hendri Posted November 9, 2018 ID:1280168 Share Posted November 9, 2018 After formatting win10 because onesystemcare malware, all my files extension change to .pptx e.g DSC03528.JPG.PPTX except .txt files. every folder has readme.txt files contain : Your files are Encrypted! For data recovery needs decryptor. and it's suggest to download "tor browser". what should I do, please help me. Link to post Share on other sites More sharing options...
Aura Posted November 9, 2018 ID:1280173 Share Posted November 9, 2018 Hi hendri Can you upload an encrypted file to ID-Ransomware and copy/paste the results here? https://id-ransomware.malwarehunterteam.com/ Link to post Share on other sites More sharing options...
hendri Posted November 9, 2018 Author ID:1280179 Share Posted November 9, 2018 2 minutes ago, Aura said: Hi hendri Can you upload an encrypted file to ID-Ransomware and copy/paste the results here? https://id-ransomware.malwarehunterteam.com/ GlobeImposter 2.0 This ransomware has no known way of decrypting data at this time. It is recommended to backup your encrypted files, and hope for a solution in the future. Identified by custom_rule: victim ID in encrypted file Link to post Share on other sites More sharing options...
David H. Lipman Posted November 9, 2018 ID:1280181 Share Posted November 9, 2018 Can you please upload a copy here, in your next reply. Link to post Share on other sites More sharing options...
hendri Posted November 9, 2018 Author ID:1280182 Share Posted November 9, 2018 HI Aura, thx for reply, I have quoted the result. Link to post Share on other sites More sharing options...
hendri Posted November 9, 2018 Author ID:1280185 Share Posted November 9, 2018 ok @David H. Lipman Link to post Share on other sites More sharing options...
Aura Posted November 9, 2018 ID:1280205 Share Posted November 9, 2018 Sadly, as stated by ID-Ransomware, that Ransomware cannot be decrypted for free at the moment. Your best solution is to recover these files from a recent back up, if you have one, or back up these files somewhere safe and hope that a free decryption solution will be released in the future. Link to post Share on other sites More sharing options...
David H. Lipman Posted November 10, 2018 ID:1280401 Share Posted November 10, 2018 On 11/9/2018 at 8:18 AM, David H. Lipman said: Can you please upload a copy here, in your next reply. @hendri can you please upload an encrypted data file so we can take a look at it. Link to post Share on other sites More sharing options...
hendri Posted November 10, 2018 Author ID:1280404 Share Posted November 10, 2018 @David H. Lipman sure, but I can't the files not allowed to upload here. Link to post Share on other sites More sharing options...
David H. Lipman Posted November 10, 2018 ID:1280406 Share Posted November 10, 2018 Place the file(s) in a ZIP, RAR or 7zip Archive and attach that. Link to post Share on other sites More sharing options...
hendri Posted November 10, 2018 Author ID:1280407 Share Posted November 10, 2018 ok, this is the file. Wrong Decision.jpg.rar Link to post Share on other sites More sharing options...
David H. Lipman Posted November 11, 2018 ID:1280412 Share Posted November 11, 2018 Thank you for indulging my request. Unfortunately, nothing new could be ascertained from the encrypted file. Link to post Share on other sites More sharing options...
Aura Posted November 11, 2018 ID:1280533 Share Posted November 11, 2018 Is there anything else we can do for you hendri, or that was it? Link to post Share on other sites More sharing options...
hendri Posted November 12, 2018 Author ID:1280541 Share Posted November 12, 2018 That's all, thanks Link to post Share on other sites More sharing options...
Aura Posted November 13, 2018 ID:1280798 Share Posted November 13, 2018 No problem hendri, you're welcome. Since it seems to be GlobeImposter 2.0 (according to IDR), I suggest that you follow its thread on BC for any development. https://www.bleepingcomputer.com/forums/t/644166/globeimposter-ransomware-support-crypt-pscrypt-ext-back-fileshtml/page-17 Link to post Share on other sites More sharing options...
Aura Posted November 13, 2018 ID:1280799 Share Posted November 13, 2018 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts