[email protected] Virus – Decrypt .XTBL Encrypted Files

guardware-ransomware-how-to-decrypt-my-files-encrypted-sensorstechforum-comYet another variant belonging to the Rannoh/Rakni also known as Shade and XTBL ransomware has been spotted amongst many. This variant seems to be an updated version of this ransomware family and it does not hesitate when it comes to file encryption. The virus uses a strong AES encryption algorithm to render the files no longer able to be opened on the computers it infects. After this has been done by the Guardware ransomware, the malware changes the interfix of the encrypted files to a unique ID for the infected computer. When the e-mail is contacted, the criminals associated with Guardware ransomware request payment usually in online cryptocurrency, such as BitCoin.

Fortunately, now there has been a decryptor released and we at Sensors Tech Forum advise you to read the instructions below to learn how to remove this nasty virus from your computer and decrypt your files for free.

Threat Summary

NameGuardware
TypeRansomware
Short DescriptionThe ransomware encrypts files with the AES cipher and requests a payment from the user to grant access back to the files.
SymptomsAfter encryption the ransomware steals login passwords and adds the .xtbl extension and the e-mail for ransom payoff and contact after every file name.
Distribution MethodSpam Emails, Email Attachments, File Sharing Networks.
Detection Tool See If Your System Has Been Affected by Guardware

Download

Malware Removal Tool

Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

[email protected] XTBL Ransowmare – More Information

Users on reddit forums have discovered the new ransomware being spread via malicious executable with the following name:

→ Guardware.exe

The Guardware virus is believed to not have been active at first when it was discovered back in September 2016, but to increase infection rate exponentially since.

To infect maximum amount of users, the creators may have spammed this executable on multiple locations, including suspicious websites, malvertised hosts as well as uploaded it on torrent sites. However, let us not exclude the possibility of the executable being uploaded directly as an e-mail attachment in a spam message being sent out to the user to foll him or her into opening the –-mail.

Whaveter the case may be, this ransomware virus also known as “The Splash Trojan”, may interefere with the following registry entries after an infection takes place:

→ HKLM/Software/Microsoft/WindowsNT/CurrentVersion/Winlogon/Shell
HKLM/Software/Microsoft/Windows/CurrentVersion/Run/

Then, this CrySiS iteration may uninterruptedly and unnoticed to attack and encrypt a wide variety of file extensions:

→ .odc, .odm, .odp, .ods, .odt, .docm, .docx, .doc, .odb, .mp4, sql, .7z, .m4a, .rar, .wma, .gdb, .tax, .pkpass, .bc6, .bc7, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum, .ibank, .t13, .t12, .qdf, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps

The encrypted files usually have an extremely long name that consists of the e-mail address for contact if you have become affected as well as the .xtbl file extension. Here is how an encrypted file by [email protected] ransomware may appear:

guardware-ransomware-virus-sensorstechforum-encrypted-file

Fortunately we can help you restore your files. Malware researchers have developed a free decryptor that usually works for all the Shade variants using the .xtbl file extension. We have created instructions on how to download and use this decryptor and hopefully recover the lost files for free after removing Guardware ransomware completely.

Guardware Ransomware – Removal and Decryption Instructions

Phase 1 – Removal

Before you attempt any form of decryption, it is advisable that you remove this virus from your computer firstly, to be safe. We have provided a fast removal manual that will help you locate and delete the files of the Guardware ransomware virus before starting the decryption process.

Manually delete Guardware from your computer

Note! Substantial notification about the Guardware threat: Manual removal of Guardware requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Guardware files and objects
2. Find malicious files created by Guardware on your PC
3. Fix registry entries created by Guardware on your PC

Automatically remove Guardware by downloading an advanced anti-malware program

1. Remove Guardware with SpyHunter Anti-Malware Tool
2. Back up your data to secure it against infections and file encryption by Guardware in the future

Phase 2 – Decryption

After you have removed this nasty ransomware, you should follow the bellow mentioned steps to try and decrypt files encrypted by Guardware ransomware.

Step 1: Prepare your computer to stay awake and not automatically turn off during scan by doing the following:

1)Click once on the icon for the power (battery icon) in your system tray that is located next to your clock in the bottom right. After this, a menu will appear and on it click on More Power Options.
2)After the Power Options menu shows up, click on Change Plan Settings to open the settings.
3)In there, make sure you set everything from “Turn off the display” to “Put Computer to Sleep” in all modes to “Never”.
4)Now go to “Change Advanced Plan Settings” and go to the expanding “Hard Disk” setting from the list and set it’s settings to “Never” as well.

Step 2: Download the Kaspersky Shade Decryptor by clicking on the button below and save the archive on your computer.

Download

Kaspersky Shade Decryptor

1-shade-decryptor-download-sensorstechforum

Step 3: Open the archive. For this, you need an archive reading program like the free WinRar, for example. Extract the ShadeDecryptor.exe file somewhere where you can easily locate it:

2-shade-decryptor-extract-sensorstechforum

Step 4: Open the decrypter and click on the Start Scan button to open the file explorer:

3-shade-start-scan-button-sensorstechforum

Step 5: Choose an encrypted file and click on Open after which the decryptor should begin looking for keys corresponding to your computer. Be advised that you need to be patient since this process may take from hours up to days.

3.2-encrypted-file-shade-ransomware-sensorstechforum

4-decrypting-shade-ransomware

Guardware Ransomware Decryption – Conclusion and Tips

Bear in mind that if you follow these instructions, you should perform them on a secured computer and what is more important is that you should make copies of the encrypted files, just in case they break while the decryptor is decrypting them. We also advise you to be extremely careful and learn how to protect your data in the future, because unlike this ransomware, many other ransomware viruses such as Cerber and Locky have not been decrypted so far.

We also advise that you keep in mind how you store your data in the future:

Safely Store Your Important Files and Protect Them From Malware

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.