Virus - Decrypt .XTBL Encrypted Files - How to, Technology and PC Security Forum |
THREAT REMOVAL Virus – Decrypt .XTBL Encrypted Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

guardware-ransomware-how-to-decrypt-my-files-encrypted-sensorstechforum-comYet another variant belonging to the Rannoh/Rakni also known as Shade and XTBL ransomware has been spotted amongst many. This variant seems to be an updated version of this ransomware family and it does not hesitate when it comes to file encryption. The virus uses a strong AES encryption algorithm to render the files no longer able to be opened on the computers it infects. After this has been done by the Guardware ransomware, the malware changes the interfix of the encrypted files to a unique ID for the infected computer. When the e-mail is contacted, the criminals associated with Guardware ransomware request payment usually in online cryptocurrency, such as BitCoin.

Fortunately, now there has been a decryptor released and we at Sensors Tech Forum advise you to read the instructions below to learn how to remove this nasty virus from your computer and decrypt your files for free.

Threat Summary

Short DescriptionThe ransomware encrypts files with the AES cipher and requests a payment from the user to grant access back to the files.
SymptomsAfter encryption the ransomware steals login passwords and adds the .xtbl extension and the e-mail for ransom payoff and contact after every file name.
Distribution MethodSpam Emails, Email Attachments, File Sharing Networks.
Detection Tool See If Your System Has Been Affected by Guardware


Malware Removal Tool

Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. XTBL Ransowmare – More Information

Users on reddit forums have discovered the new ransomware being spread via malicious executable with the following name:

→ Guardware.exe

The Guardware virus is believed to not have been active at first when it was discovered back in September 2016, but to increase infection rate exponentially since.

To infect maximum amount of users, the creators may have spammed this executable on multiple locations, including suspicious websites, malvertised hosts as well as uploaded it on torrent sites. However, let us not exclude the possibility of the executable being uploaded directly as an e-mail attachment in a spam message being sent out to the user to foll him or her into opening the –-mail.

Whaveter the case may be, this ransomware virus also known as “The Splash Trojan”, may interefere with the following registry entries after an infection takes place:

→ HKLM/Software/Microsoft/WindowsNT/CurrentVersion/Winlogon/Shell

Then, this CrySiS iteration may uninterruptedly and unnoticed to attack and encrypt a wide variety of file extensions:

→ .odc, .odm, .odp, .ods, .odt, .docm, .docx, .doc, .odb, .mp4, sql, .7z, .m4a, .rar, .wma, .gdb, .tax, .pkpass, .bc6, .bc7, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum, .ibank, .t13, .t12, .qdf, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps

The encrypted files usually have an extremely long name that consists of the e-mail address for contact if you have become affected as well as the .xtbl file extension. Here is how an encrypted file by ransomware may appear:


Fortunately we can help you restore your files. Malware researchers have developed a free decryptor that usually works for all the Shade variants using the .xtbl file extension. We have created instructions on how to download and use this decryptor and hopefully recover the lost files for free after removing Guardware ransomware completely.

Guardware Ransomware – Removal and Decryption Instructions

Phase 1 – Removal

Before you attempt any form of decryption, it is advisable that you remove this virus from your computer firstly, to be safe. We have provided a fast removal manual that will help you locate and delete the files of the Guardware ransomware virus before starting the decryption process.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share