How to Restore Files Encrypted by Ransomware (Without Decrypter)

by Ventsislav Krastev | July 5, 2018 | 299 Comments Backup, File Recovery, ransomware infection, ransomware removal, Restore Files, Update July 2019, Update June 2019, Update September 2019

(3 votes, average: 5.00 out of 5)

We have created this instructive article to best explain the current options that you as a victim have to restore your files in case you do not wish to pay ransom to cyber-criminals.

Ransomware viruses have been around for quite some time and with most of them now decryptable the developers of viruses have “learnt” their lesson and have created a much stronger encryption scripts than before. So with ransomware evolving, the common user does not really have the capability or the know-how on how he or she can fight back to this menace and get the files back without having to go through the painstaking process of paying BitCoins. This is why, we as a security blog with extensive experience in how such viruses encrypt your files have decided to go over the main methods that you can use to restore your encrypted files in the event that there is no decryptor that is officially working for the virus at hand.

How Do Ransomware Viruses Encrypt Files?

By default, encryption can be explained as “The process of encoding information so that only parties with access to it can read it.”, according to it.ucsf.edu. This basically means that the virus infects your computer after which runs a set of processes which create a copy of the original file and this copy has parts of data replaces with data from the encryption algorithm used (RSA, AES, etc.). The original file is then deleted and the virus leaves the file to appear as if it is corrupt. After the encryption is complete the ransomware generates a decryption key, which can be either Private(symmetric) or public. The trend nowadays is for ransomware viruses to use a combination of both, making the direct decryption even more impossible than it was before, unless you have a decryption software which is again, coded by the ransomware authors. For more information on how encryption exactly works, you can check the related article underneath:

Before you start to recover files, be advised that for some methods to work, you will need to remove the ransomware virus from your computer beforehand. We recommend using an advanced anti-malware software for the removal process, since it is capable to fully and swiftly detect all malicious files and secure your computer by removing them and providing active protection against all possible threats, known at the moment.

Download

Malware Removal Tool

How to Get Encrypted Files to Work (Alternative Ways)?

So, having briefly explained what has happened to your files, let us now discuss what you can do to get them to work again. In this article we have done our research to best provide you with instructions on the different alternative tools that you can use to get the files back. Do not consider the methods underneath a 100% solution, but rather something that you can try and it may or may not work. To install some hope in you recovering your files, however, I will say that depending on the virus and the situation, we have received feedback from ransomware victims who used those methods to restore some of their files and users who were able to restore absolutely every file that was encrypted successfully. Oh yes, and before you start readin about those tools and methods, be advised to read the decription of each method as we have explained where it can be used with maximum effectiveness, since this method is likely to be appropriate for your specific situation. Let us start!

Method 1 - Restore Files via Data Recovery Software

Method 2 - Restore Files via Windows Backup

Method 3 - Restore Files by Using Shadow Explorer (Shadow Copies)

Method 4 - Restore Files by Plugging Your Hard Drive to Another Computer

Method	Via Manually taking out your hard drive and plugging it into another PC, then unlocking it to gain access to your files.
Appropriate Situation	Usually used on viruses which completely lock access to Windows, like Lockscreen ransomware viruses or broken viruses that damage Windows in a way.
Instructions Difficulty	Hard

Ransomware viruses have evolved the past couple of years and with new infections, like the Petya and GoldenEye viruses, we have definitely started to realize the devastating consequences of the ransomware menace. These types of viruses may not encrypt the files on your drive, but most of them damage the Master Boot Record, also known as MBR, prevent you from starting Windows. In this case or if you cannot access Windows for other reasons, this theoretical approach may be able to help you effectively.

Step1

Step2

Step3

Step4

Step5

Method 5 - Restore Files by Using a Network Sniffer

Method	Via the Wireshark Network Sniffer.
Appropriate Situation	When the ransomware communicates live with the cyber-criminals to send information about the decryption key to their server.
Instructions Difficulty	Very Hard

The good old network administrator tool, the Wireshark Network Sniffer is coming yet again to help. But to use it, you must have a comprehensive understanding on how to work with network sniffing software, since the approach here is purely theoretical and it works only when ransomware viruses send the actual decryption key to the cyber-criminals behind this infection. But to find a string like this in the frames and packets of data, you need to have an understanding on how analyze incoming and ongoing communication data from Sniffer programs. Below, we have tried to explain how you can do this thoeotically, if you feel enthusiastic in trying this method out.

IMPORTANT:For the instructions below to work, you must not remove the ransomware from your computer.

Network sniffing with Wireshark can be performed if you follow these steps:

Step1

Step2

Step3

Step4

Method 6 - Restore Files by Using Decrypters for Other Ransomware Viruses

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

OFFER

REMOVE IT NOW (PC)

with Spy Hunter

ransomware may remain persistent on your system and may re-infect it. We recommend you to download SpyHunter and run free scan to remove all virus files on your PC. This saves you hours of time and effort compared to doing the removal yourself.

Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter’s malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter’s EULA, Privacy Policy and Threat Assessment Criteria.

Preparation before removing ransomware.

Before starting the actual removal process, we recommend that you do the following preparation steps.

Make sure you have these instructions always open and in front of your eyes.
Do a backup of all of your files, even if they could be damaged. You should back up your data with a cloud backup solution and insure your files against any type of loss, even from the most severe threats.
Be patient as this could take a while.

Step 1: Boot Your PC In Safe Mode to isolate and remove ransomware

OFFER

Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!

We Recommend To Scan Your PC with SpyHunter

1. Hold Windows key() + R

2. The “Run” Window will appear. In it, type “msconfig” and click OK.

3. Go to the “Boot” tab. There select “Safe Boot”, tick “Network” and then click “Apply” and “OK”.

Tip: Make sure to reverse those changes by unticking Safe Boot after that, because your system will always boot in Safe Boot from now on.

4. When prompted, click on “Restart” to go into Safe Mode.

5. You can recognise Safe Mode by the words written on the corners of your screen.

Step 2: Clean any registries, created by ransomware on your computer.

The usually targeted registries of Windows machines are the following:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

You can access them by opening the Windows registry editor and deleting any values, created by ransomware there. This can happen by following the steps underneath:

1. Open the Run Window again, type “regedit” and click OK.

2. When you open it, you can freely navigate to the Run and RunOnce keys, whose locations are shown above.

3. You can remove the value of the virus by right-clicking on it and removing it.

Tip: To find a virus-created value, you can right-click on it and click “Modify” to see which file it is set to run. If this is the virus file location, remove the value.

Step 3: Find files created by ransomware

For Windows 8, 8.1 and 10.

For Windows XP, Vista, and 7.

For Newer Windows Operating Systems

1: On your keyboard press  + R and write explorer.exe in the Run text box and then click on the Ok button.

2: Click on your PC from the quick access bar. This is usually an icon with a monitor and its name is either “My Computer”, “My PC” or “This PC” or whatever you have named it.

3: Navigate to the search box in the top-right of your PC’s screen and type “fileextension:” and after which type the file extension. If you are looking for malicious executables, an example may be “fileextension:exe”. After doing that, leave a space and type the file name you believe the malware has created. Here is how it may appear if your file has been found:

N.B. We recommend to wait for the green loading bar in the navination box to fill up in case the PC is looking for the file and hasn’t found it yet.

For Older Windows Operating Systems

In older Windows OS’s the conventional approach should be the effective one:

1: Click on the Start Menu icon (usually on your bottom-left) and then choose the Search preference.

2: After the search window appears, choose More Advanced Options from the search assistant box. Another way is by clicking on All Files and Folders.

3: After that type the name of the file you are looking for and click on the Search button. This might take some time after which results will appear. If you have found the malicious file, you may copy or open its location by right-clicking on it.

Now you should be able to discover any file on Windows as long as it is on your hard drive and is not concealed via special software.

IMPORTANT!
Before starting “Step 4”, please boot back into Normal mode, in case you are currently in Safe Mode.
This will enable you to install and use SpyHunter 5 successfully.

Step 4: Scan for ransomware with SpyHunter Anti-Malware Tool

1. Click on the “Download” button to proceed to SpyHunter’s download page.

Download

Malware Removal Tool

It is recommended to run a scan before purchasing the full version of the software to make sure that the current version of the malware can be detected by SpyHunter. Click on the corresponding links to check SpyHunter’s EULA, Privacy Policy and Threat Assessment Criteria.

2. After you have installed SpyHunter, wait for it to update automatically.

3. After the update process has finished, click on the ‘Malware/PC Scan’ tab. A new window will appear. Click on ‘Start Scan’.

4. After SpyHunter has finished scanning your PC for any files of the associated threat and found them, you can try to get them removed automatically and permanently by clicking on the ‘Next’ button.

If any threats have been removed, it is highly recommended to restart your PC.

Step 5 (Optional): Try to Restore Files Encrypted by ransomware.

Ransomware infections and ransomware aim to encrypt your files using an encryption algorithm which may be very difficult to decrypt. This is why we have suggested a data recovery method that may help you go around direct decryption and try to restore your files. Bear in mind that this method may not be 100% effective but may also help you a little or a lot in different situations.

1. Download the reccomended Data Recovery software by clicking on the link underneath:

Stellar Data Recovery Technician Version

2. On the download page, click on the “Download” button:

3. Click on “Save File” button:

4. Accept all agreements and click “Next”:

5. After all the “Next” steps, click on “Install” and then wait for the installation to complete:

6. Run the software. Click on the location to scan for missing or deleted files and click on “Scan”:

7. Wait for the scan to complete, it may take some time. Be advised that this scan is not 100% guaranteed to recover all files, but it does have some chance to get your data back:

For more “how-to” file recovery methods and steps, you can visit our instructive article on “How to Restore Files Encrypted by Ransomware (Without Decrypter)“.

Ventsislav Krastev

More Posts - Website

OFFER

REMOVE IT NOW (PC)

with Spy Hunter

Preparation before removing ransomware.

Before starting the actual removal process, we recommend that you do the following preparation steps.

Make sure you have these instructions always open and in front of your eyes.
Do a backup of all of your files, even if they could be damaged. You should back up your data with a cloud backup solution and insure your files against any type of loss, even from the most severe threats.
Be patient as this could take a while.

Step 1: Boot Your PC In Safe Mode to isolate and remove ransomware

OFFER

Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!

We Recommend To Scan Your PC with SpyHunter

1. Hold Windows key() + R

2. The “Run” Window will appear. In it, type “msconfig” and click OK.

3. Go to the “Boot” tab. There select “Safe Boot” and then click “Apply” and “OK”.

Tip: Make sure to reverse those changes by unticking Safe Boot after that, because your system will always boot in Safe Boot from now on.

4. When prompted, click on “Restart” to go into Safe Mode.

5. You can recognise Safe Mode by the words written on the corners of your screen.

Step 2: Clean any registries, created by ransomware on your computer.

The usually targeted registries of Windows machines are the following:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

You can access them by opening the Windows registry editor and deleting any values, created by ransomware there. This can happen by following the steps underneath:

1. Open the Run Window again, type “regedit” and click OK.

2. When you open it, you can freely navigate to the Run and RunOnce keys, whose locations are shown above.

3. You can remove the value of the virus by right-clicking on it and removing it.

Tip: To find a virus-created value, you can right-click on it and click “Modify” to see which file it is set to run. If this is the virus file location, remove the value.

Step 3: Find files created by ransomware

For Windows 8, 8.1 and 10.

For Windows XP, Vista, and 7.

For Newer Windows Operating Systems

1: On your keyboard press  + R and write explorer.exe in the Run text box and then click on the Ok button.

N.B. We recommend to wait for the green loading bar in the navination box to fill up in case the PC is looking for the file and hasn’t found it yet.

For Older Windows Operating Systems

In older Windows OS’s the conventional approach should be the effective one:

1: Click on the Start Menu icon (usually on your bottom-left) and then choose the Search preference.

2: After the search window appears, choose More Advanced Options from the search assistant box. Another way is by clicking on All Files and Folders.

Now you should be able to discover any file on Windows as long as it is on your hard drive and is not concealed via special software.

Step 4: Scan for ransomware with SpyHunter Anti-Malware Tool

1. Click on the “Download” button to proceed to SpyHunter’s download page.

Download

Malware Removal Tool

2. After you have installed SpyHunter, wait for it to update automatically.

3. After the update process has finished, click on the ‘Malware/PC Scan’ tab. A new window will appear. Click on ‘Start Scan’.

If any threats have been removed, it is highly recommended to restart your PC.

Ventsislav Krastev

More Posts - Website

OFFER

REMOVE IT NOW (PC)

with Spy Hunter

Preparation before removing ransomware.

Before starting the actual removal process, we recommend that you do the following preparation steps.

Make sure you have these instructions always open and in front of your eyes.
Be patient as this could take a while.

Step 1: Uninstall ransomware and related software from Windows

OFFER

Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!

We Recommend To Scan Your PC with SpyHunter

Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it. To do that:

1. Hold the Windows Logo Button and “R” on your keyboard. A Pop-up window will appear.

2. In the field type in “appwiz.cpl” and press ENTER.

3. This will open a window with all the programs installed on the PC. Select the program that you want to remove, and press “Uninstall”

Follow the instructions above and you will successfully uninstall most programs.

Step 2: Clean your Browsers from ransomware.

Remove an extension from Mozilla Firefox

Remove an extension from Google Chrome

Remove an extension from Internet Explorer

Remove an extension from Microsoft Edge

1. Start Mozilla Firefox. Open the menu window

2. Select the “Add-ons” icon from the menu.

3. Select the unwanted extension and click “Remove“

4. After the extension is removed, restart Mozilla Firefox by closing it from the red “X” button at the top right corner and start it again.

1. Start Google Chrome and open the drop menu

2. Move the cursor over “Tools” and then from the extended menu choose “Extensions“

3. From the opened “Extensions” menu locate the unwanted extension and click on its “Remove” button.

4. After the extension is removed, restart Google Chrome by closing it from the red “X” button at the top right corner and start it again.

1. Start Internet Explorer:
2. Click on the gear icon labeled ‘Tools’ to open the drop menu and select ‘Manage Add-ons’

3. In the ‘Manage Add-ons’ window.

4. Select the extension you want to remove and then click ‘Disable’. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click ‘Disable’.

5. After the unwanted extension has been removed, restart Internet Explorer by closing it from the red ‘X’ button located at the top right corner and start it again.

1. Start Edge

2. Open the drop menu by clicking on the icon at the top right corner.

3. From the drop menu select “Extensions”.

4. Choose the suspected malicious extension you want to remove and then click on the gear icon.

5. Remove the malicious extension by scrolling down and then clicking on Uninstall.

Step 3: Clean any registries, created by ransomware on your computer.

The usually targeted registries of Windows machines are the following:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

You can access them by opening the Windows registry editor and deleting any values, created by ransomware there. This can happen by following the steps underneath:

1. Open the Run Window again, type “regedit” and click OK.

2. When you open it, you can freely navigate to the Run and RunOnce keys, whose locations are shown above.

3. You can remove the value of the virus by right-clicking on it and removing it.

Tip: To find a virus-created value, you can right-click on it and click “Modify” to see which file it is set to run. If this is the virus file location, remove the value.

Step 4: Scan for ransomware with SpyHunter Anti-Malware Tool

1. Click on the “Download” button to proceed to SpyHunter’s download page.

Download

Malware Removal Tool

2. After you have installed SpyHunter, wait for it to update automatically.

3. After the update process has finished, click on the ‘Malware/PC Scan’ tab. A new window will appear. Click on ‘Start Scan’.

If any threats have been removed, it is highly recommended to restart your PC.

Ventsislav Krastev

More Posts - Website

OFFER

REMOVE IT NOW (MAC)

with Combo Cleaner

ransomware may remain persistent on your system and may re-infect it. We recommend you to download Combo Cleaner and run free scan to remove all virus files on your Mac. This saves you hours of time and effort compared to doing the removal yourself.

Combo Cleaner’s scanner is free but the paid version is needed to remove the malware threats. Read Combo Cleaner’s EULA and Privacy Policy

Preparation Phase:

Before starting to follow the steps below, be advised that you should first do the following preparations:

Backup your files in case the worst happens.
Make sure to have a device with these instructions on standy.
Arm yourself with patience.

Step 1: Uninstall ransomware and remove related files and objects

OFFER

Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!

We Recommend To Scan Your Mac with Combo Cleaner

Keep in mind, that Combo Cleaner needs to purchased to remove the malware threats. Click on the corresponding links to check Combo Cleaner’s EULA and Privacy Policy

1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:

2. Find Activity Monitor and double-click it:

3. In the Activity Monitor look for any suspicious processes, belonging or related to ransomware:

Tip: To quit a process completely, choose the “Force Quit” option.

4. Click on the “Go” button again, but this time select Applications. Another way is with the ⇧+⌘+A buttons.

5. In the Applications menu, look for any suspicious app or an app with a name, similar or identical to ransomware. If you find it, right-click on the app and select “Move to Trash”.

6. Select Accounts, after which click on the Login Items preference. Your Mac will then show you a list of items that start automatically when you log in. Look for any suspicious apps identical or similar to ransomware. Check the app you want to stop from running automatically and then select on the Minus (“–“) icon to hide it.

7. Remove any left-over files that might be related to this threat manually by following the sub-steps below:

Go to Finder.
In the search bar type the name of the app that you want to remove.
Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.

Step 2: Remove ransomware – related extensions from your Mac’s browsers

Remove a toolbar from Mozilla Firefox

Remove a toolbar from Google Chrome

Remove an extension from Safari and reset it.

1. Start Mozilla Firefox. Open the menu window

2. Select the “Add-ons” icon from the menu.

3. Select the Extension and click “Remove“

4. After the extension is removed, restart Mozilla Firefox by closing it from the red “X” in the top right corner and start it again.

1. Start Google Chrome and open the drop menu

2. Move the cursor over “Tools” and then from the extended menu choose “Extensions“

3. From the opened “Extensions” menu locate the add-on and click on the garbage bin icon on the right of it.

4. After the extension is removed, restart Google Chrome by closing it from the red “X” in the top right corner and start it again.

1. Start Safari

2. After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.

3. From the menu, click on “Preferences“

4. After that, select the ‘Extensions’ Tab

5. Click once on the extension you want to remove.

6. Click ‘Uninstall’

A pop-up window will appear asking for confirmation to uninstall the extension. Select ‘Uninstall’ again, and the ransomware will be removed.

How to Reset Safari
IMPORTANT: Before resetting Safari make sure you back up all your saved passwords within the browser in case you forget them.

Start Safari and then click on the gear leaver icon.

Click the Reset Safari button and you will reset the browser.

Step 3: Scan for and remove ransomware files from your Mac

When you are facing problems on your Mac as a result of unwanted scripts and programs such as ransomware, the recommended way of eliminating the threat is by using an anti-malware program. Combo Cleaner offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.

Download

Combo Cleaner

Ventsislav Krastev

More Posts - Website

299 Comments

karim December 16, 2018 at 9:50 am

my computer is infected by a quite new malware named ilksktivw and demands money to release files.

Reply ↓
1. Milena Dimitrova December 17, 2018 at 9:24 am
  
  Hi Karim,
  Is that the extension that has been appended to your files? Can you give us more information?
  
  Reply ↓
  1. Sergio Herrera January 31, 2019 at 9:50 pm
    
    Hola Milena
    
    Mi nombre es Sergio Herrera, yo tambien tengo problemas con mis archivos. estan encriptados por el virus pumax tienen extencion *.pumax. podras ayudarme para desencriptar mis archivos. realmente agradezco su ayuda.
    saludos cordiales.
    
    Reply ↓
    1. Milena Dimitrova February 1, 2019 at 2:03 pm
      
      Hi Sergio,
      
      Fortunately there is a decrypter for the .pumax ransomware, please find it here: https://sensorstechforum.com/pumax-files-virus-remove/
      Have a look at the .pumax Virus – Update December 2018 section of the article where the download link is situated.
      
      Reply ↓
      1. Otto Garzon Lazo March 2, 2019 at 9:40 pm
        
        Milena Dimitrova ,hola por favor, mi maquina se infecto con la extensión .promarad, según he revisado es de DJVU, puedes ayudarme por favor
  2. Gerardo ramos February 7, 2019 at 9:46 pm
    
    Perdí fotos muy importantes de un casamiento y se transformaron con extensión .blower no tengo dinero para pagar los desencriptadores quisiera saber si se puede hacer algo …. Incluso todo el disco quedo con los files en .blower por favor auxilio que hago
    
    Reply ↓
    1. Mario February 12, 2019 at 6:04 am
      
      we are having the same problem, if you can find any solution to this problem please let me know and I will do the same
      thank you.
      
      Reply ↓
  3. ekankam May 2, 2019 at 7:15 am
    
    ‘mdenwoscnv’… this is the extension that has appended my files. Gandcrab 5.2
    
    —= GANDCRAB V5.2 =—
    
    ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
    
    *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
    
    Attention!
    
    All your files, documents, photos, databases and other important files are encrypted and have the extension: .MDENWOSCNV
    
    The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
    
    The server with your key is in a closed network TOR. You can get there by the following ways:
    
    —————————————————————————————-
    
    | 0. Download Tor browser – https://www.torproject.org/
    
    | 1. Install Tor browser
    | 2. Open Tor Browser
    | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/7a5cf7ad42ee203
    | 4. Follow the instructions on this page
    
    —————————————————————————————-
    
    On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
    
    ATTENTION!
    
    IN ORDER TO PREVENT DATA DAMAGE:
    
    * DO NOT MODIFY ENCRYPTED FILES
    * DO NOT CHANGE DATA BELOW
    
    —BEGIN GANDCRAB KEY—
    lAQAADAJgYtRzogG6VI9idTrIRXUeN8zn21wcirjNWAzsNW1s730AtMEXjfdRNRIeJffhU2DD0qJCF3yElHQ5Rh6/WxbILF5P/Etfr/NV6ITyymPASD0FkIH/kX7P0gXgW5RUIOjZIvCGUSCPcdGyFxE5MtP9AQIEPOCcRyUPpj2CM4jDfhhjfFoNiJEGu3vxGPWIuPODXCCcZF9y5DoA+oiUs3z6HInQC3ANuimBUAwcOkaykjSLaqykN2EXnaboXM0Mq8d8UbilmxFBdDtElfN624leVspQny/GDwjZcyt5P0hY5Ql1okq55M8XlolPInQQKpGEfmR8efMM9uak0RDk1FAamQG63/XCFJvHYXwezLFFVVZPlsgsLYx1p5vr+bpgf53VU+jsYZsvhx7ZXAhOzojRIPUHrmlZcfWt8siNM3p4GVz2C+9ZitDG2I+HhxyGiubPEyqQ8Lgm9lVZH/2/Lk0LEKxnu3CXG1yslLVBI4y2f2NO+doIlXcpj7UwTLxna3vsnxrQASyqVIqrNte4G0yvN8YEAi7jyFQA2lPVEUDNidEmeGF2mBNewtBlNFzX2QIMPd4VxkaOE8SCeX+2nrNskXJaSldZVUcUXEC4KUi+9jlX4djJX2EHO/rLpVc9oEwojfOf/SD1ZoMqpXzaFigPL/0zlH+ItasEyiYcpevWq5TZX8oBx+YwZe+pPfKf1GXUCDGwKfM4/J71X+3i17gs5sKrK7+Q5Amy23Wri0RLsugonqpGN76pRUHI7WaJj0TidiVv/MX4d3V3oCfRsY69jKrkp1WyPpT6kZS9kunr9k7SCOsN1e0/YHXKPhfxw6qADZqyioi3qjeBJf4eletP8FV/3owH/MZtNUW3+wBfSrUe0aYrivkRza9GZvQsBjJONk4FP4CGmbzXWF55YukxTdkylHYrMh8XC/kZkPdq6Wb/MZ0NGn+saZ2vv8D1Lm6Y54e5MxUTc2yo3smVf03Btyl6Ur/NY5X1U04QzfUFg/PhsQqYRaXvFO6GU7J425ZUPgp5n9U4a2dSS+BClyqoDYg7P2K2BkXMAw027AEjjHpAbNn4G2iXdt9heBXPzbEPmLosemHxNVkQEYQW31TbddowmZbfxo4m2J92MyQD9FsmpF0cMNtXuVLg8wcB+Xqhz3qADg2Su9Cemslu6AYkmcpQsXOCKrZsoYGbw0ry/lWERSqP1DboDQWHWXGQN/cLfD6PxWT7pUJsDfMyfZxV5DW6IuFg79rBZOBUCur4W20JWUBFKJPjvX9ao3tlLxcKsf5pAh5nNYSBRs0s8w6r7a7vda+7aoBAgfKTTlkd6trLBJUt87IqAGCS/hu1ENH8EEZOSjQ2j0B3u9d0Xt2KyVWoyyzPoUbFI7YRdzsanicwPbQ2cWJQgz7P/taD9FacpAmIyzOrkeM9C63cc7hAazGr15/llCxLetrfcVgwHl5iK7SEBKIVDIpY171G8p3Nx/v/+rGXI0ace7UTwRyu0vWNvql4adJsmzqPRcd1KB8L/YwHHoMWkQ3t4VvJ6/U5SnKYdDfmiGI6OyHa2dgzxu7yI6OL803YwXY4Lkc+Imw9u8GTK4qL19zWz+bqUsVLn+5BZ55WBM/gThSWNmI8y3sv+KVK+ClmMA+xGDP7vLG0+XAvamOn5Jo6A/eXKTMvXMQaMujgiLXbnS7ISQFQLwNm16HBNUWBOMFmHQ2KvdachMGlUxeahems8hryl1W6FjtrIc7wsCuadT0uNzRPmL26g8QivdUM91YXwioP0wcs4YQw95RZyTLeDm+8PYbg70Nwhrc7KyXltvJxn//GNdKROvFjS4JI5fj1gxl2VppwkYib76Si+Sch1aBkX94hWjJQTIG3Uv7rtHcqBTHwByGeADV/JEa675OHU/ifWzBxksDBy01kJmOPY4A/qyydbXFLO5uYgntEg1YHFFB0vZWt/rAA1UBS2dixBi+Jt3WdSy5C2s+YQYfbR/inH+cZimIBFf0fQjacmKU5S9Nc7tried1+cLpSbSgLGIAKwWZoA3HdvQ6UW6Wg25vr71Zk0iOhNmCEhAPJn7FAk4JOWWgHYFeb2zFpbwNol0jlI4ryecdinvFXiXLLMAcyPiVVsbhPEG1q2biBxLzOXSw6dUTRciFFyLip8xURVaKEjq7DWzrEe3YdvMNaIZ573mi3u6IdBnQjv8ezj27hbxLSUVPbWuHXAbsLFTqu5oKVpmqqkdNXsI8Ew53vy0eZuXuGO4=
    —END GANDCRAB KEY—
    
    —BEGIN PC DATA—
    7ftDEgLb/ZS0lcmZbHM61KPJ5QOnD5UKmw6YbtogFHYeWLYCxZ+XYFtxBmDb9KHJMJDbAvSVseDPRXvIIXQmQ2qay7PczsgSeehmapSX2qbLGOIpU0uVIkugicQ2qivs7UgEXVJiDcF0iWP/gFL8WqBHGyOgMof74iZHO883kWa60KsRG/ofEubBktllsrKHT/UeIK90f4NTA3Q0Aa7fDOtFnCOTB5ome7FLZ/fMCt27gAb2/52sUzN7xdxdWKoyoIWs5zhHRnLzMN2B2FCdeiqo6lrnnIaZ6V9BSTXO4zB9mPr7qICkGFwpU6i/RSEVcPfH0wpSWSCYtNWJJNBZBilqqcZvR+W3YrGamdOR3UfUP93y/vMwLOHjW6PirwtWo+YkTxTJi/a4L0V0svf5S0uz66BfoUfFwZ2FPDCx4ShFud3oPVoJ6iuVz+mqqBpva7wdrtMyqi8A1fqlXTmS7qd4Aew/gTiwNUzEb+Yfs9wmLRGjwLinwCjinzPeKPygh42fWKb+7gkWvC6ijoFSEvtEvCM/AMXhw9QRIEb1V0GbyemMap0N1g0/++Qbe2sEznTBCrbrZtdJPEOVLco+Lu0bswnKcECVorCUEcCsFrTRnIiaaUI1b9k0s1GLcyrSiKIADBDFnYGgqEJw2kbHxMHGvHUKm+/KPPM0EpSdBZiuzltfHLo=
    —END PC DATA—
    
    Reply ↓
  4. Shameer June 1, 2019 at 8:16 pm
    
    Sir my files are infected with .skymap extension. I have tried Stop Decrypter but no luck.When do you think that the decrypter will be available.
    
    Reply ↓
    1. Milena Dimitrova June 3, 2019 at 8:39 am
      
      Hi Shameer,
      
      There is a decryption tool but is is designed to support specific offline IDs, so it may not be effective for all cases of .skymap ransomware infections. More information here: https://sensorstechforum.com/remove-skymap-files-virus/
      
      Reply ↓
  5. ZSC July 23, 2019 at 11:39 am
    
    @Hi Milena
    My files are infected with .[wewillhelpyou@qq.com].adage ransomware. is there a decrypter or a solution to get back my files?
    
    Reply ↓
Steven December 18, 2018 at 9:49 am

Hello Milena,

My computer also infected by ransomeware and most of the files extensions are renamed as .zeyilkz, are there any ways to decrypt them? Million thanks.

Best regards,
Steven

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 10:13 am
  
  That is a custom extension – it is robably GandCrab. Did you get a ransomware note or a text file with instructions? If you did, can you share the text here?
  
  Reply ↓
Kay January 9, 2019 at 2:02 pm

Mine was named .adobe. Has anybody had any progress with resolving this?

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 11:04 am
  
  Hello, Kay.
  I have seen a person on Twitter who was able to decrypt some files encrypted by the .adobe ransomware. However, that person asks for thousands of dollars for his services. I guess a free decryption tool might be available soon.
  
  Reply ↓
2. Gergana Ivanova February 18, 2019 at 11:21 am
  
  Hey, Kay!
  The same extension has been detected as one used by STOP ransomware strain. The good news is that security researchers have cracked the code of this threat and released a decryption tool. So you may be able to recover .adobe files with the help of this tool. Have in mind that another ransomware called Dharma also has a train that appends the extension .adobe. In case that your files were corrupted by Dharma .adobe your best option is to attempt to restore them from backups or consider the use of alternative data recovery approaches.
  
  Reply ↓
vaggelis January 9, 2019 at 7:45 pm

my files are decrypted and the extension is ktpviuiin.
how can i decrypt them ?
please help i am desperate………..

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 11:06 am
  
  Hello, vaggelis. This is a custom extension. It might be GandCrab ransomware. If it is a newer version – there is no solution. If the version is older, try the official decryption tool released last year – https://sensorstechforum.com/decrypt-gandcrab-ransomware-files/
  
  Reply ↓
Norma January 9, 2019 at 8:36 pm

Mi equipo esta infectado por un randsomware y añadió a mis archivos y fotografías una extensión .djvuq y en cada carpeta hay una hoja nombrada .openme.tx Ustedes creen que sea posible restaurar mis archivos? Gracias por su ayuda!

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 11:29 am
  
  Yes – there is a decryption tool released. You can find a download link in the beginning of this article: https://sensorstechforum.com/djvur-ransomware-remove/
  
  .djvur and .djvuq are both variants of STOP ransomware and have the same decryption tool mentioned above.
  
  Reply ↓
DJELMEN January 15, 2019 at 9:51 am

My computer also infected udjvu and most of the files extensions are renamed as udjvu, are there any ways to decrypt them?

Reply ↓
1. Gergana Ivanova February 18, 2019 at 11:36 am
  
  Hey, DJELMEN!
  
  Happily, you can attempt to restore .udjvu files with a free decryption tool released by the security researcher Michael Gillespie. You can download the tool via the Decryption Tool link here. The tool requires a pair of an original file and its encrypted version.
  
  Reply ↓
  1. anturi May 8, 2019 at 6:00 pm
    
    thx a lot
    
    Reply ↓
Jenaro January 16, 2019 at 3:19 pm

Buenos días, tengo información encriptada por extención .Rapid, se puede salvar ?
Gracias!!

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 11:34 am
  
  You can copy your encrypted files to another disk drive and wait for an official decryption tool released for free.
  
  As for the decryption tool sold by the criminals, do not buy it – it is broken. Only a few files are decrypted with it if the criminals decide to give you a decryptor. Wait and maybe there will be a solution in the future.
  
  Reply ↓
Eliodoro January 16, 2019 at 8:22 pm

Hola,
el pasado 9 de enero de 2019 fue atacado mi pc y me encriptaron los archivos, la extensión de los archivos es “*.no_more_ransom”.
En las carpetas dejaron un fichero llamador “How Recovery Files.txt” con el siguiente texto:
Hello, dear friend!
All your files have been ENCRYPTED
Do you really want to restore your files?
Write to our email – rapid@helprapid.org …………
El programa Spyhunter 5 no me ha detectado nada extraño en el sistema.
La última copia de seguridad es de hace 2 meses.
¿Cómo podría desencriptar los archivos?
Gracias de antemano

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 3:59 pm
  
  Hello, Eliodoro,
  write to the support of Spy Hunter regarding the detection. As for the files – for the time being there is no official solution.
  
  Reply ↓
Umar Javed January 25, 2019 at 9:59 pm

My computer is infected with all hard drives with gandcrab 5.1 and i am searching how can i get my files back and do not pay to that bastards

Reply ↓
1. SUN February 17, 2019 at 6:14 pm
  
  MY PC ALSO AFFECTED WITH GAND CRAB 5.1 on 20 Jan 2019
  
  AND SEARCHING FOR A SOLUTION…..
  
  Reply ↓
Ban January 26, 2019 at 2:52 pm

My PC also has been infected by ransomeware and all the files extension are in UIYAGBSI file. Please help

Thank you.

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 11:10 am
  
  Umar Javed, SUN – GandCrab 5.1 is a newer version and there is no decryption solution for it.
  
  Ban – that sounds like GandCrab as well, but try the official decryptor if it is an older version of the virus: https://sensorstechforum.com/decrypt-gandcrab-ransomware-files/
  
  Reply ↓
Titan January 29, 2019 at 2:35 am

Hola alquien encontro como recuperar los archivos… Esos malnacidos me contaminaron todo el trabajo

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 3:47 pm
  
  Hello, Titan,
  have you tried any of the above methods? Also, what ransomware has infected your files? If you know – share here.
  
  Reply ↓
ventsislav georgiev January 31, 2019 at 7:59 pm

infected the extension is .ekptwbs tray many methods and nothing if abybody can help me my email is vendzi4@gmail.com

Reply ↓
rach January 31, 2019 at 8:20 pm

mon pc est infecte par un ransomware ; NANO aider moi svp a recupere tout mes fichiers

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 3:44 pm
  
  Hey rach,
  try using the Aurora Decrypter tool linked in this article : https://sensorstechforum.com/nano-files-virus-ransomware-remove/ There is a chance that this is another ransomware using the same extension (a Scarab ransomware variant), in which case we are unaware of a decryption solution.
  
  Reply ↓
ventsislav georgiev January 31, 2019 at 9:09 pm

grandgrab5.0.4 extension .ekptwbs please help me to decrypt them with bitdefender its impossible my email is vendzi4@gmail.com

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 3:41 pm
  
  Ventsislav,
  5.0.4 version of Gandcrab is not decryptable yet. You should backup your files and wait for an update to the decrypter – hopefully it will happen.
  
  Reply ↓
Jim February 1, 2019 at 8:28 pm

Hi,

A friend got infected with a ransomware called Jaffe@Tuta.Io

Any ideas?

Thanks

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 3:39 pm
  
  We are aware of the ransomware – you can check our article for more information – https://sensorstechforum.com/remove-jaffe-ransomware/
  
  Other than that, there is no known official decryption tool released for Jaffe ransomware.
  
  Reply ↓
Sagar SR February 2, 2019 at 1:12 pm

Hi Milena,
all my desktop files are infected by a GANDCRAB v5.1 under the file name .ubhoiy
please help me retrieve my files..

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 4:00 pm
  
  Unfortunately, GANDCRAB v5.1 is not decryptable for now. We cannot help you as no solution exists, yet.
  
  Reply ↓
Flamas February 4, 2019 at 7:06 am

Hola.. Mi pc se infecto con un ransomware que deja todos mis archivos con una terminación .blower me puedes ayudar?

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 4:11 pm
  
  Hola Flamas,
  currently there is no decryptor for .blower ransomware. As it is a STOP variant a decryptor might be developed. Just save your files and wait.
  
  Reply ↓
VIVEK February 8, 2019 at 7:18 pm

my photo files are all encrypted with extension .bklhn
Any help would be much appreciated

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 4:14 pm
  
  VIVEK,
  nowadays, solely knowing the extension of a ransomware virus is not enough to determine of which ransomware family it is. It looks as if you have a custom extension, which is probably generated by GandCrab ransomware. If that is the case and the infection is new (from this month) you probably got a newer version of the virus and it is not decryptable.
  
  Do you see anything else that you can share – a ransom note, message with instructions?
  
  Reply ↓
xfoun February 11, 2019 at 6:22 pm

Buenas chicos , mis archivos estan encriptados en .local , alguna idea ?? muchas gracias

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 4:18 pm
  
  Hey xfoun,
  I have never heard of the .local extension. Any other information you can share on the virus – .txt file, ransom message or instructions on the infected computer?
  
  Reply ↓
2. Tsetso Mihailov August 23, 2019 at 6:40 pm
  
  Hello again xfoun.
  A ransomware virus, which encrypts files and places .local as their new extension has been found recently. It is a variant of STOP ransomware – you can read more on the link:
  https://sensorstechforum.com/local-file-virus-stop-remove/
  
  I know months have past since you first wrote, but if this is the virus that hit your computer, you can try to decrypt some of your files with the general STOP decrypter linked here:
  https://sensorstechforum.com/decrypt-files-stop-ransomware/
  
  I hope this helps you in some way.
  
  Reply ↓
Mario February 12, 2019 at 6:06 am

hi, let me know if you find any solution on this, we have the same problem. I will do the same for you.

Thanks

Reply ↓
Azhar Abbas February 12, 2019 at 6:30 am

My files infected on 9th February 2019, by KRAKEN CRYPTOR, encrypted files extension is .YTUSU , Please suggest any decryptor if available.

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 4:24 pm
  
  Hello Azhar,
  there is no too that can decrypt KRAKEN CRYPTOR yet. We will write if such a tool is released.
  
  Reply ↓
KOSKAMP February 12, 2019 at 2:30 pm

CAN SOMEBODY HELP ME WITH THIS EXTENSION .KUFQZTS TO REMOVE FROM MY FILES THANK YOU

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 4:25 pm
  
  Probably GandCrab ransomware. If its new – it cannot be helped.
  
  Reply ↓
Akila February 14, 2019 at 1:36 am

is there any decrypter for the *.xoloed ransomware ? plz help

Reply ↓
1. Milena Dimitrova February 18, 2019 at 9:22 am
  
  Hi there,
  
  Can you give us more details about your infection? Is there a ransom note you can share with us?
  
  Reply ↓
Roan February 15, 2019 at 4:42 pm

My files are named .qdsmrc is there a way to fix it ? I really want my good trip memories memories back :(.

Reply ↓
1. Milena Dimitrova February 18, 2019 at 9:09 am
  
  Hi Roan,
  Can you provide us with further details about your infection?
  
  Reply ↓
cristain February 16, 2019 at 11:27 am

hola mis archivos asido infectados con la extencion ( BTEGHU ) y deja un archivo de nota en cada carpeta con el nombre de BTEGHU-DECRYPT hay alguna solución para recuperar mis cosas

Reply ↓
1. Tsetso Mihailov February 18, 2019 at 4:28 pm
  
  Hello, cristain.
  This is most likely GandCrab ransomware. Can you share the contents (text) of the BTEGHU-DECRYPT.TXT file?
  
  Reply ↓
Dialora February 17, 2019 at 7:54 am

My files are all infected on 16th February, encrypted files extension is JXSCT.
Please suggest any decryptor if available

Reply ↓
Gergana Ivanova February 18, 2019 at 12:00 pm

Hello, Dialora!

Considering the random extension you mentioned, we believe that your PC has been infected by a version of GandCrab ransomware. Do you see any ransom note or a text file with instructions? If you do, look for the mention of specific numbers. When you find them visit our article on how to decrypt files encrypted by GandCrab Ransomware and find your version. Beware that all versions released after 5.0.4 including the newest 5.1 are still not decryptable.

Reply ↓
Bauti February 18, 2019 at 12:41 pm

All my file are infected by gandcrab 5.1 on 16 February, encrypted files extension is “krsefzfhq”. I would really appreciate any help and suggestions.

Reply ↓
1. Milena Dimitrova February 18, 2019 at 2:42 pm
  
  Hello,
  
  Sorry to hear about your infection. Unfortunately, there is no decryption tool for this version of the ransomware. You can remove the ransomware using an anti-malware program but there is no option to restore your files. More information about the ransomware: https://sensorstechforum.com/remove-gandcrab-5-1-ransomware/?%D0%B4%D0%BB%D0%BD
  
  Reply ↓
sivone February 19, 2019 at 5:50 am

Hi, every one on the internet who is kind. Can you help me?, my files were encrypted by gancrab ransomware 5.1. The file shows look like this:

Diffraction.docx.djhzsis.blower.

All my files are blower file.
Could you please help me?

Reply ↓
1. Milena Dimitrova February 19, 2019 at 8:36 am
  
  Hi Sivone,
  
  Unfortunately, this version of the ransomware is not decryptable. You can try alternative data restoration methods but there is no guarantee. More information here: https://sensorstechforum.com/blower-files-virus-remove/?lnln
  
  Reply ↓
Valerio February 19, 2019 at 9:42 am

Dear Sensors Tech Forum,
can You help me? Please! All my files, documents, photos, images, videos, and other important files are encrypted and have the extension “.JRSGLQXT”.
Within each corrupt folder there is the following file!
“GANDCRAB V5.1 – UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS – Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .JRSGLQXT – The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.”
Thank’s in advance for Your reply.

Reply ↓
1. Milena Dimitrova February 19, 2019 at 10:08 am
  
  Hi Valerio,
  
  We are very sorry for the loss of your files. Unfortunately, this version of the ransomware is not decryptable. You can learn more about it here: https://sensorstechforum.com/remove-gandcrab-5-1-ransomware/
  
  Reply ↓
Miguel February 20, 2019 at 7:27 am

alguien puede ayudarme a desencriptar archivos con la extensión. blower

Reply ↓
Maik February 24, 2019 at 12:18 am

Dear Sensors Tech Forum,
Please can you help me?All my files,photos,videos,documents and other´s are encrypted by Gandcrab V5.1 on February 09,2019 and have now the Extension “SPKFSF”

Reply ↓
Maik Oebels February 24, 2019 at 12:30 am

Hallo Sensors Tech Forum,
Bitte um Hilfe.All meine Dateien,Fotos,Videos etc. wurden am 09. Februar 2019 durch “Gandcrab V5.1” verschlüsselt und haben nun die Erweiterung “spkfsf”.Gibt es da eine Möglichkeit die Daten wieder zu entschlüsseln?

Reply ↓
Ignacio February 26, 2019 at 1:17 am

Hola, mis archivos estan encriptados bajo la extensión .cbupus, por GANDCRAB v5.2. Estos métodos me funcionaran? Saludos

Reply ↓
MARA February 26, 2019 at 3:03 am

ESTIMADOS.
POR FAVOR ME PUEDEN AYUDAR, A MI SERVIDOR LE INGRESÓ Ransomware denominado CRYPT. BORRO TODA MI BASE DE DATOS.
HAN LOGRADO RECUPERAR LOS ARCHIVOS.
SLDS

Reply ↓
Jaume February 26, 2019 at 9:05 pm

No se el nombre del MALWARE me pone la extensión, . FAIL
Alguien me puede ayudar!!!!

Reply ↓
Lock February 27, 2019 at 10:34 am

My PC was affected GandCrab V5.2 with .WKNZFU extension in all my files.. any decryptor for V5.2 released ?

Reply ↓
elias February 28, 2019 at 5:45 am

buenas tengo mis archivos con la extension .ukbmz no se q tipo de virus es m si alguien podria ayudarme gracias ♥

Reply ↓
ELIAS February 28, 2019 at 6:10 am

hola buenas mi pc esta con los archivos y tiene la extension .UKBMZ si me podrian ayudar se los agradeceria muchisimo

Reply ↓
Jhon February 28, 2019 at 6:15 pm

Mis archivos estan infectados con la extension ETH

Reply ↓
jorge February 28, 2019 at 10:24 pm

Hola, me paso lo mismo, la extension es .promoz, el mail de rescate blower@india.com y blower@firemail.cc. Me pueden informar si hay algun desencriptador por favor? Estoy desesperado.

Reply ↓
1. Ismael March 2, 2019 at 6:13 pm
  
  Hola, tengo exactamente el mismo problema….haz podido solucionarlo? de ser así, como lo hiciste? saludos
  
  Reply ↓
Kuki March 2, 2019 at 5:11 pm

I got ransomware with .promok extension :(((
Asking 490 USD to these email addresses blower@india.com, blower@firemail.cc
Do you know if there is decrypter for this please? .promok

Reply ↓
Ismael March 2, 2019 at 6:12 pm

Hola, tengo un NAS el cual fue infectado con rasomware todos los archivos estan encriptador con la extension .PROMOZ, spyhunter5 logro limpiar mi equipo, pero el servidor NAS aun sigue infectado, alguien conoce alguna herramienta (aunq sea de pago) o alguna forma de recuperar los archivos? la mayoría de mis archivos infectados son solo fotos y video familiares, estoy desesperado, estan las fotos de toda la vida ='( …. esta es la nota de rescate que aparece, desde ya muchas gracias por su ayuda
——————————————————————————————————————————-
ATTENTION!

Don’t worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-ll0rIToOhf
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
blower@india.com

Reserve e-mail address to contact us:
blower@firemail.cc

Your personal ID:
034OspdywaduiShdktrecpmTcuXM4gQ1VxOiWCronjaflECHMOiIWMEQKZy2r
——————————————————————————————————————————-

Reply ↓
dean i March 2, 2019 at 8:21 pm

hi my files have been changed to FJLTS is therre a fix for this?

Reply ↓
dean March 3, 2019 at 10:16 am

all been changed too FJLTS

—= GANDCRAB V5.2 =—

***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************

*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****

Attention!

All your files, documents, photos, databases and other important files are encrypted and have the extension: .FJLTS

The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.

The server with your key is in a closed network TOR. You can get there by the following ways:

and this left in every folder on all my hard drives

Reply ↓
1. Milena Dimitrova March 5, 2019 at 12:27 pm
  
  Hi Dean,
  
  Unfortunately, this version of GandCrab is not decryptable at the moment. You can follow our website for updates on the ransomware.
  
  Reply ↓
ravee March 4, 2019 at 2:05 pm

hi My files has an extention of 87a1 how to I recover it I’ve waited for almost a year now,
please help

Reply ↓
1. Milena Dimitrova March 5, 2019 at 12:18 pm
  
  Hi ravee,
  
  Can you give us more details about your infection? The extension looks like Cerber ransomware: https://sensorstechforum.com/new-cerber-ransomware-remove-restore-encrypted-files/
  
  Reply ↓
Ismael March 4, 2019 at 2:29 pm

me paso lo mismo, mis archivos fueron encriptador por .promoz rasomware…alguien tiene alguna soluciona? (aunq sea de pago

Reply ↓
1. Milena Dimitrova March 5, 2019 at 12:13 pm
  
  Hi there,
  
  More information about this ransomware is available here: https://sensorstechforum.com/remove-promoz-files-virus/
  
  Reply ↓
Kevin March 4, 2019 at 8:50 pm

Hello,
I was hit with a ransomeware and all my files have the extension .local. Can someone help me?

Reply ↓
1. Milena Dimitrova March 5, 2019 at 12:06 pm
  
  Hi there,
  
  Can you give us more details about your infection?
  
  Reply ↓
  1. Kevin March 7, 2019 at 7:55 pm
    
    Sure, all files have a .local extension.
    
    The name of the ransomenote is “HOW TO RECOVER ENCRYPTED FILES”
    
    And they want me to contact
    BM-2cUPRnXJRuFYKcDUCLugjrCPY58nrvHrAV@bitmessage.ch
    
    Reply ↓
    1. kkeny March 11, 2019 at 2:34 pm
      
      Exactement le meme probleme mais en anglais ‘HOW TO RECOVER ENCRYPTED FILES.TXT”
      Tout mes fichiers son en .local
      Même adresse mail.
      l’id fourni est énorme
      help please????
      
      Reply ↓
marcelo March 6, 2019 at 4:14 am

Hola, en mayo de 2018 perdí todos mis archivos, mas de 50 gb, y mis backups también fueron infectados con la siguiente extensión 2415599031.ransomed@india.com y CRAB.2415599031.ransomed@india.com.CRAB si existe un descifrador se lo agradecería.

Reply ↓
Alamin Rahman March 6, 2019 at 8:57 am

Hello, My PC Effected By .IOPUMLYM Exctension and GANDCRAB V5.2
Please Anyone Help me for Decrypted my Encrypted file and folder

Reply ↓
Facundo Gil March 6, 2019 at 1:13 pm

Hola, soy victima de veracrypt@foxmail.com, me encripto archivos con la extension .adobe.
Me pueden ayudar?
Saludos y muchas gracias

Reply ↓
1. Tsetso Mihailov March 6, 2019 at 2:39 pm
  
  Read above on https://sensorstechforum.com/restore-files-encrypted-ransomware-without-decryptor/#comment-28651
  
  Reply ↓
Santi JR March 6, 2019 at 6:20 pm

Hola hace un par de meses me infectó un ransomware con extensión .missing, y a día de hoy aún no he podido descifrarlo. lo único que he podido averiguar es que se trata de una nueva variante del APOCALYPSE.
dejo nota de rescate:(el archivo figura así: IMG_9345.JPG.Contact_Data_Recovery)

Your computer was hit by ransomware

Contact by Email for your data recovery.

Email : restore_2019@mail.ru
Your Personal Identification ID: ID_RESTORE_E1B5040FES

We’ll provide proof of recovery and Data Decryption Software to you.

WARNING: If you don’t contact us, your data will be damaged. If we do not reply, email from a different email service.

Luego el archivo al cual se dirige citada nota del rescate figura con el nombre seguido de la extensión .missing

Se sabe algo al respecto, ayuda por favor

Reply ↓
jean March 8, 2019 at 2:04 pm

hola necesito ayuda mi pc se infecto con un ransomware .promorad existe alguna aplicación para desencriptar mis datos gracias

Reply ↓
Tunmise March 10, 2019 at 9:47 am

My SD card got infected with uuuuuuuu.uuu and it created so many folders. My files are still there but i’m unable to open or use them

Reply ↓
Cristhian lesmes March 11, 2019 at 2:35 am

Buena noche tengo un problema con uno de estos virus quisiera solicitar su ayuda el virus es un Promorad2 ransomware, agradezco su ayuda Milena.

Reply ↓
Jijith J V March 11, 2019 at 7:19 am

Hi All my files have affected by .bomber extension is there any way to decrypt the same?

Reply ↓
luis March 11, 2019 at 10:00 pm

i got my files changed to .kroput files any advice to get it back?

Reply ↓
IVAN March 11, 2019 at 11:05 pm

holaa necesito ayuda mis archivos se infectaron por un virus llamado streamer que encripto mis documentos y les puso la extension *.promorad2 alguien que sepa si hay alguna forma de recuperar los documentos, gracias de antemano

Reply ↓
Cristobal March 12, 2019 at 11:12 pm

hola yo tengo desde ayer uno que encripto todo lo que alcanzo en mi red en archivos compartidos con extension .KROPUT… habra alguna solucion??? me pide 980dls

Reply ↓
1. Leonardo Rovira April 10, 2019 at 2:07 pm
  
  todos mis archivos infectados con la extension .kropun. alguna solucion para recuperarlos? gracias
  
  Reply ↓
  1. Milena Dimitrova April 15, 2019 at 10:02 am
    
    Hi Leonardo, here’s more information about your infection https://sensorstechforum.com/remove-kropun-files-virus/
    
    Reply ↓
Guido March 13, 2019 at 12:48 am

Hola cómo están gente…un virus me infectó mí PC y me cambio las extensiones a .promora2 alguien tiene info o como se puede hacer, muchas gracias de antemano.

Reply ↓
Guido March 13, 2019 at 12:53 am

Hola gente…se me infectó mí PC y mis archivos de trabajo se cambiaron a la extensión .promora2 alguna solución o info de cómo recuperarlos…muchas gracias de antemano

Reply ↓
1. ronald revilla March 14, 2019 at 4:56 am
  
  a mi me paso igual amigo, no has conseguido solucion? soy de Venezuela
  
  Reply ↓
  1. Guido March 14, 2019 at 11:40 pm
    
    Nada aún, sigo buscando soluciones…me avisas si encuentras algo… gracias
    
    Reply ↓
Carlos March 13, 2019 at 5:45 pm

En mi laptop, memoria usb, y disco duro externo… se infectaron con el promorad2… como puedo recuperar mis archivos sin necesidad de formatear nada.

Reply ↓
Carlos g.x. March 13, 2019 at 5:48 pm

En mi laptop, memoria usb, y disco duro externo se infectaron con una extensión que es promorad2… como puedo recuperar archivos de mis discos extraíble sin necesidad de formatear nada.

Reply ↓
Rolando March 13, 2019 at 9:18 pm

buenas tardes alguien me puede ayudar a recuperar mis archivos que tienen la extecion .promorad2

Reply ↓
ronald revilla March 14, 2019 at 4:53 am

buenas noches, fui atacado por virus ransomware que encrypta y deja extension .promorad2 tendrán alguna solucion para esto?????

Reply ↓
rizwan March 14, 2019 at 3:36 pm

my pc is infected by ransomware please help me
—= GANDCRAB V5.2 =—

***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************

*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****

Attention!

All your files, documents, photos, databases and other important files are encrypted and have the extension: .GBYXADMGV

The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.

The server with your key is in a closed network TOR. You can get there by the following ways:

Reply ↓
Angel corso March 14, 2019 at 9:30 pm

Buenas tardes por favor ayudaaa help me le entro ese virus a mi pc y todos mis archivos tienen esta extencion ( .pulsar1 ) aguien que me ayude a como resolverlo por favor

Reply ↓
Marco March 14, 2019 at 10:55 pm

Hola
Mis archivos han sido infectados por la extensión .charck, hay alguna solución?

Reply ↓
JOE March 15, 2019 at 2:28 pm

Hola, necesito su ayuda todos mis documentos de mis discos(Archivos, fotos, videos entre otros) se han puesto con la extension . CHARCK necesito recuperarlos…… I NEED YOU!

Reply ↓
1. Milena Dimitrova March 18, 2019 at 1:44 pm
  
  Hi Joe,
  
  You have been attacked by a version of Stop ransomware. https://www.sensorstechforum.com/remove-charck-files-virus/
  Unfortunately, there is no decrypter for it at the moment.
  
  Reply ↓
Ivan Naranjo March 15, 2019 at 8:14 pm

ME PUEDEN AYUDAR POR FAVOR, TENGO INFECTADOS MIS ARCHIVOS, ESTAN CON UNA EXTENSION .pulsar1
agradezco mucho si alguien me puede ayudar. gracias Iván

Reply ↓
1. Milena Dimitrova March 18, 2019 at 1:41 pm
  
  Hi Ivan and Freddy,
  
  You both have been infected by a version of Stop ransomware which is not decryprable at the moment. You can read more about it in our article: https://sensorstechforum.com/remove-pulsar1-files-virus/
  If a decrypter is released, we will update the article with information. You can follow us for updates.
  
  Reply ↓
Manhal March 16, 2019 at 9:22 pm

hello any solution my files all get extension kroput

Reply ↓
1. Milena Dimitrova March 18, 2019 at 1:37 pm
  
  Hi Manhal,
  Unfortunately, no decryption for now. Here’s more information about the ransomware: https://sensorstechforum.com/remove-kroput-ransomware/
  
  Reply ↓
daniel March 17, 2019 at 6:30 am

buenas noches tengo ransomware que me encripto todos mis documentos con extension .pulsar1 alguien que me pueda ayudar son documentos muy importantes.

Reply ↓
1. Milena Dimitrova March 18, 2019 at 1:36 pm
  
  Hi daniel,
  
  You’ve been infected by https://sensorstechforum.com/remove-pulsar1-files-virus/. The bad news is that there is no decryption for it at this point.
  
  Reply ↓
imi737 March 17, 2019 at 7:24 pm

Zdravo , Hallo
All my data hdd is infected *HXCNTD*
Help…….

Reply ↓
1. Milena Dimitrova March 18, 2019 at 1:08 pm
  
  Hi there,
  
  It seems that you’ve been infected by а version of GancCrab. Can you give us more details about your infection, such as ransom note, to tell you if a decrypter is available.
  
  Reply ↓
Pool March 18, 2019 at 2:07 pm

My files are crypted by .kroput,anybody knows the solution?

Reply ↓
1. Milena Dimitrova March 18, 2019 at 2:24 pm
  
  Hi Pool,
  
  Unfortunately, no decryption tool is available at the moment. We will update our article (https://sensorstechforum.com/remove-kroput-ransomware/) if a decrypter is released.
  
  Reply ↓
  1. Pool March 18, 2019 at 2:29 pm
    
    Thanks Milena,but i did manage to decrypt 202 files from 4000+ with STOPDecryptor if that helps :)
    
    Reply ↓
Pool March 18, 2019 at 6:08 pm

Stellar Phoenix Photo Recovery will recover any photo or video,it doesn’t matter what virus ti is,that helped me,cheers

Reply ↓
Majo March 18, 2019 at 8:23 pm

Hola como estas. He notado la gran cantidad de virus ransomware. Hace casi un mes que estoy buscando solucion-. Mi pc fue atacada por el GandCrab v.5.2, bien nuevito…. Si uno compra el SpyHunter, recupera los archivos encriptados? o solo elimina el virus? Otra cosa, como hay tantas fallas de seguridad, mi bandeja de entrada de email llena de Spam. (yahoo y fibertel, no asi gmail hasta ahora)Muchas gracias.

Reply ↓
LOURDES March 19, 2019 at 1:58 am

como restaurar archivos cifrados por ransomware

Reply ↓
imi737 March 19, 2019 at 4:17 pm

—= GANDCRAB V5.2 =—

***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************

*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****

Attention!

All your files, documents, photos, databases and other important files are encrypted and have the extension: .HXCNTD

The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.

The server with your key is in a closed network TOR. You can get there by the following ways:

—————————————————————————————-

| 0. Download Tor browser – https://www.torproject.org/

| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/5b768db9b0f8d3d0
| 4. Follow the instructions on this page

—————————————————————————————-

On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.

ATTENTION!

IN ORDER TO PREVENT DATA DAMAGE:

* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW

—BEGIN GANDCRAB KEY—
lAQAALG5rR06FGgc3Z3vHwAexWFvWe6pXKGNmTrUK3/IVnbXC4qekGu5jJZRWr1ycEWWR5+CS8XOrzOzYlWAAgG5fh9i8rcW/NGDy4yCmMzwweh1BadN1ey3T5/DDGcmTPE6y6YMQDEzBqKRrgbUMp3wkFZi8QH67l8laDuZQZtuqE/JCuhGA3knB6B2qkbkYo28Yz6c8cEGjLpN6QYf8MH70IIheuPxthDbuGDLGad9gsng4VujjJ4bPNcJoa+ppIRpiumz8Mkjuxec3nZ81aJE3q9AAfOrmeQvNtW7pvq983CkrfmFf1+9tttOn5xYJYXjfZu2CA+UnbJC3WAwYGMRAkjpqeQFSr2ShlUcgeihKOFFgFugdrHT0nbaxUbDVVgAfC46ScDU8Ro5g4EmPnDS1tS2IUr1RKQBOJxkNyWsbH/CcGt1zmsEfAZP6GHk+8qFVV/O4swwlRIkDGeWk676XQuIGOacH3LzmcT3eei9a5pKEFd0dNeA96JVv6OsK9UHiytpE9SyWohLP+dIfBm5MQi9jJ2yE7i1Rt9nD4D8cdQeKji67n9KZXpjJZliVoRsatamTWkK/+tGgfK+vZY4ob3d6BWl8XWtEvTTLwumWcd2AQcjzJQed2znUdIbjyPCZSe+bW/RCcKuX58TluN2CgOLVWHr/WpjfhEQiIBkk/bXQJsGLTQ3KcM1ZiRRUDutf7UtUkKWNM5OCY9weSYG3qVaCzk9YKVP5FRWbB+AijXkINuN/5alRNfnQ8z+cGEsMB8ss6nbdh6m6l9vEUTkIsbmfEco3sn4rCk+UrxIuAXXKCynPD8q08mHPYjCDCscMTlQ+3cS1tnWpMgC7I8QCQkkX6P6aGzZnLeS2zJ6ewzPlRxwm4e8Uez8RUrQpHT82geycigfblQWe1HnuKnQXeRY1712dt2sgtaoqBvy2xGI8zDnc/gXnvKATm+bdYLoMfYL587IZrTJEw1btpB6Dfr+q0UxPmIWdNIPGsLCSzFZFT1HZI5C8l2dgGJXH6k+LlYl3YalD010WeezH9WMb9yokNHmvzVoD5rDru9M9yNoh/AdzS5Y261c94COD2tGN74Yv+W+AhVI0TTDyA9h4XH0hdQSZbbA9WCGi8Ef/wUn5fbddEK0uOP75X3PZtOCvhdFRSd+7iKFG/6iqvVYnDtT7bsdD0Go3H4Fku3LtBJXmqCuyUsmYqW7rc7gNUvjpRYbFjk/ht19hsblmcytqhODto9X2DHJCpKwoZOOeyuTt/N7UT2It58LohD7OPuRaVXTt4r+tmBopQloYuNpwumKOEj3I0UIT9J5zUlYWdHaw9oQU6HbIGhQRZELsLjMjKZTHpT7MN2jhDVIWwLShEutYCbUSjT757t0ebSLXESrUVrWKuCvtRyFd9LGZDJ+x25R7oeMooFVKysdM4J4WTTYkEhvUCucrP8HrEgnd/7SAPn2MuI7lXbYvOMH6CNYyOvCaNBlCQSX6jlbRdrDRVk6srSd+L4edc8vB7+uVGO+Pt1GY6YV8rrot6JQS2NS9ht3tHui3nk6Uu8+aztnJE6CdRXXXs7PctftNZneRIaZJghTuYDWHgBqoXcJ9tBjt07lEElJRgmRAV7WGgOj9psIysujQpNJUVL9olbR6eikNuulxTgtQK2vLD5LuNv6G9AyB3A/Qdh1E5pGG0dy9gZ6JMtfXJOcR7ud0N3eDCxOoXGkKpi0ocxQ2TRkChvIMxyHwsvQWuKyioVqPn1yovk5LZmwXYiWCsdItGhN9rwvoBR1QPqgn3n/MTv8E1P8Lw24amHWNUBKZTfbVRYwpxY4gHBHcKBxWJL7Zb6vcTRFPBvXNwWyrV3Z68GHMTt351fRG2y5yXGNuHYctNa61IJc/QEiDYlbE9NorWcWaEQO0hRixsYhPDSM1quHTeIsR04tMWnmjXV4UMjYJmNETuS5HKp9semkleUSaMhsB4ThCZaafqe2Jjj+22oQP3OhpVUVK+QOniuFFp5DJG3p6XT8i2Ouxm8lpp7KvVboVO8ZpyrpHGTJt00WvSTjeFgc4jZj3yMy/TP76BeRNdx97bn0KNOsLMV7uK+ounggIdx3+eznL/7Tyuc2sr7cG7F08TwG3LtsaSA83KJ2An7SrKqBw8T+elO7XwKGqtsBsEnM3vnEklN+8qVdlJoTRl/x4JRU6mtlIeUJcyXV1R4ZE+vWI22V8C2GMyasSFKgktc3u8IRllAglXdYokZJEQTTeNQyGjE=
—END GANDCRAB KEY—

—BEGIN PC DATA—
7ftDEgLb/ZS0lcmZbHM61LvJzQOaD5cK2A6MbtAgbXYAWLQC95+cYAdxMWD/9MbJPZC3AvSVpuCmRVvIb3Q4Qz+a8bP6zo4STehtaoWXs6bpGMopS0ugInags8QTqn3soEgwXUJiM8FeiUr/tVKOWpBHJSOrMqL70iY+O9M3k2aL0KcRQ/oDEurBgtkSstyHBvUdIJN0TYNZA3s0F67PDOtF+yPcB5smbLF7Z+3MGN3xgF72rZ3ZUwt7wdxWWO4yn4Wp5y5HC3KrMJiBlVDzeiqo9FrdnMKZ719GSVfO+TAimLr7s4CuGAspCajqRTwVfPf20xBSUiDItL+JL9AKBiJqpsZqR7K3OLGemdSR2keIP43y//MxLLTjT6O6r1xW4eZxTzPJ1fbDL0900Pf6S0az7KAroTHFqZ2NPDKx6yhBud7oMVoK6ieVzOm2qBlvYbwCrtoyoy8A1fmlVjmS7q94BOw8gSWwQ0zSb+QfwNw4LR2j3Li9wF7i8DPfKPyghI2WWKL+6QkQvCyii4FeEv9EqiMxANjhx9QXIE31U0GeyeGMa50B1gs//OQPexoE0nTuCpvrA9c9PD6VRsopLqob8QmecC6V+7DIEcqsE7TRnIeaZEIlb4A05VHMc2nS0KJeDErFmIGkqFpw2EbRxIzGl3VEm8DKGvMCEuydIpiQzgJfQrpB71s2/1/ZdDB8r5KiQFhjqF1/yoXwoFyOuqdBYA56yRhuMMZxGB5sV+B3uzvqG6fuaplMs3UQDWsYCcS6Le3Uxn/maKAeNd3QiFB7RdqsfCI9+d2XxPVJsuoXhfB2B0kLztEkOcK3e/qYaj0JwNTW5DnfJK2n5OfHK1Pv1icGnIlS
—END PC DATA—

Reply ↓
Gustavo March 19, 2019 at 7:54 pm

hola mis archivos estan cifrados por una extension.CHARCK, me pueden ayudar a resolver mi problema?

Reply ↓
uncut March 19, 2019 at 11:33 pm

Hello

My computer also infected by ransomeware and most of the files extensions are renamed as .doples, are there any ways to decrypt them? Million thanks.

Reply ↓
Rachael Leigh March 20, 2019 at 5:12 pm

Hello

My computer also infected by ransomeware and most of the files extensions are renamed as .[mrpeterson@cock.li].GFS are there any ways to decrypt them? Million thanks.

Reply ↓
1. Vencislav Krustev March 22, 2019 at 12:57 pm
  
  Hi, besides the [mrpeterson@cock.li].GFS, do you see something else, before it, like:
  
  “ID-9238H23B. [mrpeterson@cock.li].GFS”
  
  The reason I am asking Is because this could be a variant of Dharma ransomware.
  
  Also, do you see any ransom note or other type of Readme file with ransom instructions and if so, what’s the file’s name?
  
  Reply ↓
Angel corso March 21, 2019 at 2:09 pm

Hola mi pc esta infectada todos mis archivos tienen la extencion PULSAR.1 Ayudenme como puedo desencriptarlo

Reply ↓
Christos March 22, 2019 at 2:15 am

Hi,

I have also the [mrpeterson@cock.li].GFS issue.

Any help regarding removal and decryption?

Thank you

Reply ↓
1. Vencislav Krustev March 22, 2019 at 12:57 pm
  
  Hi, besides the [mrpeterson@cock.li].GFS, do you see something else, before it, like:
  
  “ID-9238H23B. [mrpeterson@cock.li].GFS”
  
  The reason I am asking Is because this could be a variant of Dharma ransomware.
  
  Also, do you see any ransom note or other type of Readme file with ransom instructions and if so, what’s the file’s name?
  
  Reply ↓
  1. Christos March 22, 2019 at 10:11 pm
    
    Hi Vencislav,
    
    1. Nothing before that
    
    2. Yes, there are ransome txts all over the place…
    
    Any thoughts?
    
    Reply ↓
    1. Ventsislav Krastev (Post author)March 25, 2019 at 9:52 am
      
      You have been infected by a new version of Gefest ransomware. It is still pending decryption so when a decryptor is released we will post it with a link in this article:
      https://sensorstechforum.com/remove-gfs-ransomware/
      
      Reply ↓
      1. Christos March 25, 2019 at 4:15 pm
        
        Thanks.
        
        Hope that you will find the decryptor soon1
Juan Domingo March 22, 2019 at 6:42 pm

is there any decryptor for this .GMPF virus? i have all my files encrypted with it on an external hard drive but i have no idea how to recover them. can u please help me? thx

Reply ↓
1. Ventsislav Krastev (Post author)March 25, 2019 at 10:39 am
  
  I think that your computer has been infected with a new version of this ransomware: https://sensorstechforum.com/gmpf-virus-ransomware-remove/
  
  We will update this article as soon as there is a decryptor available.
  
  Reply ↓
Christos March 23, 2019 at 12:14 am

It seems that my messages are not getting through.

So, (a) nothing else before [mrpeterson@cock.li].GFS and (b) yes there are ransome txts all over the place.

Any thoughts?

Reply ↓
BOnbon March 23, 2019 at 6:35 am

My files are all infected by luceq , encrypted files extension is luceq
Please suggest any decryptor if available

Reply ↓
ABDO1430 March 23, 2019 at 2:06 pm

Hello
My computer also infected by ransomeware and most of the files extensions are renamed as .[.chech.xejgsuypc.chech ] are there any ways to decrypt them? Million thanks.

Reply ↓
1. Milena Dimitrova March 28, 2019 at 10:02 am
  
  Hi there,
  
  It appears you’ve been infected by this ransomware: https://sensorstechforum.com/remove-chech-ransomware-files/
  
  Reply ↓
gerra March 25, 2019 at 12:43 pm

I NEED .GFS files decrypter

Reply ↓
Pierre March 25, 2019 at 9:09 pm

Hallo, nun hat´s auch mich erwischt:

“GANDCRAB V5.2” (alle jpg avi mp4 mp3 pfd etc) haben jetzt .zaciox Dateiendungen und sind verschlüsselt.

Gibt wohl noch keinen Decryptor, oder? :/

Reply ↓
Iván March 26, 2019 at 3:22 pm

Hola, mi pc ha sido infectada con el virus DHARMA, y mis extensiones han sido encriptadas como archivos .ETH
¿Hay alguna manera de poder desencriptarlos? Necesito mi archivo de Outlook .pst urgente.
Gracias!

Reply ↓
1. Milena Dimitrova March 28, 2019 at 10:01 am
  
  Hi Ivan,
  
  Unfortunately, there is no solution for this version of Dharma ransomware. We will update our article if a decryption tool is released https://sensorstechforum.com/remove-eth-files-virus/
  
  Reply ↓
malick March 26, 2019 at 3:51 pm

bonjour,
Mon pc est infecté par un ransomware avec l’extension « .promos ». Tous les fichiers du pc sont cryptés ainsi ceux de mon disque dur externe.
Merci pour votre aide

Reply ↓
1. Milena Dimitrova March 28, 2019 at 9:59 am
  
  Hi Malick,
  
  You’ve been infected by a version of STOP ransomware – https://sensorstechforum.com/remove-promos-files-virus/. Unfortunately, for now there is no official decryption tool.
  
  Reply ↓
Guido March 30, 2019 at 2:55 am

Buenas noches gente, alguien pudo encontrar una solución para desencriptar archivos con la extensión . promora2
Gracias

Reply ↓
Felicianus Roni April 2, 2019 at 3:55 am

My PC got infected by [mrpeterson@cock.li].GFS and all files are encrypted by this extension. Is there any decryptor available to decrypt the encrypted files.

Thanks in advance

Reply ↓
Beto calderon April 2, 2019 at 6:28 am

Buenas noches, tengo un problema con un servidor que fue infectado por el ciphered, hay algun descifrador que me pueda funcionar, tengo una backup de postgres para poder liberar, muchas gracias por su aporte

Reply ↓
alberto April 3, 2019 at 1:02 am

Hola, para archivos con .ETH existe alguna solución

Reply ↓
Ed Sullivan April 3, 2019 at 6:53 pm

I was infected on Nov. 29, 2018. The encrypted files end with the extension .RYK. Is there any hope of getting these files back?

Reply ↓
Ana April 4, 2019 at 7:46 pm

Hola mis archivos se infectaron y se agregó una extension refols.
Existe alguna herramienta que puede salvarlos?
gracias

Reply ↓
Elio April 7, 2019 at 4:33 pm

I was infected on Apr. 4, 2019. The encrypted files end with the extension .refols. Is there any hope of getting these files back?

Reply ↓
1. Raghda April 12, 2019 at 11:34 pm
  
  Me too
  
  Reply ↓
Atif Mahmood April 8, 2019 at 12:03 am

Hello sir,

my files got .grovas extension. I tried some data recovery software but these softwares recover encrypted files instead of recovering original files.
Please help.
Thanks

Reply ↓
Daud April 8, 2019 at 4:36 am

Please Help me

My computer also infected by ransomeware and most of the files extensions are renamed as .[.tronas ] are there any ways to decrypt them? Million thanks.

ATTENTION!

Don’t worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-hK4tAv2Ed9
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
merosa@india.com

Reserve e-mail address to contact us:
merosa@firemail.cc

Your personal ID:
056dhfgrtycbnalgAGsHWxzelVxa0mbMD7wO0Q0b160JGHBy0OlE6ja

Reply ↓
MUNIR April 8, 2019 at 3:48 pm

The encrypted files end with the extension .gjlxe. Is there any hope of getting these files back?

Reply ↓
Darryn Reeds April 9, 2019 at 12:25 pm

Anyone know what this one is – Only hit one netword hard drive used for downloading and storing media:
What happened to your files ?
All of your files were protected by a strong encryption with AES cbc-128 using NamPoHyu Virus.

What does this mean ?
This means that the structure and data within your files have been irrevocably changed,
you will not be able to work with them, read them or see them,
it is the same thing as losing them forever, but with our help, you can restore them.

Reply ↓
1. Milena Dimitrova April 9, 2019 at 1:31 pm
  
  Hi Darryn,
  
  Can you send us further details about your infection? Please contact us via email – support [at] sensorstechforum.com. Thank you!
  
  Reply ↓
Darryn Reeds April 9, 2019 at 6:32 pm

Hi Milena – I’ve sent detail in an email.

Reply ↓
1. Milena Dimitrova April 10, 2019 at 7:37 am
  
  Thank you! We will review your problem!
  
  Reply ↓
Luis April 10, 2019 at 10:51 am

Good afternoon, I have been attacked by a virus called “nampohyu” and I can not see or edit my files, any tool for disinfection?
Thank you

Reply ↓
1. Milena Dimitrova April 10, 2019 at 2:57 pm
  
  Hi Luis, here is more information about the ransomware:
  
  https://sensorstechforum.com/remove-nampohyu-virus/
  
  Reply ↓
Atif Mahmood April 10, 2019 at 12:59 pm

please help me too….. my comment is above

Reply ↓
martin April 12, 2019 at 2:47 pm

good afternoon, got files infected with “.kaedsgbr”
does anyone know how to recover this?
Thanks

Reply ↓
martin April 12, 2019 at 5:57 pm

The grandcrab v5.2 attacked my laptop and got the .KAEDSGBR extension in my files.
Any idea how to recover them?
Thanks

Reply ↓
Farras G April 14, 2019 at 7:08 pm

Hello, My PC Effected By .browec Exctension , anyone please help me

Reply ↓
1. Milena Dimitrova April 15, 2019 at 9:50 am
  
  Hi Farras,
  
  You have been infected by a new variant of STOP ransomware. We are working on an article, so stay tuned.
  
  Reply ↓
  1. Milena Dimitrova April 15, 2019 at 12:53 pm
    
    Hi again,
    Here’s the promised article: https://sensorstechforum.com/browec-files-virus-remove/
    
    Reply ↓
Feguino April 15, 2019 at 9:53 am

Hi, all of my hard drives got encrypted by gancrab 5.2 and I have tried many things and seen lot of tutorials to get my files decrypted but it wasn’t possible. If someone knows a way, please let me know.

Reply ↓
John April 17, 2019 at 2:11 pm

Hi guys. I desperately need help. My computer files are locked by ransomware. Filename now changed to .id-5D33294E.[decryptyourdata@qq.com]. Any help is greatly appreciated. Many thanks.

Reply ↓
ivu April 21, 2019 at 10:43 pm

guys any solution for .norvas extension?
STOP (Djvu)

any decrypt software available? please i need help

Reply ↓
Wira April 22, 2019 at 9:11 pm

Hi Milena,
My laptop just got Grancrab v5.2

here’s what TXT says :

—= GANDCRAB V5.2 =—

***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************

*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****

Attention!

All your files, documents, photos, databases and other important files are encrypted and have the extension: .GKONVWPZSS

The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.

The server with your key is in a closed network TOR. You can get there by the following ways:

—————————————————————————————-

| 0. Download Tor browser – https://www.torproject.org/

| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/3a3b3d4da4ed05fe
| 4. Follow the instructions on this page

—————————————————————————————-

On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.

ATTENTION!

IN ORDER TO PREVENT DATA DAMAGE:

* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW

—BEGIN GANDCRAB KEY—
lAQAAAZ0eV0htBBzATPZz/UKOECfCBqXFPicOdyBgxWQ7EFZEEls+UHMTebpH30xUKQSitaF5Hm24p9iKLE1bHeYXD0Q9WZ8HIwaAK943NAUdflI7R6xs44vfh+lVL1YTFw+rL3l73juWi3hjN5BoeiAyWCfE4LPI6sot6DvyOrvy5BuRrECDi1l8J7FiBG4JNANP9qjw4CwrlF3+fazZrRdnns/gJWWwDMjZIunhnU52xv5hegC8sGkyUCW+Dmp/+33T2xZWBUL5j3gSeOiIaNxXq8aJUZH+ciy4XIz/evOv8YAEvDyXftIR7mCssRRnyAvIp5gDYXv0l9hqJGd+iHbGqkFcxXXDF5AE0g/KvVcaB66k4g8el4f/wVluMi7n1ZgcZSMOlBnN5elOrNssxOVtdbYEMqPrK837MVIRNgGSuRS2CQ01COUg68VCHEuSEvcb6/dCpUWX8DSkGgF5IFiUkXycIkRyaOQh9nMI+wlLI4KUa2eysNL7OkE4piQwx7VQO11MspiE3nYzZulO6dVh/0jHtS2qR+zH1qSPbD2PFKZiiAY9X9HRt2/QF+mjEof6tVW4aE4ewk3ndfs0nGx8quSP4Mwkh4Xe+GxQLl1q4Pg5mEm83H1R+4eZoW+mV7rL4knpWTAGk7rXY8BiWrZUOrdajl/T8hyqy/zd3M+WsNDssVrBzwEFbMMdPnoNeVtP5hCGlf3xmXvst824FjUktG09pJuNor4aXLBy8qB/dxdJfMfLR7vVRMK2C3yyVTUvQpC9JF+qLee8ZGc4WsCNooh44omwCbnFLPCcVP8eUKm5wPtzLpJNOhjZ/Q1+Uw6s/3Wgy6yhpBQRTduA+71NbnqIRVv0Oa687OVfJWOWymmFQj1AEi/PnZezS+DuWOdnPcZfe7U+cAARv8zcjqegobHKx9S8vtXfzAbTXuSZFA2IeJOxm76hpZfZD2qGhFLJSYuZcs2rqvVxFsrJEwhYin05x/K/jZN40S4McpkPutRmcTrlRBICMonJlXgDhP/onoZ6BD0Gyg4yd/R+2ggVtC6sqaxmJ+mvvw7eQP/tKIwkLAOSo+LPdEYRuF0Gs57KD7j08L6oLnwx4uAlVN4LfZj190psAUlesDUxQUlx4sVWTdFA/jeu19XBOfm+vvoijtK/6B1Yng4LKKVKeIYZOosxqk30tFW7kMj6bz3irXJfCNpCgL09aogDVuh82BsQhKlomg+Ck+AZp+ddzA4CndsOHspyZY0mPN0XtBuvguQn+Q5cQs15eF1kk98KF6Cww+QwA4gE0TPacqp+7E+9JYtc6pCy21OrGbqwTRkE0G4k37eMEXHS0OCXh+JoXLDK7jED8zFStuK4SQGwH87N7+mexjitvN8ZAXLvV2xWmYMyw25nPANv0zmgb8qWDLZSFjCBklHDsgfpQ6z+IuEOAe7d/yJ1UOhcoqHDOQ5w4MzE5TH9jrTvy0QNg9ygDj+e9hWsYXP0NXda7EcEJF8ZsE890x2qg+W3ivpODul3viCDWM12EZtc1VwS/mIkOeQoewtzvtmPnVFB3dE2vyWxcF1OLrnQjTc6+UCYyjlADEjfAyJbg1I2wX//dwNfNwWD4Y+snS45/AxVY7k8TXsPWHCz+Q4rQAHp+E8q9Vptrt8DJfSalzJX3qHZIBHmWvXg4H4JYhAuVpZPW8n1U2B5ldgla0Fh1TtU6Ve9ZkAN48iJGdisD1DXsyHk2u9WZjSWxDwFvTiIc1oKjKgm+TT6WG+VoNU+yCcyq3sbNUwJ1pHw7RIbuHF4VihOamGRia5PHoh4q68FDDejiMOxsRT8RwKrH7dXK6aDHzCtGSbISjlQ3ps+Hjeneq4Q5+LGQ3jyYqOgLGIEM55AeWdghjNTeaZEx7gfqSiUaqmqqv6bdHFJln19zMtgNzOF0xD1+ouvGnmtcLc4jw7wqoWz4B5VGB9i6FudGNskiwHowznJmJ+Y9uRI+XXx7g1zH+bTqWvNssenT1LfRyMBogC3BInWimdOFAEDG1TEiNJ1ZIsmx5AKpt+YoPbeRYHDANd/ZomsxL01ZWHeSyO/gSYsLdnQNYPFmJ0Q6wEdb8p1TAWIY29mYRLYh1Fpq1KGG5IImmQwmfLVij+ZHjypiqkKPACPYwneu54jbdjmR4eQZ6Gsz9XtSKuQ6L1Sffgl947J2MD2u7YgJFpYeGHk5Br6tmwRieTCiog/sQ5oBbGbZvnx6E8voLii7P4BD0bC3V5QxQPSdeCTr8=
—END GANDCRAB KEY—

—BEGIN PC DATA—
7ftDEgLb/ZS0lcmZbHM61LbJ5QOrD78K2A6MbtAgbXYAWLQC95+cYAdxPGD39NfJNZC3AvSVpuCmRVvIb3Q4Qz+a8bP6zo4STehtaoWXs6bpGMopS0ugInags8QTqn3soEgwXUJiM8FeiUr/tVKOWpBHJSOrMqL70iY+O9M3k2aL0KcRQ/oDEurBgtkSstyHBvUdIJN0TYNZA3s0F67PDOtF+yPcB5smbLF7Z+3MGN3xgF72rZ3EUwh72NxaWKMyroWv5y5HQHKtMJ6Bp1C3eiyo81q/nNiZsF8GSUzO8zB1mOD75oCzGAcpOKjwRTcVLPea0xhSBSCXtLmJKdAJBnBq/8Y6R7W3ZbHMmdGR2kfVP8/ypPMxLODjVKORrwJWw+YFTyjJqvbBL1l0uveLSzuzh6AsoTfFqJ2FPDSx6ihDudroK1oI6iCVzemgqBFvYbwKrt8yoS8F1f6lXzmN7tp4DOxOgUCwX0ytb+Yf1txSLW2jqLjSwFri8TPXKP2ggo2XWKT+5gkLvCyiiYFfEvhEtSMwANrhxdQRIEb1UEGbyfSMGJ0C1n0/geR7exoErHT3CuvrYtdAPEKVL8osLq4b8wmecCyV+bDAEdKsHrTanImaZUIqb5k071HAc27S0qJYDEjFjIHSqFZwrkaoxPjGmnU6m9nKYvNqEp2dXpj6zgRfRbpC71g26F/SdD18r5KgQFNjrF16ypzwu1zyuq1BFw4LyXBuRcYDGHRsVuB+uynqR6e5apBMsXUeDWYYGsT7LbfUl3+JaP8eZ93ZiFR7QdqtfCI97N3TxLxJiupehd92IUk9zqkkSMLGe/yYdD1dwIDWoDmEJPWnvefCKwjvjydFnNFS+UC8uMJ2OEuUY4im4bC4pFh1PKMdocIIMVHNSiuljM5atLVUtveokNxYVn1oo84bQY8icmg97wv6B922CjhdeBucwZMdVSGaL80KTREDeZesAqtbG6ipmfSgPyWMYwOJrrF9NPJ0rIe6Pg==
—END PC DATA—

Any chance how to decrypt my files? i just lucky it happen quick but i saw it and disconnect the internet and remove it using loaris trojan remover. so it’s only effecting some folders not all.
Please let us know what should we do to decrypt the files back to normal.

Thanks a lot Milena !
Greetings from Indonesia

Wira

Reply ↓
Kit April 23, 2019 at 7:09 am

ANY SOLUTION FOR THE FILE *.NORVAS” AND “.ETOLS” Extension?

I’m really in trouble..
————————————–
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.norvas )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.txt )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.pdf )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.xlsx )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.xls )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.jpg )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.docx )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.doc )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.zip )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.ttf )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.ppsx )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.MP4 )
No key for ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.pptx )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.norvas )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.txt )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.pdf )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.xlsx )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.xls )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.jpg )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.docx )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.doc )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.zip )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.ttf )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.ppsx )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.MP4 )
Unidentified ID: a6O73oLJl0WDKZZiiIi16sXgsZpPrZGnunxnaffu (.pptx )
MAC: 14:2D:27:26:13:F7
MAC: 00:00:00:00:00:00:00:E0
Decrypted 5 files, skipped 2987

Reply ↓
nabeel April 24, 2019 at 12:51 am

i have all my file extension with .verasto !!! i installed a clean copy of windows in C: but my other separate drive that i have kept for back is all still infected i want to clear that ” .verasto ‘ extension that is show up any solution?

Reply ↓
dhs April 24, 2019 at 5:33 am

same with me..need help

Reply ↓
dhs April 24, 2019 at 5:37 am

I need help to overcome the virus. norvas, does anyone have a solution?

Reply ↓
Ari April 24, 2019 at 8:29 am

Can some body help me with this extention .guesswho to decrypt my file, Thank You

Reply ↓
1. Milena Dimitrova April 24, 2019 at 9:56 am
  
  Hi Ari,
  
  Can you give us more details about your infection? You can send us more information on support [at] sensorstechforum.com.
  
  Reply ↓
  1. Ari April 24, 2019 at 10:38 am
    
    all my file become extention .guesswho
    
    xample my file :
    HFKO2QUQAS.guesswho
    
    this information :
    Hello, dear friend!
    All your files have been ENCRYPTED
    Do you really want to restore your files?
    Write to our email – rapidka@cock.li or notnepo@cock.lu
    and tell us your unique ID – ID-94PB343W
    
    Reply ↓
    1. Ari April 24, 2019 at 12:53 pm
      
      this link xample my file extention .guesswho
      https://drive.google.com/file/d/1ZtvTX6MmOVjBaqDA_Ou1EQjIStEvqlrD/view
      
      thank you..
      
      Reply ↓
      1. Milena Dimitrova April 24, 2019 at 2:07 pm
        
        Hi Ari,
        
        Unfortunately, this appears to be a new ransomware, not much is known so far.
        What have you done so far with your infection?
      2. Milena Dimitrova April 24, 2019 at 2:50 pm
        
        Hey Ari, we created this article https://sensorstechforum.com/remove-guesswho-files-virus/ which will be updated with more details. In the meantime, you can remove the ransomware using an anti-malware program but first make sure to back up your encrypted files.
      3. Ari April 25, 2019 at 3:36 am
        
        Hi Dimitrova,
        thank you for your respons, i am very confused because my server backup infected too, now i am start fron zero data..but my encrypted file still keep it.
      4. Milena Dimitrova April 25, 2019 at 9:28 am
        
        Hi Ari,
        Do you have an idea what started the infection? Where did you get the ransomware from?
Juan Vargas April 24, 2019 at 9:44 pm

My files were infected with verasto ransonware. Is there a solution to recover? Any decrypt software? Thnks

Reply ↓
1. Milena Dimitrova April 25, 2019 at 9:44 am
  
  Hi Juan,
  This appears to be a new version of STOP ransomware. You can learn more about it here: https://sensorstechforum.com/remove-verasto-files-virus/
  
  Reply ↓
Ari April 25, 2019 at 3:35 am

Hi Dimitrova,
thank you for your respons, i am very confused because my server backup infected too, now i am start fron zero data..but my encrypted file still keep it.

Reply ↓
takewa April 27, 2019 at 3:18 pm

Hi, I have been infected with morsea virus on the whole machine and leave me a message if you want to return my files sent a sum of money
What should I do

Reply ↓
Mark Anthony Pelegrin April 30, 2019 at 11:01 pm

My files were decrypted by kiranos virus or i believe STOP ransomware. I cannot open it anymore. I tried removing the double extension but to no avail.

Ex. wordfiles.docx.kiratos to wordfile.docx.

Please need your help. Important family files to be retrieved.

Thank you for your immediate response.

Reply ↓
frizol May 1, 2019 at 2:17 pm

Please help. All my files have been infected with ransomware and all of it has an extension name .TODARIUS

Reply ↓
Agung May 2, 2019 at 1:28 am

my computer was infected by a ransomwire named VERASTO. The virus left almost my data & applications (doc, xls, pictures (pdf, cdr), music, executable) encrypted and the file extension changed to VERASTO. So far I failed find the way to decrypt the encrypted files.

Reply ↓
Antonio Cardoza May 2, 2019 at 3:50 am

Hi, My files been infected with file extension n064h.

Reply ↓
JUDY May 3, 2019 at 11:00 am

Hola mi pc fue infectada y toda mi.información fue encriptada. En todos los archivos me sale la extensión HOFOS. Como recupero . Alguien q pueda ayudarme por favor.

Reply ↓
Eni May 8, 2019 at 8:30 am

My files got infected with Phoenix ransomware, all documents encrypted. Any solution please, or a decrypter software?

Reply ↓
1. Milena Dimitrova May 8, 2019 at 1:04 pm
  
  Hi Eni,
  
  Is this the ransomware that attacked you? https://sensorstechforum.com/phoenix-files-virus-remove/
  
  Reply ↓
  1. Eni May 8, 2019 at 3:21 pm
    
    Hello Milena,
    Thank you, yes it is: .id[4A792664-0001].[autrey.b@aol.com].phoenix
    
    Albeit, I am yet to find decryptors seen above that specifically decrpyts .phoenix encrypted files.
    
    Please assist further. Thanks again.
    
    Reply ↓
Ahmed May 9, 2019 at 11:16 pm

Any help about .Fordan ?

Reply ↓
1. Milena Dimitrova May 10, 2019 at 9:23 am
  
  Hi Ahmed,
  Unfortunately there is no decrypter for the latest version of STOP ransomware (.fordan).
  
  Reply ↓
terry May 10, 2019 at 9:01 am

hi is there any decryptor for a ransomeware .fordan

Reply ↓
1. Milena Dimitrova May 10, 2019 at 9:23 am
  
  Hi Terry,
  Unfortunately there is no decrypter for the latest version of STOP ransomware (.fordan).
  
  Reply ↓
Cristiano May 10, 2019 at 11:17 am

Hello!
All my files have the extension .fordan….Not working…..It’s a ransomware….Is there any decryptor ?

Reply ↓
Kamran May 12, 2019 at 12:19 pm

Hello Milena,
Thank you, yes it is: .id-721A22A5.[3442516480@qq.com]
I am yet to find decryptors seen above that specifically decrpyts encrypted files.
Please assist further. Thanks.

Reply ↓
Admir May 13, 2019 at 11:34 pm

Hello, any decryptors for .bufas extension. It seems it has been online just recently and spreads fast. Thanks.

Reply ↓
Tanveer May 15, 2019 at 8:30 am

hi .. I got my files attacked with .fordan… ransomware ..I wonder if someone can help me

Reply ↓
John Garcia M: May 16, 2019 at 2:54 pm

Hola.. Mi pc se infecto con un ransomware que deja todos mis archivos con una terminación .forasom me puedes ayudar? Muchas gracias

Reply ↓
zeeshan May 16, 2019 at 7:42 pm

My pc attacked with .bufas virus extension , if anyone know the solution how to decrypt them , please help me

Reply ↓
Vibhanshu May 18, 2019 at 6:16 am

My files got attacked by .dotmap ransomware.Please help me anyone to get rid of this…

Reply ↓
James May 20, 2019 at 12:23 pm

my files are decrypted and the extension is .hclqephnq
how can i decrypt them ?
please help i am desperate………..

Reply ↓
Xaris May 21, 2019 at 2:35 am

My external hardrive got infected by ransomware virus and all my files got .radman extension in the filename and they doesn’t work anymore… please help me resolve this issue.. most article that i have read are for pc and laptops.. how about external hardrives or usb?..please please please help

Reply ↓
Mikhail May 21, 2019 at 1:06 pm

my files are decrypted and the extension is .locked, .locked2, .locked3
But if rename files – totalcomander asks for a password
files 7zAES:19
how can i decrypt them ?
please help

Reply ↓
Miklos Alin May 21, 2019 at 3:35 pm

Hello,

Can you help me?
The extension of all my files were changed into .i1n7y95pm6
How can I have the files back?

Thank you for your help.
Best regards,
Alin

Reply ↓
1. Milena Dimitrova May 22, 2019 at 9:50 am
  
  Hi Alin, can you give us more details about your infection?
  
  Reply ↓
allen May 21, 2019 at 11:24 pm

my files were infected and changed to .uvwfn and .roaqonoe can you help me with this?

Reply ↓
Hallder Hans Ramos Martel May 22, 2019 at 3:36 pm

Hola Milena Dimitrova, mi computador se acaba de infectar con el ransomware con la extensión .DOTMAP, por favor me podrías ayudar, necesito esa información que esta infectada, te lo agradecería mucho

Reply ↓
Miklos Alin May 23, 2019 at 3:42 am

Hello,

7 days ago my computer got infected.
It started with the files from Dropbox and then everything what was saved on my hard drive.
The files were encrypted in each folder, I have all files with extension “.i1n7y95pm6”, a text file and a file with extension “.lock”.
It asks me to follow a link and to pay to have them back. It also says that i need the i1n7y95pm6-decryptor app, they can provide if I pay the fee.
Sadly, beeing a photographer, all my photos from last wedding were affected, so I’m screwd up.
Please help, if possible.

Thank you.
Best regards,
Alin Miklos

Reply ↓
Kevin May 29, 2019 at 7:48 pm

My files are encrypted with extension of .a0cb

Anyone able to help?

Reply ↓
1. Milena Dimitrova May 30, 2019 at 11:17 am
  
  Hi Kevin,
  
  You can refer to our support chat on this page: https://sensorstechforum.com/spyhunter-download-and-install-instructions/?nr=1
  Our experts may be able to assist you.
  
  Reply ↓
Ciella June 1, 2019 at 6:43 pm

My files are encrypted with extension of .DOCM

Please help me.

Thank you.

Reply ↓
1. Milena Dimitrova June 3, 2019 at 8:58 am
  
  Hi Ciella,
  
  More information about the ransomware: https://sensorstechforum.com/docm-ransomware-remove/
  
  Reply ↓
  1. iwan June 4, 2019 at 9:05 am
    
    how to decrypt ransomeware .BLOWER
    
    Reply ↓
nabin June 3, 2019 at 3:09 pm

Hey Guys what’s up ? my backup drive infected by a . REZUC Ransome virous. I tried to recover the infected files by POWER DATA RECOVERY and Steller PHONIX WINDOWS DATA RECOVERY but not working. these two software recover the file but same as a infected one with same name. (infected file name. jpeg.rezuc)

is there any Solution for this problem? please help me

Reply ↓
1. Niyal Nagar June 7, 2019 at 6:59 pm
  
  Hello, friend
  my data is also infected from the same extension .REZUC
  Please tell the solution if you got.
  I will inform you if i got something.
  niyal.nagar@gmail.com
  
  Reply ↓
jhoswal June 10, 2019 at 9:11 am

! YOUR FILES ARE ENCRYPTED !!!

All your files, documents, photos, databases and other important
files are encrypted.

You are not able to decrypt it by yourself! The only method
of recovering files is to purchase an unique private key.
Only we can give you this key and only we can recover your files.

To be sure we have the decryptor and it works you can send an
email wtfsupport@airmail.cc / wtfsupport@cock.li and decrypt one
file for free. But this file should be of not valuable!

Do you really want to restore your files?
Write to email:
wtfsupport@airmail.cc
wtfsupport@cock.li

Your personal ID: C596F821-01E7-AE6C-9025-74F883BF38C8

Attention!
* Do not rename encrypted files.
* Do not try to decrypt your data using third party software,
it may cause permanent data loss.
* Decryption of your files with the help of third parties may
cause increased price (they add their fee to our) or you can
become a victim of a scam.

Reply ↓
1. Milena Dimitrova June 10, 2019 at 11:40 am
  
  Hi jhoswal,
  
  Can you tell us what file extension is appended to your files?
  
  Reply ↓
Geet June 12, 2019 at 2:17 am

In my PC all files are encrypted by .boston file extension and it shows this message everywhere:
ATTENTION!

Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-BTtULebL7F
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
gorentos@bitmessage.ch

Reserve e-mail address to contact us:
stoneland@firemail.cc

Our Telegram account:
@datarestore

Your personal ID:
099nHgSrtddgsDC8wRtYGBcyY3EID5WKqCqXmHWXfRi1IuCpGaki3

Reply ↓
savan virani June 22, 2019 at 9:52 am

Sir my files are infected with .pidon extension. I have tried Stop Decrypter but no luck.When do you think that the decrypter will be available.

Reply ↓
1. shafiq June 29, 2019 at 4:17 am
  
  My files have also being infected by .pidon extension. Please help to decrypt it.
  
  Reply ↓
Dino Bribe June 23, 2019 at 9:38 am

hay, My files are encrypted with extension of .Truke
do you have any idea how to get my file back ???
thanks

Reply ↓
Jose Olivera June 25, 2019 at 10:15 pm

Hi Milena Dimitrova,

I see you are trying to help a lot of us with similar problems, the file extensions that are appended to our files. I see a lot of common extensions but have not found the one that infected my PC. Can you help me? The extension is .HBTOSE

Warm Regards

Reply ↓
1. Milena Dimitrova June 26, 2019 at 8:18 am
  
  Hi Jose,
  
  Can you please send us more information? What does the ransom note say? You can send us an email at support [at] sensorstechforum.com.
  
  Reply ↓
King June 30, 2019 at 3:20 am

Hi Team, can anyone help. files encrypted with .nusar extension.

Ransom note:

ATTENTION!

Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-26O6Irjllx
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
gorentos@bitmessage.ch

Reserve e-mail address to contact us:
varasto@firemail.cc

Our Telegram account:
@datarestore

Your personal ID:
108bTddSKjtqXoxZBYibA1m4sRgLU28MuDKhXF3Gru7Uy0IKrP

Reply ↓
1. Milena Dimitrova July 3, 2019 at 7:13 am
  
  Hi King,
  
  Currently, there is no decrypter for .nusar files. You can try alternative data recovery methods listed in the article but unfortunately there is no guarantee they will work. Our advice is to be patient and wait for an official decrypter.
  
  Reply ↓
  1. King July 7, 2019 at 6:48 am
    
    Hey thank you for responding Milena. Its very much appreciated. Hopefully i wont have to wait too long for a decrypter.
    
    Thanks again
    
    Reply ↓
Jaja Azeez July 1, 2019 at 5:54 am

Hello,

Can anybody help me?
The extension of all my files were changed into .qbfubc
How can I have the files back?

Thank you for your help.
Best regards,
Jaja

Reply ↓
1. Jaja Azeez July 1, 2019 at 5:59 am
  
  My pc was infected since December 24th 2018, but i was never switch on my pc since that. I thought it will be remove itself when i do not open for a long time, but it still have. So, i really need help on this.
  
  Reply ↓
2. Milena Dimitrova July 2, 2019 at 7:51 am
  
  Hi Jaja,
  
  I believe you’re infected by GandCrab ransomware. Can you tell us what is written in the ransom note? There are a few other ransomware that use similar random extensions and we need more information to confirm.
  
  Reply ↓
Aditya T July 3, 2019 at 12:43 pm

My whole system got infected through ransomware and each and every file get extension .lotep . How shall I get back my files in original file formats ?
Help me Pleaseeeeeeeeeee

Reply ↓
mahmoud July 16, 2019 at 8:53 pm

my lap infected with ransomware and each and every file get extension herad
how to recover my data
plz

Reply ↓
1. Aniket July 18, 2019 at 7:10 pm
  
  hii mahmoud,
  Try STOP decryptor it might be helpful to decrypt your files which are encrypted with offline key.
  
  Reply ↓
Aniket July 17, 2019 at 12:40 pm

my laptop got attacked with new ransomware and they are asking for money

Reply ↓
Aniket July 17, 2019 at 12:42 pm

my laptop got attacked with new ransomware and they are asking for money what to do
with .berosuce extension

Reply ↓
1. Milena Dimitrova July 17, 2019 at 2:47 pm
  
  Hi Aniket,
  
  You’ve been affected by the latest strain of STOP ransomware. We’re currently working on an article with more details.
  
  Reply ↓
Aniket July 18, 2019 at 4:18 pm

Thanks Mam for replying,
My files are decrypted now.

Reply ↓
Tendai July 19, 2019 at 12:53 pm

my laptop has been attacked by a new ransomware, all my files ie documents , photos and videos are infected with a .cezor extention.Is there any decryptor for the cezor virus?

Reply ↓
1. Gergana Ivanova July 22, 2019 at 4:10 pm
  
  Hey, Tendai!
  
  Happily, you can attempt to restore .cezor files with a free decryption tool released by the security researcher Michael Gillespie. You can download the tool via the Decryption Tool link here. The tool requires a pair of an original file and its encrypted version.
  
  Reply ↓
HUMBERTO M July 29, 2019 at 11:58 am

HOLA, BUENOS DIAS!
MI ORDENADOR FUE INFECTADO Y TODOS MIS FILES DICEN QUE ESTÁN EN UN TIPO DE DOCUMENTO ( .ACCESS ) NO PUEDO VER NADA.
APARECIÓ UN MENSAJE EN MIS CARPETAS QUE DICE _README.TXT Y PIDEN DINERO PARA RECUPERARLO Y ME DEJAN EMAILS DE CONTACTO.
ES POSIBLE HACER ALGO? ME DICEN QUE TENGO 72 HORAS.

Reply ↓
Roman August 4, 2019 at 9:49 pm

hola buenas tardes , en pocas palabra me sucedió igual que a todos con la extensión .Format……. se puede hacer algo con esa extensión?

Reply ↓
1. Gergana Ivanova August 5, 2019 at 12:06 pm
  
  Hello Roman,
  
  The Format ransomware virus removal guide linked below is updated to provide .format files decryption solution. Good luck!
  
  https://sensorstechforum.com/remove-format-virus/
  
  Reply ↓
mohd raahim August 5, 2019 at 3:22 pm

hi I am Raahim from INdia My pc was hacked and all files were changed to .banjo by ransomware..please help

Reply ↓
1. Gergana Ivanova August 8, 2019 at 3:25 pm
  
  Hello Mohd Raahim,
  
  I’m sorry to inform you that this ransomware is not decrypted yet. So the best you can do for now is removing all malicious files like shown in the Banjo removal guide below and attempting to restore .banjo files with the help of some alternative data recovery methods.
  
  https://sensorstechforum.com/banjo-virus-remove/
  
  Reply ↓
mohd raahim August 6, 2019 at 8:59 am

hi my pc was attacked by a .banjo ransomware..please help in decrypting files

Reply ↓
Ola August 6, 2019 at 10:24 am

Hello my laptop infected with .prandel and all files on D drive encrypted to .prandel. Files on c drive are intact.

Can anyone offer suggestion please.

Reply ↓
1. Gergana Ivanova August 8, 2019 at 3:44 pm
  
  Hey Ola,
  
  Make sure to try the steps provided in this STOP ransomware decryption guide. The free decryption tool was updated to support .prandel files recovery. Wish you luck! Tell us about the results.
  
  https://sensorstechforum.com/decrypt-files-stop-ransomware/
  
  Reply ↓
Roman August 7, 2019 at 4:30 pm

Buenas tardes , estaría necesitando es descifrar los archivos .format ……… hay solución?….. esa informacion q me enviaste es para remover el virus no para desifrar , Gergana muchas gracias.

Reply ↓
1. Gergana Ivanova August 8, 2019 at 3:49 pm
  
  Hi again Roman,
  
  If you navigate to the “Decrypt Files Encrypted by STOP Ransomware” link from the Fromat virus removal guide and then click on it you will access the following article – https://sensorstechforum.com/decrypt-files-stop-ransomware/
  
  It presents detailed instructions on how to download and use the free decryption tool that is updated to support .format files decryption.
  
  Reply ↓
raahim August 9, 2019 at 2:44 am

Hi Gergana thanx for replying…but can i expect after some time when the decryption
method is available…? because as .banjo will too have a decryption method after some time..is it?

Reply ↓
reji August 11, 2019 at 2:50 am

are there any decryption tool available for .guesswho randsomware?
will it help if we have original and encrypted file?

Reply ↓
cristian c August 12, 2019 at 2:27 pm

Hola. Mis archivos tienen extensión .decrypt019 . Alguna aplicación para recuperarlos? Please…

Reply ↓
1. Milena Dimitrova August 13, 2019 at 7:40 am
  
  Hi Christian,
  
  Can you provide us with more information? What does the ransom note say?
  
  Reply ↓
Roman August 12, 2019 at 6:35 pm

Hola y buenas tardes a todos , cuento un poquito mi experiencia , después de dar vueltas y pasar malos momentos durante 10 días pude recuperar mis archivos , los recupere usando mi ultima carta que fue pagar el rescate , al pagar no demore 5 hs en poder volver mis archivos a la normalidad , si son de mucha importancia sus archivos para evitar malos momentos concejo pagar el rescate…….. si hubiera pagado cuando me paso me ahorraría 9 días de sufriendo y tiempo perdido en tratar de llegar a una solución ……. solo quería contar un poquito mi experiencia , suerte con sus problemas.

Reply ↓
1. Milena Dimitrova August 13, 2019 at 7:37 am
  
  Hi Roman,
  
  What is the ransomware that attacked you?
  
  Reply ↓
Siddharth August 13, 2019 at 4:22 pm

hello Sir,my pc got encrypted with .NASOH file extension is there any decrypter tool for free please help, the hackers have also sen me a decrypter tool link, please help.

Reply ↓
Fabiane August 13, 2019 at 9:13 pm

Good night my computer was infected with the .nelasod virus, I don’t know if I had a ransom message because as soon as I saw the extension of the files change I took the laptop to the technical support and they just formatted the computer. Then I was very nervous because when I searched I saw that if I had not formatted I was more likely to recover the files. I have already passed Stodecrypter but have not recovered 1423 files. Below the message of the program, I hope someone helps me, are files of my work and do not have updated backup. Thanks

Reply ↓
Roman August 14, 2019 at 11:35 am

.format

Reply ↓
IAKY August 17, 2019 at 4:56 pm

Hi everyone,
My files were encrypted by the extension .MJT55IDJ

and there is a text file which mentions the extension along with the link to website decryptor.top also there is a tor link for tor as well.

I cannot identify what method for use as it seems like an unknow extension or it can be just an extension already used.

Any help here would be appreciated. Thanks

Reply ↓
Egroj August 20, 2019 at 2:23 pm

Hola a todos,
Alguno de uds ha experimentado o conoce de problemas de infección causados por el ramsonware .STAFS?
Mi servidor amaneción con ese problema, y por razones obvias, no hemos podido trabajar.
Les agradecería mucho cualquier indicio de ayuda al respecto.
Gracias!

Reply ↓
Aniket August 28, 2019 at 5:19 pm

My files are encrypted with .hese extension which ransomware is this? what should i do? please reply as soon as possible

Reply ↓
sahil September 6, 2019 at 10:38 am

hi my file was infected extension is SETO plz help me to how to decrypt my file plzzzzzzzzzzzzzzzzz

Reply ↓
Ahmed September 9, 2019 at 10:09 pm

Hello, my files have been encrypted with
. meds extemsion, any decryptor available

Reply ↓
1. Milena Dimitrova September 10, 2019 at 9:42 am
  
  Hi Ahmed, for now, there is no decrypter for this variant.
  
  Reply ↓
Ali Yasser September 11, 2019 at 11:42 pm

ATTENTION!

Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-ZFjRnJfc9f
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
gorentos@bitmessage.ch

Reserve e-mail address to contact us:
gerentoshelp@firemail.cc

please find a solve

Reply ↓
moon September 17, 2019 at 8:33 pm

hi my files are effected with .domn ransom ware. please help me.

Reply ↓
Fernando Solano September 17, 2019 at 11:20 pm

Me infectaron con archivos terminados en @tutanota.com].actin, me remiti a una herramienta que tiene McAfee y logro extraer un codigo, imagino que es una llave, pero no aparece una ventana que debe aparecer para aplicarla, alguien sabe algo sobre esto?

Gracias

Reply ↓
moustafa September 21, 2019 at 7:40 am

my infection is with virus called Kvag one of DJVU viruses if there is a solution for my files please help me

Reply ↓
Prasanth September 23, 2019 at 9:33 am

Hi,
My files are encrypted with .KARL extension. I need a decryption tool to restore my files. Can anyone help me with a decryption tool please. Thanks in advance.

Reply ↓
Richard Frimpong September 24, 2019 at 8:49 pm

my desktop computer is infected with a virus called “kvag” and i cant access my files please what should i do to recover my files.

Reply ↓
Dave Blake September 29, 2019 at 9:09 pm

I tried the STOPdecrypt and my files state this:

zb4VhvvuCVcmcaY5U1eYScU1Lgyp7LNTgrM27P7l (.meds )
The Personal ID the hackers “assigned” me is this:

Your personal ID:
162Ad768734uygjdfgzb4VhvvuCVcmcaY5U1eYScU1Lgyp7LNTgrM27P7l

How do I get my files back. My PC knowledge is minimal.

Reply ↓
Rakesh October 3, 2019 at 10:27 am

Infected by .MOKA extension. Text note is as below. Can I get any help?
ATTENTION!

Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-ZFjRnJfc9f
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
gorentos@bitmessage.ch

Reserve e-mail address to contact us:
gerentoshelp@firemail.cc

please find a solve

Reply ↓
Varenya October 5, 2019 at 6:28 am

All my files have been decrypted with .reco extension. Is there any decryptor available for them?

Reply ↓
Bachrul Arief F October 5, 2019 at 2:28 pm

Hello admin,,please help,,

yesterday i my server got YDHM ransomware from RDP vuln.

could you help me to find a decryptor for YDHM ransom??

Reply ↓
1. Milena Dimitrova October 7, 2019 at 7:44 am
  
  Hi there,
  
  Can you provide more information about your infection? What does the ransom say, what is the file extension?
  
  Reply ↓
vamsi October 11, 2019 at 8:48 am

All my files are changed to .RECO extension..
Is there any decrypt tool for this ransomware?
please help me…

Reply ↓
Paco H. October 13, 2019 at 11:09 pm

Hola a todos. Tengo todos los archivos encriptados con la extensión .a107
¿Sabéis cómo recuperarlos?
Gracias de antemano.

Reply ↓
1. Milena Dimitrova October 14, 2019 at 7:27 am
  
  Hi Paco,
  Can you provide more details about this infection? Do you see a ransom note, and if yes, what does it say?
  
  Reply ↓
Manuel Hernandez October 15, 2019 at 5:33 pm

Hola,

Me acaban de aparecer todos mis archivos con la extension i8r6i

me aparecio un archivo de rescate: i8r68-readme.txt. Abra alguna forma de recuperar mis archivos?. Gracias por su ayuda

—=== Welcome. Again. ===—

[+] Whats Happen? [+]

Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion i8r6i.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).

[+] What guarantees? [+]

Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities – nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service – for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise – time is much more valuable than money.

[+] How to get access on website? [+]

You have two ways:

1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8A2BCC537C222A2B

2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.top/8A2BCC537C222A2B

Warning: secondary website can be blocked, thats why first variant much better and more available.

When you open our website, put the following data in the input form:
Key:

1YmXlsfAPpVLGYh2A1ORFymHMxykuGioTJPbJ9U20rizJRCidOPYjVkTX7Ns3iqK
H5Q60vT/3ZqHysKrrdrOZ3f4n7eEEEypn6mIXW2S4vLJTZFgkEySqd0VdGJrLJum
AsX195SF7nKBHuJ+XvwEWaw8qOykzsPldRgTcoBLfs9HRxs+m9+g8luJDJsvkYkg
FCnWMdJ6c3SJ5UqIdFUpv4Pjl55QGtaeQPrq3QdtcdPUpaC0GuHqy68Jzu+wm0lt
slLa7udw7Dv72IEim6pVrfEwRBvxkFW+quZZjXaHyW5bWg20roW99JyzwhAUkwpi
WF7J2zQSB4K7JP2l9/TvRHIXuhVGD+hzm0fHZf5RLeulkTDdJ0pHpP54WL3pzWji
ZEYfMhVUW2NsQUNooguvtOCYVYAOlenJnbbCBhYWI/0quehkazK6AerzR4lKRoqq
5p+jlpPvth5ZWCUYukQ5d6ns0sKrkJ2fSTS0OohDfDu/LhCY+/4wH9qoV6mYqRGp
4GNvG1ESDKqP7Pe3CNorUA2oDuYlEZO36HyvvapOh3MGeafVArDTTE8ubiTmzLFf
bsgPHi8U2Ld4A79GqIlUEfvr6yXuNMyxwj4ABB5r0i3nqyukSia0XS/e0rEJZwBb
NGWe2IGr80Q7q5/JaH2cG4Rs+Iv88NBZgcG1556f6DURKS4tSmN1mUAEB/+X7PV6
0F6Pe5SBPbRiUjISPInuieXmZ9mgY1ZR6hUWwY91sxmC4YHHAPE8HDJBYu/zF+mD
ruLDyzmZyFlJBM8eS5HftzoVG6V7EUPoop6DopIZccVrmBQSIw1PiaJz8PaXbZSb
X8pzlMWDQ7EhIbtvmBcsSt/5RPNUF6KJtNOP7m388a2Y09Skqc7rNmpRzpEINkbJ
skg1WznzPDWD2GR4MLnNgELXkN5WdksjmVMaBKkj1s8K3UeWx+Pc+VOVWotz6Q0Z
LMirhKtENr3XHg30uu0Tm4diLjiMhPDu6LqO103T2o+/Mj/2mF61f8oh3A+Pw7Ui
8tQsrhpRga7g18tXliuLxyEIHXKZ8nduNIQv65H5M72NfxQEcwCrGV5/lrc+hDlf
AX0C2Kt0QLKgB6qD5KR0bFPbt+0GL33WRpFIzApLFiIyPH8WxzmXgeQ90iJ0Nf75
8maTMc9vJJG41cwZ0h54cNbQRzgq1BDd4Bqj8e3rbei7Eg==

Extension name:

i8r6i

—————————————————————————————–

!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions – its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!

Reply ↓
Soso October 20, 2019 at 1:37 pm

bonjour j’ai été infecté aussi et tout mes fichiers sont devenus des fichiers .reco
comment faire s’il vous plait,un disque dur entier de 300 go très très important.
merci de m’aider infiniment

Reply ↓
denis October 23, 2019 at 1:50 am

Hola, todos mis archivos están con extensión .NOLS , please alguna herramienta para su recuperación o vuelta a la normalidad.el virus ya lo borre pero me quedaron encriptados.. gracias a quien pueda ayudar

Reply ↓

Ventsislav Krastev

Ventsislav Krastev

How to Recover Ransomware Encrypted Files (Without Decrypter)

How Do Ransomware Viruses Encrypt Files?

How to Get Encrypted Files to Work (Alternative Ways)?

Ventsislav Krastev

Ventsislav Krastev

Ventsislav Krastev

Ventsislav Krastev

Ventsislav Krastev

Ventsislav Krastev

Ventsislav Krastev

299 Comments

Leave a Reply to Marco Cancel reply

Method	By using a Data Recovery Program.
Appropriate Situation	When there is no decryption available for the ransomware, but you can still use Windows to install and run software.
Instructions Difficulty	Easy

Method	Via Windows Backup & System Recovery Services
Appropriate Situation	This method is used when your backup has been set up and is active and working and the backed up files are not deleted.
Instructions Difficulty	Easy

Method	Via the program Shadow Explorer.
Appropriate Situation	This method is used when your backup has been set up, but is NOT active and working , however the backed up files are not deleted.
Instructions Difficulty	Easy

Method	Via Third-Party Decryptors.
Appropriate Situation	When the ransomware is part of a ransomware family of variants which are decryptable and an official working decryptor is released.
Instructions Difficulty	Average