Bart

@spgedwards My understanding is Cryptolocker overwrites rather than deletes files. You got this to work on a real infection?

@JohnEDunn I'm not ignoring you - checking on 'version' I'm using before providing full/useful response : )

@spgedwards @JohnEDunn @jleyden This won't work as CryptoLocker doesn't delete files, but rather encrypts them.

@spgedwards @JohnEDunn @jleyden However... If you delete the encrypted files, it's possible PhotoRec can recover the original ones.

@bartblaze @spgedwards @jleyden It does but not 'shadow volume copies' - it has to delete/overwrite those. One Vista feature worth a cheer

@JohnEDunn @spgedwards @jleyden It's indeed a possibility. With Cryptorbit you can restore them. (see also: http://bartblaze.blogspot.be/2014/04/ransomware-q.html#preventiondisinfection …)

@bartblaze @JohnEDunn @jleyden Just to be clear, all. Not saying this is fool-proof 100% technique. Last resort for those sans backups!

@spgedwards @JohnEDunn @jleyden Also: after you made your backup, disconnect your external HD, or you're gonna have a bad time ;-)