Remove Ransomware and Restore .Xtbl Encrypted Files - How to, Technology and PC Security Forum |

Remove Ransomware and Restore .Xtbl Encrypted Files

A new ransomware, carrying the vulgar name of its ransom email address, has been reported to be massively spread. It encrypts the user files with a strong cypher and uses the ransom email plus a .xtbl file extension after it. The questionable malware is believed by security experts to be a part of RaaS (Ransomware as a service) operation because it has many variants.

Threat Summary


Short DescriptionPart of the “@” ransomware variants. Encrypts the files on the infected computer then asks for ransom money in email correspondences.
SymptomsThe user may witness his files to become corrupt with the questionable email and .xtbl as file extensions that are added.
Distribution MethodVia Exploit kits or downloader Trojans.
Detection Tool See If Your System Has Been Affected by


Malware Removal Tool

User ExperienceJoin our forum to Discuss Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. – How Did I Get It

The most likely method that the crypto-malware may have used to spread onto the user PCs may be via two main methods:

  • Malicious URLs posted as spam comments on forums or other social websites.
  • Malicious URLs featured in spam emails may resemble like they are originating from a legitimate service.

Either way, the ransomwar may also not come directly onto the computer, but arrive via other malware. The most often used malware to download crypto-viruses are MSIL Trojans and Exploit Kits, such as the Angler Exploit Kit. Since their executables are obfuscated by the so-called cryptors or obfuscating software, it is difficult for a conventional antivirus software to detect them. The distribution malware may either open a port, connect to a host and download the malicious .exe via the port or directly create an exploit for the attackers. Ransomware In Detail

Similar to other variants, like or this variant may drop its payload in several locations:

  • %UserProfile%
  • %Roaming%
  • %AppData%

The files dropped may be of the following file types:

→ .exe, .dll, .tmp

Each one of the modules of this ransomware may have different function. The malware then may set a registry key to run on system startup after which look for the most commonly used file types and encrypt them.

An encrypted file by the ransomware looks as follows:


The virus then may change the wallpaper of the user to a wallpaper that asks the user to contact the questionable e-mail for further instructions. Here is what the wallpaper states:

Important files on this PC are locked
If you want to reset this operation send one locked file to this email:
Important information: You only have 3 days to reply to this email before unlocking becomes impossible.”

The ransomware also has a text file, named “How to decrypt your files.txt”. Judging by what type it is this ransomware is most likely sold on the dark web as a service for cyber-criminals who do not have the experience to program their own ransomware. This is why all of the “@” types of ransomware use a specific contact email address that is unique to them and different wallpaper. However, they may be very similar in their structure.

Remove Redshitline Ransomware and Restore .Xtbl Files

In order to delete this ransomware, it is strongly advisable to use an advanced anti-malware software. Furthermore, we strongly recommend using the advanced anti-malware software because it will remove the ransomware and other malware that be executed on your computer without damaging your files.

Regarding file restoration, we recommend using the methods outlined in Step “4” from the instruction below.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:

1 Comment

  1. AvatarBrian Lakstins

    I have a customer with this virus. It started encrypting network shares on March 21st.

    The system infected is a virtual machine, so it is now shutdown without being cleaned.

    I tried Kaspersky Rakhni Decryptor and Rannoh Decryptor, but with no luck. Rakhni Decryptor gives an unsupported file type error. Rannoh Decryptor gives an error Can’t initialize on pair followed by Can’t init decryptor.


Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share