Yet another variant belonging to the Rannoh/Rakni also known as Shade and XTBL ransomware has been spotted amongst many. This variant seems to be an updated version of this ransomware family and it does not hesitate when it comes to file encryption. The virus uses a strong AES encryption algorithm to render the files no longer able to be opened on the computers it infects. After this has been done by the Guardware ransomware, the malware changes the interfix of the encrypted files to a unique ID for the infected computer. When the e-mail is contacted, the criminals associated with Guardware ransomware request payment usually in online cryptocurrency, such as BitCoin.
Fortunately, now there has been a decryptor released and we at Sensors Tech Forum advise you to read the instructions below to learn how to remove this nasty virus from your computer and decrypt your files for free.
|Short Description||The ransomware encrypts files with the AES cipher and requests a payment from the user to grant access back to the files.|
|Symptoms||After encryption the ransomware steals login passwords and adds the .xtbl extension and the e-mail for ransom payoff and contact after every file name.|
|Distribution Method||Spam Emails, Email Attachments, File Sharing Networks.|
|Detection Tool|| See If Your System Has Been Affected by Guardware |
Malware Removal Tool
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
[email protected] XTBL Ransowmare – More Information
Users on reddit forums have discovered the new ransomware being spread via malicious executable with the following name:
The Guardware virus is believed to not have been active at first when it was discovered back in September 2016, but to increase infection rate exponentially since.
To infect maximum amount of users, the creators may have spammed this executable on multiple locations, including suspicious websites, malvertised hosts as well as uploaded it on torrent sites. However, let us not exclude the possibility of the executable being uploaded directly as an e-mail attachment in a spam message being sent out to the user to foll him or her into opening the –-mail.
Whaveter the case may be, this ransomware virus also known as “The Splash Trojan”, may interefere with the following registry entries after an infection takes place:
Then, this CrySiS iteration may uninterruptedly and unnoticed to attack and encrypt a wide variety of file extensions:
→ .odc, .odm, .odp, .ods, .odt, .docm, .docx, .doc, .odb, .mp4, sql, .7z, .m4a, .rar, .wma, .gdb, .tax, .pkpass, .bc6, .bc7, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum, .ibank, .t13, .t12, .qdf, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps
The encrypted files usually have an extremely long name that consists of the e-mail address for contact if you have become affected as well as the .xtbl file extension. Here is how an encrypted file by [email protected] ransomware may appear:
Fortunately we can help you restore your files. Malware researchers have developed a free decryptor that usually works for all the Shade variants using the .xtbl file extension. We have created instructions on how to download and use this decryptor and hopefully recover the lost files for free after removing Guardware ransomware completely.
Guardware Ransomware – Removal and Decryption Instructions
Phase 1 – Removal
Before you attempt any form of decryption, it is advisable that you remove this virus from your computer firstly, to be safe. We have provided a fast removal manual that will help you locate and delete the files of the Guardware ransomware virus before starting the decryption process.