Solved

How can I decrypt files decrypted with cbtlocker

Posted on 2015-02-10
4
338 Views
Last Modified: 2015-02-13
Hi,
My files were encrypted by Cbtlocker malware , I was able to remove the virus, but my files still encrypted. How can I restore my files. I tried to System Restore, and other tools but with no luck.
Please help.

Regards,
Omar
0
Comment
Question by:Fuad Bazarah
4 Comments
 
LVL 47

Accepted Solution

by:
dbrunton earned 125 total points
ID: 40601241
Short answer:  You can't.

Long answer:  See http://www.bleepingcomputer.com/virus-removal/ctb-locker-ransomware-information for lots of information.

There are suggested methods of recovery there but quite likely they won't work.  You can pay the ransom if you wish to try that method.
0
 
LVL 26

Assisted Solution

by:Thomas Zucker-Scharff
Thomas Zucker-Scharff earned 125 total points
ID: 40601360
Short answer - either restore from backup or pay the ransom.  I don't suggest the latter, especially since you have wiped the information that would allow decryption with a ransomed decrypt key.  So most likely this will not work.  If you don't have a backup and you can't get it back to the state before you cleaned it.  You don't have much chance.
0
 
LVL 23

Assisted Solution

by:Eirman
Eirman earned 125 total points
ID: 40601375
System restore only works for your operating system files,
not your data files. You need a separate backup(s) for them.

This is a long shot. There just might be some unencrypted old versions of some files available.
http://windows.microsoft.com/en-us/windows/previous-versions-files-faq#1TC=windows-7
0
 
LVL 18

Assisted Solution

by:web_tracker
web_tracker earned 125 total points
ID: 40602397
You will not be able to unencrypt the files, but you may be able to get back many of the files from a backup that is automatically created called Shadow copy (that is if it was activated to run before your files got encrypted). By default shawdow copy is turned on.  But some of the CBlocker viruses also encrypt or destroy your shadow copy files. You may be able to try using ShadowExplorer to extract files from your Shadow copy.  http://www.shadowexplorer.com/downloads.html
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Explore the encryption capabilities built into Google Apps and how these features can help you meet privacy policy and regulatory compliance, but are not a full solution. Understand and compare the most popular email encryption services for Google A…
If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now