is a Dr.Web generic detection that includes a family of Trojans responsible for encrypting data and demanding a ransom payment. As such, there are numerical modifiers (additional information) after the name that further describes what type of malware it is. Trojan.Encoder.686
was added to the Dr.Web database on 07/11/14 and the description included this variant left files (ransom notes) named DecryptAllFiles_.txt and AllFilesAreLocked_.bmp (see here
) and also appended a .ctbl
extension to the end of the filename just like the original CTB Locker
Unfortunately at this time there is no fix tool and decryption of CTB Locker...is impossible
since there is no way to retrieve the private key that can be used to decrypt your files without paying the ransom. Encoder.686 uses CryptoAPI to generate random data as well as elliptic curve cryptography which makes it impossible to recover the affected data. The only methods you have of restoring your files is from backup, file recovery tools, or from Shadow Volume Copies as explained in the FAQ: How to restore files encrypted by CTB Locker
...but there is no guarantee that will work.
As with most ransomware infections...the best solution for dealing with encrypted data is to restore from backups
. If that is not a viable option, the only other alternative is to save your data as is and wait for a possible breakthrough
...meaning, what seems like an impossibility at the moment (decryption of your data), there is always hope someday there may be a potential solution so save the encrypted data and wait until that time.
There is an ongoing discussion in this topic where you can ask questions and seek further assistance but as noted above there is no solution to fix your files yet.
Rather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions, comments or requests for assistance in that support topic discussion. Doing that will also ensure you receive proper assistance from our crypto malware experts since they may not see this thread. To avoid unnecessary confusion...this topic is closed.
The BC Staff