Remove ODCODC Ransomware and Restore .odcodc Files - How to, Technology and PC Security Forum | SensorsTechForum.com
THREAT REMOVAL

Remove ODCODC Ransomware and Restore .odcodc Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...

odcodc-ransomware-skull-art-acsii-master-boot-record-dropbox-uniqueA ransomware that uses one of the most often used ransom messages, encrypting files with a strong cipher has been the reason for several reports of affected victims. The ODCODC ransomware (also known as crypto-virus) sets the .odcodc file extension to the newly encrypted files and leaves a “readthis.txt” ransom note. Users who have been infected with the ODCODC ransomware are advised to remove this ransomware immediately and try one of the file restoration methods illustrated after this article.

UPDATE! There has been a decryptor released for ODCODC Ransomware. You can download it from the following link

Threat Summary

NameODCODC
TypeRansomware
Short DescriptionThe ransomware may encrypt files with the RSA-2048 cipher and asks a ransom payment for decryption.
SymptomsFiles are encrypted and become inaccessible. A ransom note with instructions for paying the ransom shows as a readthis.txt file.
Distribution MethodSpam Emails, Email Attachments, File Sharing Networks.
Detection Tool See If Your System Has Been Affected by ODCODC

Download

Malware Removal Tool

User ExperienceJoin our forum to Discuss ODCODC Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

ODCODC Ransomware – How Is It Distributed

In order to be widespread, ODCODC Ransomware may use several different techniques to be spread out, but the main possibilities are:

Malicious files.
Malicious URLs.

Such may be spread in various ways, varying from malicious e-mail attachments to malicious URLs shared on various suspicious websites.

ODCODC Ransomware In Detail

Once activated on the computer, ODCODC ransomware may drop its payload files in one of the several folders:

  • %AppData%
  • %Temp%
  • %Roaming%
  • %User’s Profile Folder%
  • %Windows%
  • %Desktop%

The files may be more than one and may be of the following file formats:

→ .dll, .txt, .exe, .tmp, .vbs, .bat, .cmd

They may contain random names or names that resemble a Windows process, for example, “svchost.exe”. The .tmp files are usually dropped in the %Temp% folder.

After the malicious files have been dropped, the ODCODC ransomware may employ a powerful RSA or AES encryption to files with the following extensions:

After encrypting the files of affected users, ODCODC ransomware may delete the shadow volume copies of the infected computer, eradicating any possibility of files being recovered from backups. This can happen by executing a .vbs script with the following administrative command:

shadow-command-sensorstechforum

After this is done, the ransomware may create a “readthis.txt” file with the following ransom message:

→ “Your personal files are encrypted!
What happened to your files?
All of your files were protected by a strong encryption with RSA-2048. https://en.wikipedia.org/wiki/RSA_(cryptosystem)
What does this mean?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you cant restore them.
What to do?
We can recover your files. You can trust us, for proof of this we can decrypt some your files for free.
How to contact you?
Write us to email: abennaki@india.com
Ваши персональные файлы зашифрованы!
Что случилось с файлами?
Все ваши файлы зашищены криптостойким алгоритмом RSA-2048. https://en.wikipedia.org/wiki/RSA_(cryptosystem)
Что это значит?
Это значит, что структура и содержимое ваших файлов потерпили необратиме изменения, вы не можете с ними работать, читать или видеть, это тоже самое, что потерять их бесповоротно, но, с нашей помощью, вы можете их все восстановить.
Что мне делать?
Мы можем полностью восстановить доступ к вашим файлам. Вы можете нам доверять, доказать честность и серьезность наших намерений мы можем бесплатной расшифровкой нескольких файлов.
Как с вами связаться?
Напишите нам на почту: abennaki@india.com”Source:Affected Users

ODCODC Ransomware – Conclusion, Removal, and File Restoring

The bottom line for this variant of crypto-malware is that it may be part of the Rakhni or Troldesh variants. Judging by the badly written ransom note in Russian, it has been created for Russian users, but it may not originate from Russia. Such files may be decrypted via Rakhni decryptor by Kaspersky, which we have posted along with other file restoration methods in step “3. Restore files encrypted by ODCODC” below.

However, if you want to try and restore your files, we advise you to either do it on a safe computer or follow the removal instructions below to remove the malware from your PC. They are methodologically arranged to help detect and remove ODCODC ransomware effectively.

Finally, we advise you to follow this article for further updates on ODCODC ransomware and in the meantime to try the methods from step “3” below to attempt and restore your files. They may not be 100 percent successful, but there is a possibility that you might be able to revert at least some of your files.

Avatar

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:
Twitter

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...