0

there are a ransomware attacking on of my computer and most of the file has been renamed to something like

id-2832SGndfDcbv.supportfriend@india.com.xtbl

The file isn't corrupted as the file still has the exact size, the attack was on yesterday 3AM(GMT+6) and asking for ransom via email. As the file still being same size, I tried rename the extension but somehow doesn't work.

After Google-ing for sometime, it was attacked by so-called "CrySiS" ransomware, I was trying to find some solution and decryptor online but sadly couldn't find any of it. Plus, I'm not going to take risk of download and using some unpopular third party decryptor which may make my current situation worse.

these file being attacked contain most of personal information. I wonder is there any solution or way to decrypt the file that being attacked?

hokit
  • 21
  • 2
  • Unfortunately, we are not tech support or a ransomware and malware removal forum. Besides, we can't figure out what's going on from an email address. – schroeder Sep 15 '16 at 07:09

1 Answers1

1

It depends greatly on the malware that attacked you. Like any software, some malware is written better than others. Some use poor encryption that can be broken. Some can be fooled into decrypting your files just by tricking them into believing their payment server was paid (the "Jigsaw" ransomware is stupid like this.) But others are using high security approaches that can't be so easily thwarted.

The best approach is always to recover the lost files from a backup (on an uninfected computer, of course!), and wipe and rebuild the infected box. If that's not possible, you may have to decide whether or not to pay the ransom, and quickly. Ransomware typically comes with some kind of evil countdown clock that will permanently delete more and more files as time elapses and the payment deadline approaches; they may also delete a large number of files in retaliation if they detect a reboot or if the ransomware is killed, restarted, or tampered with.

If recovery isn't possible, your next best bet is to use a different computer to find out what kind of ransomware you were infected with, and google for specific advice for recovering your data. If self-recovery isn't in your comfort zone and the encrypted data is extremely valuable, consider calling a computer security firm.

Remember, once you're infected don't shut the attacked box off, don't reboot it, just work quickly to preserve what you can. If you do need to power it down, make sure you physically kill power instantly. You should remove the battery or unplug the power cord, instead of pressing the power button and waiting for it to shut down, or using the 'Shutdown' menu option. Use the powered down time as an opportunity to make a backup of the disk image before you restart it. This will preserve additional files from being deleted by the malware when it comes back up.

John Deters
  • 34,205
  • 3
  • 61
  • 113