[AsakiIssa]

I know a customer that got hit by this Tuesday morning. Unsurprisingly, Avast did nothing. I just told her the bad news and clean-installed Windows.

I have tried to find the private key with sample files, using known file byte headers, the public key and brute force on the private key. Sadly, no luck yet.

[duskwuff]

That's assuming the private key is even reused. If they're generating a new key for each user (which they very well could be), you're boned.