all file change to be .PPTX, and i'v been reinstal my laptop

[NexusBurn]

Hi I have the same problem with my desktop computer.

All my files were changed to .PPTX.

and i'v been reinstal my laptop before my all my change to .PPTX, and just 80% my file have been change to .PPTX

i reinstal my laptop becaus im panic to see all my file change to .PPTx, because that was my first time see this virus

 

I need someone willing to help please. All the encrypted file are too important. I can't just delete them.

Here's the same note they left.

Your files are Encrypted!
For data recovery needs decryptor.
How to buy decryptor:

1. Download "Tor Browser" from https://www.torproject.org/ and install it.

2. Open this link In the "Tor Browser"

http://huhighwfn4jihtlz.onion/sdlsgdewwbhr

Note! This link is available via "Tor Browser" only.

------------------------------------------------------------
Free decryption as guarantee.
Before paying you can send us 2 file for free decryption.
------------------------------------------------------------
You unique ID
   67 6C 44 0F D1 41 DC 78 D7 71 A9 F4 70 72 57 41
68 A7 BA B2 99 CE A3 95 C9 5E 1B 29 55 C0 44 9E
7D 0B 3C C1 87 BE C5 14 AF 1A BD B0 29 BD 09 E5
53 6E 3F 9A 47 D2 B8 3B E1 38 09 3D DC EE 29 61
C4 E1 52 57 9E EA 92 6E 8A 21 81 2B 4C D0 09 13
2D 4D 6E E4 BB 84 53 97 3B 85 17 D8 0D 71 A0 90
E7 8D BB 96 C3 64 4F C1 0C E0 AE F1 80 96 67 58
25 D5 C0 02 D0 4A 61 4F 33 82 C0 1B 02 A0 47 9C
EC 35 91 6D 5A 9C C4 E8 55 4A 9C 56 82 A4 A1 C4
97 D5 8C 4D CE 43 4E 8C 07 F7 B1 7B CF FC A3 6E
7A 74 AC EF 36 92 87 1C FB B4 3D 64 8C DA 3B F5
83 C8 EA 07 D9 03 A8 C4 22 38 01 CF 62 EA 35 2C
59 2E 3D 8E 54 26 43 5A 97 5D EA 42 7D AD 7F 0B
85 B5 44 C4 B0 78 84 EF 83 4A 53 5C D1 D2 51 19
0E E1 8B EF 0A 3C 17 F7 D2 79 2A B7 52 5C 75 AE
CC B7 7C F7 D2 90 64 C2 4C FC 7F B1 12 7E 53 49
 

please help mee to recover or decryp all my file, couse that file so important

[AdvancedSetup]

Hello @NexusBurn and

You can read the directions here and see if they're able to detect which version of this attack you have.

Can you upload an encrypted file or ransom note to ID-Ransomware and copy/paste the results here?

https://id-ransomware.malwarehunterteam.com/

Thanks

Ron

 

 

[NexusBurn]

i don't know how to use that link, when i click uploud that link will be appear like this :

 

[AdvancedSetup]

Please try a different browser. I just checked and it's working from my location.

https://id-ransomware.malwarehunterteam.com/

 

[NexusBurn]

file to choose, and link address i content like this right ??

or i'v got wrong ??

[NexusBurn]

so if that say like this, what solution can i do to all my file right now ?

[AdvancedSetup]

I'm sorry but there currently is no way to decrypt your files. You can copy them off to an external drive. Then store the drive in a safe place in the hopes that in the future a key will be released to restore those files.

 

 

[NexusBurn]

Okee thanks @AdvancedSetup if you have key to decrypt please tell me, couse all of my file is important

[AdvancedSetup]

Again, I do apologize as there is nothing we can do to help you with getting those files back at this time. 

However, going forward I would highly suggest you use an external USB drive and backup all your personal data.

Backup Software

All the best

Ron

 

 

[NexusBurn]

Okee thanks @AdvancedSetup, but i'v been see some one tell me tu try use app spyhunter, it's true ?

[AdvancedSetup]

No, that is not true. SpyHunter cannot decrypt the files either.

[NexusBurn]

Oh okeey, but this link say, they can remove the virus *.PPTX ransomware

https://www.pcrisk.com/removal-guides/14037-pptx-ransomware

I don't know it was true or not, so i ask to you...

[AdvancedSetup]

We can remove and clean the computer. That's not an issue. No one currently can restore your data files.

Please run the following below and we'll clean the computer for you.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[NexusBurn]

Oh okeey thanks, i think that link say they can restore all data *.PPTX

[AdvancedSetup]

They are lying, but hey it's up to you as it is your computer.

If you had the older infection then possibly, but the 2.0 version of this attack has no known public method to recover the data. You need the private key to do so.

 

[NexusBurn]

It's a new version of this virus ?

If yes, when this virus appear, cous i'v been looking for another person, this virus appear in this month ?

[AdvancedSetup]

I'm sorry, but I don't know exactly when it was discovered.

[AdvancedSetup]

Since this issue is resolved the topic will now be closed to prevent others from posting here.

If you need assistance please start your own new topic and someone will be happy to assist you.

Thanks