From Dr Web's article it is unclear whether a) the Linux Crypto Ransomware uses a single AES keys or multiple ones and b) it runs only with administrative privileges (which seems to be the case). Anyone knows? The good practice to run with limited privileges and only assign ownership/rights to the running daemon user when/if needed would prevent this malware in the first place. On a side note, Krebs reports that the decryption process of Linux.Encoder.1 left few bogus characters behind on some files.