Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Ran Malwarebytes pro, reinstalled Windows and can now open Word docs in Wordpad


  • Please log in to reply
3 replies to this topic

#1 marc66

marc66

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:05 AM

Posted 26 February 2014 - 12:08 AM

Here is a partial solution it would seem:

 

1. Run Malwarebytes Pro

2. reinstall Windows

3. find correct drivers because model number was wiped in the bios

4. open MS-Word docs with Wordpad

5. first line of open file in Wordpad has gibberish but text can be read afterwards

 

Again, it seems to me this is not encryption issue because the same garbage-gibberish appears across different ppt and word files when they are opened. I suspect only headers have been corrupted in data files. 

 

Any luck with pdf files anyone?

 

Best,

Marc



BC AdBot (Login to Remove)

 


#2 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,043 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:06:05 AM

Posted 26 February 2014 - 01:30 PM

Hi,

 

What are you referring to? You don't seem to mention this. HowDecrypt/CryptorBit?

 

xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#3 marc66

marc66
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:05 AM

Posted 26 February 2014 - 10:06 PM

It is in ref to the 'how decrypt' virus ... 



#4 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,043 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:06:05 AM

Posted 27 February 2014 - 11:07 AM

Hi,

 

A repository of all current knowledge regarding CryptorBit and HowDecrypt is provided by Grinler (aka Lawrence Abrams), in this tutorial: CryptorBit and HowDecrypt Information Guide and FAQ

Reading that Guide will help you understand what CryptorBit and HowDecrypt Ransomware does and provide information for how to deal with it and possibly recover your data.

There is also a lengthy ongoing discussion in this topic: HowDecrypt or CryptorBit Encrypting Ransomware - $500 USD Ransom Topic. Since this infection is so widespread, rather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions or comments in that topic discussion.

Thanks,

 

xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users