Hi fellow net users.
I have investigated unforgivens ideea. The ideea is good, but you did the wrong thing. You just copied the info from the good one to the bad one. That's not the way. You must find the first bit of info from where it just goes wrong, and then fix it.
1.I compared 2 samples of the same picture. The first one was encrypted and the second was decrypted.
2. I was looking in the good picture at the binary info and then compared it to the crypted one to find similarities.
3.I had no luck, i think the cryptowall jsut masses up the binary info in the file. It does not put the first 512 bits of info at the end. Of course there is a logic in its MO, but that remains to be discovered.
Regarding the comparison i did, what i was trying to do looked like this:
a)encrypted file: 01 02 AA 17 25 E8 01 FF ......78 ER 58 D8 F7...
b)decrypted file: 78 ER 58 D8 F7.....
c) or much simpler: its like a row of numbers that is massed up:
one is logical (decrypted)1,2,3,4,5,6,7,8,9
one is illogical(crypted) 5,6,7,8,9.....1,2,3,4
BUT AGAIN you will not find something like this in the binary info of 2 files because cryptowall does not take the first 512 bits of info (fist numbers) and put it at the end.
Please post if someone has an ideea.