SensorsTechForum - How to Technology and PC Security Forum

PC Security and Protection => Malware Removal Questions and Guides => Topic started by: safraga on February 05, 2017, 07:13:57 pm

Title: retrieve Kovter ecryption key
Post by: safraga on February 05, 2017, 07:13:57 pm
Hi,
This week I was a new victime of the kovter ransomware.

Now I'me trying to retrieve the encryption key, bet without result.

I have 2 files, first clean from backup and the other is encrypted, if anyone can help me it will be appreciate.

Thank you in advance

safraga
Title: Re: retrieve Kovter ecryption key
Post by: Execute on February 06, 2017, 05:18:55 pm
Hello, @safraga,
what is the extension of the encrypted files? Or it's the same as the encrypted file you uploaded?

Because there was a script that worked for older versions of Kovter, that you might try out.
The script is given at the end of this article: http://sensorstechforum.com/remove-kovter-ransomware-and-restore-crypted-encrypted-files/ (http://sensorstechforum.com/remove-kovter-ransomware-and-restore-crypted-encrypted-files/)

Write back!

Best Regards,
Execute
Title: Re: retrieve Kovter ecryption key
Post by: safraga on February 07, 2017, 02:57:24 am
Hello,
I tried this script but it can't find the key.
The extention of both files are JPG and it is the image.
The encrypted file is not readable and the other one yes.

Thank you

safraga
Title: Re: retrieve Kovter ecryption key
Post by: Execute on February 07, 2017, 04:40:23 pm
Hmm, so it is indeed a new version of Kovter and the old decryption script does not work.
You should definitely keep those files intact somewhere if a decryptor tool is released.

For now, I don't see anything that might help you out, except trying some Data Recovery Programs.
Here are a few examples for such software: Recuva by Piriform, Stellar Phoenix Data Recovery (http://sensorstechforum.com/stellar-phoenix-windows-data-recovery-software-review/).

Kind Regards,
Execute
Title: Re: retrieve Kovter ecryption key
Post by: safraga on February 07, 2017, 06:14:25 pm
Thank you for trying to help
At this point, I backup the files that I would like to restor and wait for a decryptor.

Best regards

safraga
Title: Re: retrieve Kovter ecryption key
Post by: Execute on February 08, 2017, 09:58:58 am
That is indeed the thing you should do, @safraga.
I will inform you if a decryption method is found,
but it probably is going to be a long wait.

Best Regards,
Execute