Solved

How can I decrypt files decrypted with cbtlocker

Posted on 2015-02-10
4
356 Views
Last Modified: 2015-02-13
Hi,
My files were encrypted by Cbtlocker malware , I was able to remove the virus, but my files still encrypted. How can I restore my files. I tried to System Restore, and other tools but with no luck.
Please help.

Regards,
Omar
0
Comment
Question by:Fuad Bazarah
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 49

Accepted Solution

by:
dbrunton earned 125 total points
ID: 40601241
Short answer:  You can't.

Long answer:  See http://www.bleepingcomputer.com/virus-removal/ctb-locker-ransomware-information for lots of information.

There are suggested methods of recovery there but quite likely they won't work.  You can pay the ransom if you wish to try that method.
0
 
LVL 28

Assisted Solution

by:Thomas Zucker-Scharff
Thomas Zucker-Scharff earned 125 total points
ID: 40601360
Short answer - either restore from backup or pay the ransom.  I don't suggest the latter, especially since you have wiped the information that would allow decryption with a ransomed decrypt key.  So most likely this will not work.  If you don't have a backup and you can't get it back to the state before you cleaned it.  You don't have much chance.
0
 
LVL 24

Assisted Solution

by:Eirman
Eirman earned 125 total points
ID: 40601375
System restore only works for your operating system files,
not your data files. You need a separate backup(s) for them.

This is a long shot. There just might be some unencrypted old versions of some files available.
http://windows.microsoft.com/en-us/windows/previous-versions-files-faq#1TC=windows-7
0
 
LVL 18

Assisted Solution

by:web_tracker
web_tracker earned 125 total points
ID: 40602397
You will not be able to unencrypt the files, but you may be able to get back many of the files from a backup that is automatically created called Shadow copy (that is if it was activated to run before your files got encrypted). By default shawdow copy is turned on.  But some of the CBlocker viruses also encrypt or destroy your shadow copy files. You may be able to try using ShadowExplorer to extract files from your Shadow copy.  http://www.shadowexplorer.com/downloads.html
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
Ransomware is a growing menace to anyone using a computer or mobile device. Here are answers to some common questions about this vicious new form of malware.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question