Solved

How can I decrypt files decrypted with cbtlocker

Posted on 2015-02-10
4
354 Views
Last Modified: 2015-02-13
Hi,
My files were encrypted by Cbtlocker malware , I was able to remove the virus, but my files still encrypted. How can I restore my files. I tried to System Restore, and other tools but with no luck.
Please help.

Regards,
Omar
0
Comment
Question by:Fuad Bazarah
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 48

Accepted Solution

by:
dbrunton earned 125 total points
ID: 40601241
Short answer:  You can't.

Long answer:  See http://www.bleepingcomputer.com/virus-removal/ctb-locker-ransomware-information for lots of information.

There are suggested methods of recovery there but quite likely they won't work.  You can pay the ransom if you wish to try that method.
0
 
LVL 27

Assisted Solution

by:Thomas Zucker-Scharff
Thomas Zucker-Scharff earned 125 total points
ID: 40601360
Short answer - either restore from backup or pay the ransom.  I don't suggest the latter, especially since you have wiped the information that would allow decryption with a ransomed decrypt key.  So most likely this will not work.  If you don't have a backup and you can't get it back to the state before you cleaned it.  You don't have much chance.
0
 
LVL 23

Assisted Solution

by:Eirman
Eirman earned 125 total points
ID: 40601375
System restore only works for your operating system files,
not your data files. You need a separate backup(s) for them.

This is a long shot. There just might be some unencrypted old versions of some files available.
http://windows.microsoft.com/en-us/windows/previous-versions-files-faq#1TC=windows-7
0
 
LVL 18

Assisted Solution

by:web_tracker
web_tracker earned 125 total points
ID: 40602397
You will not be able to unencrypt the files, but you may be able to get back many of the files from a backup that is automatically created called Shadow copy (that is if it was activated to run before your files got encrypted). By default shawdow copy is turned on.  But some of the CBlocker viruses also encrypt or destroy your shadow copy files. You may be able to try using ShadowExplorer to extract files from your Shadow copy.  http://www.shadowexplorer.com/downloads.html
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SSL stands for “Secure Sockets Layer” and an SSL certificate is a critical component to keeping your website safe, secured, and compliant. Any ecommerce website must have an SSL certificate to ensure the safe handling of sensitive information like…
One of the biggest threats facing all high-value targets are APT's.  These threats include sophisticated tactics that "often starts with mapping human organization and collecting intelligence on employees, who are nowadays a weaker link than network…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question