Solved

How can I decrypt files decrypted with cbtlocker

Posted on 2015-02-10
4
345 Views
Last Modified: 2015-02-13
Hi,
My files were encrypted by Cbtlocker malware , I was able to remove the virus, but my files still encrypted. How can I restore my files. I tried to System Restore, and other tools but with no luck.
Please help.

Regards,
Omar
0
Comment
Question by:Fuad Bazarah
4 Comments
 
LVL 48

Accepted Solution

by:
dbrunton earned 125 total points
ID: 40601241
Short answer:  You can't.

Long answer:  See http://www.bleepingcomputer.com/virus-removal/ctb-locker-ransomware-information for lots of information.

There are suggested methods of recovery there but quite likely they won't work.  You can pay the ransom if you wish to try that method.
0
 
LVL 26

Assisted Solution

by:Thomas Zucker-Scharff
Thomas Zucker-Scharff earned 125 total points
ID: 40601360
Short answer - either restore from backup or pay the ransom.  I don't suggest the latter, especially since you have wiped the information that would allow decryption with a ransomed decrypt key.  So most likely this will not work.  If you don't have a backup and you can't get it back to the state before you cleaned it.  You don't have much chance.
0
 
LVL 23

Assisted Solution

by:Eirman
Eirman earned 125 total points
ID: 40601375
System restore only works for your operating system files,
not your data files. You need a separate backup(s) for them.

This is a long shot. There just might be some unencrypted old versions of some files available.
http://windows.microsoft.com/en-us/windows/previous-versions-files-faq#1TC=windows-7
0
 
LVL 18

Assisted Solution

by:web_tracker
web_tracker earned 125 total points
ID: 40602397
You will not be able to unencrypt the files, but you may be able to get back many of the files from a backup that is automatically created called Shadow copy (that is if it was activated to run before your files got encrypted). By default shawdow copy is turned on.  But some of the CBlocker viruses also encrypt or destroy your shadow copy files. You may be able to try using ShadowExplorer to extract files from your Shadow copy.  http://www.shadowexplorer.com/downloads.html
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Secure removal of files encrypted by windows EFS 20 109
Opinions on email encryption & Voltage 3 92
DANE and Convergence 6 70
Has my website been infiltrated? 21 63
SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
When the confidentiality and security of your data is a must, trust the highly encrypted cloud fax portfolio used by 12 million businesses worldwide, including nearly half of the Fortune 500.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now