Yet another variant belonging to the Rannoh/Rakni also known as Shade and XTBL ransomware has been spotted amongst many. This variant seems to be an updated version of this ransomware family and it does not hesitate when it comes to file encryption. The virus uses a strong AES encryption algorithm to render the files no longer able to be opened on the computers it infects. After this has been done by the Guardware ransomware, the malware changes the interfix of the encrypted files to a unique ID for the infected computer. When the e-mail is contacted, the criminals associated with Guardware ransomware request payment usually in online cryptocurrency, such as BitCoin.
Fortunately, now there has been a decryptor released and we at Sensors Tech Forum advise you to read the instructions below to learn how to remove this nasty virus from your computer and decrypt your files for free.
|Short Description||The ransomware encrypts files with the AES cipher and requests a payment from the user to grant access back to the files.|
|Symptoms||After encryption the ransomware steals login passwords and adds the .xtbl extension and the e-mail for ransom payoff and contact after every file name.|
|Distribution Method||Spam Emails, Email Attachments, File Sharing Networks.|
See If Your System Has Been Affected by Guardware
Malware Removal Tool
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
[email protected] XTBL Ransowmare – More Information
Users on reddit forums have discovered the new ransomware being spread via malicious executable with the following name:
The Guardware virus is believed to not have been active at first when it was discovered back in September 2016, but to increase infection rate exponentially since.
To infect maximum amount of users, the creators may have spammed this executable on multiple locations, including suspicious websites, malvertised hosts as well as uploaded it on torrent sites. However, let us not exclude the possibility of the executable being uploaded directly as an e-mail attachment in a spam message being sent out to the user to foll him or her into opening the –-mail.
Whaveter the case may be, this ransomware virus also known as “The Splash Trojan”, may interefere with the following registry entries after an infection takes place:
Then, this CrySiS iteration may uninterruptedly and unnoticed to attack and encrypt a wide variety of file extensions:
→ .odc, .odm, .odp, .ods, .odt, .docm, .docx, .doc, .odb, .mp4, sql, .7z, .m4a, .rar, .wma, .gdb, .tax, .pkpass, .bc6, .bc7, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum, .ibank, .t13, .t12, .qdf, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps
The encrypted files usually have an extremely long name that consists of the e-mail address for contact if you have become affected as well as the .xtbl file extension. Here is how an encrypted file by [email protected] ransomware may appear:
Fortunately we can help you restore your files. Malware researchers have developed a free decryptor that usually works for all the Shade variants using the .xtbl file extension. We have created instructions on how to download and use this decryptor and hopefully recover the lost files for free after removing Guardware ransomware completely.
Guardware Ransomware – Removal and Decryption Instructions
Phase 1 – Removal
Before you attempt any form of decryption, it is advisable that you remove this virus from your computer firstly, to be safe. We have provided a fast removal manual that will help you locate and delete the files of the Guardware ransomware virus before starting the decryption process.
Manually delete Guardware from your computer
Note! Substantial notification about the Guardware threat: Manual removal of Guardware requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.
Automatically remove Guardware by downloading an advanced anti-malware program
Phase 2 – Decryption
After you have removed this nasty ransomware, you should follow the bellow mentioned steps to try and decrypt files encrypted by Guardware ransomware.
Step 1: Prepare your computer to stay awake and not automatically turn off during scan by doing the following:
1)Click once on the icon for the power (battery icon) in your system tray that is located next to your clock in the bottom right. After this, a menu will appear and on it click on More Power Options.
2)After the Power Options menu shows up, click on Change Plan Settings to open the settings.
3)In there, make sure you set everything from “Turn off the display” to “Put Computer to Sleep” in all modes to “Never”.
4)Now go to “Change Advanced Plan Settings” and go to the expanding “Hard Disk” setting from the list and set it’s settings to “Never” as well.
Step 2: Download the Kaspersky Shade Decryptor by clicking on the button below and save the archive on your computer.
Step 3: Open the archive. For this, you need an archive reading program like the free WinRar, for example. Extract the ShadeDecryptor.exe file somewhere where you can easily locate it:
Step 4: Open the decrypter and click on the Start Scan button to open the file explorer:
Step 5: Choose an encrypted file and click on Open after which the decryptor should begin looking for keys corresponding to your computer. Be advised that you need to be patient since this process may take from hours up to days.
Guardware Ransomware Decryption – Conclusion and Tips
Bear in mind that if you follow these instructions, you should perform them on a secured computer and what is more important is that you should make copies of the encrypted files, just in case they break while the decryptor is decrypting them. We also advise you to be extremely careful and learn how to protect your data in the future, because unlike this ransomware, many other ransomware viruses such as Cerber and Locky have not been decrypted so far.
We also advise that you keep in mind how you store your data in the future: