay the DeriaLock ransom?

We do not recommend paying the DeriaLock ransom, as there is no guarantee that you will receive the decryption key even if you do pay.

Is there a public decryption tool for DeriaLock?

The No More Ransom Project has released a DeriaLock decryption tool that may be able to decrypt your files for free. However, this tool will only work if you have not changed the default encryption settings. Click here to download.

Contact a data recovery service

If you don’t have a backup of your files and you can’t decrypt them using a decryption tool, your only hope is to contact a data recovery service like SalvageData.

We have successfully recovered data from infected computers many times before and we may be able to help you too.

How much does it cost?

The price depends on a few factors, such as the type of files you need to recover and the extent of the damage. In some cases, we may be able to give you a ballpark estimate over the phone or online. However, in other cases, we may need to take a closer look at your computer before we can give you an accurate quote.

What’s the success rate?

The success rate depends on a few factors, but in general, we are usually able to recover data from infected computers.

How long does it take?

The time it takes to recover your data depends on a few factors, but in general, it usually takes us a few days to a week to complete the process.

What’s the process?

The first step is to send us your computer or your hard drive. We will then create an image of your drive and begin working on recovering your data. Once we have recovered your data, we will send you back a copy on an external hard drive or USB flash drive.

Contact us now to get started on recovering your data.