Hello everybody!
An encryptor virus (also known as ransomware) is a most dangerous type of malware.
After penetrating an operating system, they delete user files after creating encrypted
copies.
It is impossible to decrypt the files without a special encryption key, which is impossible
for an ordinary user, so the information is lost forever, in fact.
As a rule, such viruses show a pop-up message “Your personal files are encrypted” and
suggest you should pay for decryption, but it’s just a waste of money, so don’t.
Let’s see in detail what to do if your computer has been attacked by such virus and your files
are encrypted.
How can you tell that you are attacked by a ransomware virus?
Your files will be deleted and replaced by copies having the same extension.
Pause this video and study this information, or find it in the description of this video:
pzdc, crypt, good, locked-<original_name.<4 random letters>, {CRYPTENDBLACKDC}, <original
_name>@_., .crypt, .crypz, .cryp1,
.xtbl, .ytbl, .breaking_bad, .heisenberg etc.
Soon all your files will have an icon like a white sheet of paper or an icon like an
archived file.
Usually, there is a text file or HTML file next to the decrypted files; this particular
file contains the hacker’s demands to send money (usually starting from $500) in exchange
for a decryption key.
First of all, don’t give way to panic and face the truth: your files are lost forever.
You can find lots of decryptors on the web promising to unlock your data for a small
amount of $30 - $100, but most likely they will not.
You shouldn’t be sending money to the virus creator either, because all you can get is
more attention from an experienced hacker.
Remember, that the virus is still inside your computer and may be encrypting more and more
files.
Disconnect all memory cards, USB drives, cameras, tablet PCs and so on from your computer.
Disconnect your computer from the networks or WiFi to stop the virus from further migration.
Press CTRL + SHIFT + ESC (or CTRL + ALT + Delete) to see the list of running processes
and check them for suspicious activities.
Such viruses create much load on the computer’s resources, especially on its hard disk and
the processor.
Find the most resource-intensive processes and stop them.
Then go to Startup tab and disable all applications.
You can leave only trusted ones, but remember that they can also be infected and start a
virus as well.
Right-click on the Start menu and select Computer Management, then go to Task Scheduler and
then to Task Scheduler Library.
View the active tasks and disable those that seem suspicious.
After such actions the virus won’t be able to start itself again, and you can begin working
with files.
I’d recommend installing the antivirus Kaspersky Internet Security (or any other product from
the top category) to protect your computer against repeated startup of the virus and
your files against repeated infection.
You can learn more about the top antiviruses from our review - you can find the link in
the description.
Review your personal files and copy all of them which are not encrypted yet.
If you don’t have an antivirus installed, remember that bringing your files to another
computer can infect it too.
Go to the Kaspersky website (find the link in the description).
There is a collection of free decrypting utilities by Kaspersky and the instructions on using
them.
For example, let’s learn how to decrypt an .xtbl file.
1.
Enter extension of the file which you need to decrypt and click Search.
2.
The website offers us a Shade Decryptor utility - download and run it.
3.
Click “start scanning”..... and then specify the path to one of the encrypted files.
4.
If the utility cannot determine the virus identifier, it will ask you to specify the
path to the file readme.txt which contains demand from the ransomware.
This path is simple - the file is usually in the same directory with the infected files.
5.
Ready.
The utility has checked and decrypted the file.
Note.
Please remember that there is little chance that all your files can be decrypted in that
way.
Then it is high time to think about your data backup - or, to say exactly, recovering files
from your backup.
If you have such copy of your files, then you’re lucky and you can recover them after
the virus is deleted.
Such backup could be made by a program which you installed and adjusted, or independently
by one of Windows tools: file history, restore points or system image backup.
In the description, you will find links to the videos where we examine this problem in
detail.
If you work with a computer connected to the local company network, you should ask your
system administrator for help.
He must be the person who is in charge of backup.
If you can’t find a backup copy, try using data recovery software.
When encrypting, the virus creates a new file and writes the encrypted contents of the original
file there.
After that, it deletes the original file, so you can try recovering it.
Download, install and launch Hetman Partition Recovery.
Run full analysis, and the program will show the files available for recovery.
Sure you won’t be able to recover all of your files in that way, but at least it works
with some of them!
If you liked this video, click the Like button below and subscribe to our channel to see
more.
We’ll be glad to answer any questions in comments.
Thank you for watching and good luck!