Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


My file turned into .rhuphem extension. Am i infected?

  • This topic is locked This topic is locked
2 replies to this topic

#1 ostechnix


  • Members
  • 1 posts
  • Local time:11:06 PM

Posted 30 April 2015 - 01:46 AM

My files in Windows OS automatically got turned into ".rhuphem" extension. For example, if my file name is "sk.pdf", it is automatically turned into "sk.pdf.rhuphem". I can't open the files now.  Does anybody know the solution. Thanks in advance.

Edited by hamluis, 30 April 2015 - 09:29 AM.
Moved from MRL to Gen Security, closed per request - Hamluis.

BC AdBot (Login to Remove)


#2 Sintharius


    Bleepin' Sniper

  • Members
  • 5,639 posts
  • Gender:Female
  • Location:The Netherlands
  • Local time:06:36 PM

Posted 30 April 2015 - 09:28 AM


It appears that you are infected with CTB-Locker. More information can be found here: CTB Locker and Critroni Ransomware Information Guide and FAQ

There is currently an ongoing discussion in this topic: CTB Locker or DecryptAllFiles.txt Encrypting Ransomware Support & Discussion. Please post any relevant questions to CTB-Locker in that topic.

To avoid confusion, I have asked a Moderator to close this topic.


#3 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,609 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:36 PM

Posted 30 April 2015 - 10:19 AM

At this time there is no fix tool and unfortunately, still no known method to retrieve the private key that can be used to decrypt your files since there is no way to retrieve the private key that can be used to decrypt your files without paying the ransom.

Newer variants of CTB Locker will attempt to delete all Shadow Volume Copies when you first start any executable so that you cannot restore your files via System Restore or using a program like Shadow Explorer...but it never hurts to try. You may may even be able to use file recovery software such as R-Studio or Photorec to recover some of your original files.

If you jave further questions, please post them in the discussion topic linked to by Alexstrasza.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users