Solved

How can I decrypt files decrypted with cbtlocker

Posted on 2015-02-10
4
350 Views
Last Modified: 2015-02-13
Hi,
My files were encrypted by Cbtlocker malware , I was able to remove the virus, but my files still encrypted. How can I restore my files. I tried to System Restore, and other tools but with no luck.
Please help.

Regards,
Omar
0
Comment
Question by:Fuad Bazarah
4 Comments
 
LVL 48

Accepted Solution

by:
dbrunton earned 125 total points
ID: 40601241
Short answer:  You can't.

Long answer:  See http://www.bleepingcomputer.com/virus-removal/ctb-locker-ransomware-information for lots of information.

There are suggested methods of recovery there but quite likely they won't work.  You can pay the ransom if you wish to try that method.
0
 
LVL 27

Assisted Solution

by:Thomas Zucker-Scharff
Thomas Zucker-Scharff earned 125 total points
ID: 40601360
Short answer - either restore from backup or pay the ransom.  I don't suggest the latter, especially since you have wiped the information that would allow decryption with a ransomed decrypt key.  So most likely this will not work.  If you don't have a backup and you can't get it back to the state before you cleaned it.  You don't have much chance.
0
 
LVL 23

Assisted Solution

by:Eirman
Eirman earned 125 total points
ID: 40601375
System restore only works for your operating system files,
not your data files. You need a separate backup(s) for them.

This is a long shot. There just might be some unencrypted old versions of some files available.
http://windows.microsoft.com/en-us/windows/previous-versions-files-faq#1TC=windows-7
0
 
LVL 18

Assisted Solution

by:web_tracker
web_tracker earned 125 total points
ID: 40602397
You will not be able to unencrypt the files, but you may be able to get back many of the files from a backup that is automatically created called Shadow copy (that is if it was activated to run before your files got encrypted). By default shawdow copy is turned on.  But some of the CBlocker viruses also encrypt or destroy your shadow copy files. You may be able to try using ShadowExplorer to extract files from your Shadow copy.  http://www.shadowexplorer.com/downloads.html
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question