Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

.crypt


  • This topic is locked This topic is locked
11 replies to this topic

#1 diferdinando

diferdinando

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:05:55 AM

Posted 25 May 2016 - 05:20 AM

crypt word and images how do I fix



BC AdBot (Login to Remove)

 


#2 Tsubakura

Tsubakura

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Arnhem
  • Local time:05:55 AM

Posted 25 May 2016 - 09:39 AM

Hey,

 

Can you give us more details about the ransom note?

If your files are encrypted with the .crypt extension, you might've been hit by the CryptXXX.

You can try the free Kaspersky Decrypter to decrypt that, but note that it may not work on the newest version.

 

You can find more details about CryptXXX in the support topic.
http://www.bleepingcomputer.com/forums/t/609690/cryptxxx-ransomware-support-and-help-topic-crypt-ext-de-crypt-readmehtml 



#3 diferdinando

diferdinando
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:05:55 AM

Posted 25 May 2016 - 10:16 AM

@@@@@@@ NOT YOUR LANGUAGE? USE https://translate.google.com
 
@@@@@@@ What happened to your files ?
@@@@@@@ All of your files were protected by a strong encryption with RZA4096
@@@@@@@ More information about the en-Xryption keys using RZA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
 
@@@@@@@ How did this happen ?
@@@@@@@ !!! Specially for your PC was generated personal RZA4096 Key , both publik and private.
@@@@@@@ !!! ALL YOUR FILES were en-Xrypted with the publik key, which has been transferred to your computer via the Internet.
@@@@@@@ !!! Decrypting of your files is only possible with the help of the privatt key and de-crypt program , which is on our Secret Server
 
@@@@@@@ What do I do ?
@@@@@@@ So , there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way
@@@@@@@ If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment
 
 
Your personal ID: F16802F5C3EE
 
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
 
 
If for some reasons the addresses are not available, follow these steps:
 
1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2 - After a successful installation, run the browser
3 - Type in the address bar - http://eqyo4fbr5okzaysm.onion
4 - Follow the instructions on the site
 
Be sure to copy your personal ID and the instruction link to your notepad not to lose them.

kaspersky not working RannohDecryptor



#4 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:10:55 PM

Posted 25 May 2016 - 12:00 PM

That note looks to be CryptXXX 3.0. There is currently no solution at this time for it, you will have to backup your files and hope there is a breakthrough in the future.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#5 CarlesX

CarlesX

  • Members
  • 78 posts
  • OFFLINE
  •  
  • Local time:06:55 AM

Posted 25 May 2016 - 03:24 PM

 

That note looks to be CryptXXX 3.0. There is currently no solution at this time for it

So this doesn't work at all? They've built a CryptXXX decryption tool. I haven't tried it or anything, just bumped into it while searching for solutions for Cerber Ransomware.

 

https://noransom.kaspersky.com/


Edited by CarlesX, 25 May 2016 - 03:25 PM.


#6 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:10:55 PM

Posted 25 May 2016 - 03:29 PM

 

 

That note looks to be CryptXXX 3.0. There is currently no solution at this time for it

So this doesn't work at all? They've built a CryptXXX decryption tool. I haven't tried it or anything, just bumped into it while searching for solutions for Cerber Ransomware.

 

https://noransom.kaspersky.com/

 

 

Note in the topic and news articles on the front of BleepingComputer, it is explained that CryptXXX 3.0 has no solution; Kaspersky's tool only works on previous versions, it no longer works for the newest variant.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#7 CarlesX

CarlesX

  • Members
  • 78 posts
  • OFFLINE
  •  
  • Local time:06:55 AM

Posted 25 May 2016 - 03:38 PM

 

 

 

That note looks to be CryptXXX 3.0. There is currently no solution at this time for it

So this doesn't work at all? They've built a CryptXXX decryption tool. I haven't tried it or anything, just bumped into it while searching for solutions for Cerber Ransomware.

 

https://noransom.kaspersky.com/

 

 

Note in the topic and news articles on the front of BleepingComputer, it is explained that CryptXXX 3.0 has no solution; Kaspersky's tool only works on previous versions, it no longer works for the newest variant.

 

Bummer, thanks for the heads up. How long has it been since the newest variant is around? 



#8 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:10:55 PM

Posted 25 May 2016 - 03:55 PM

AFAIK, reports of it started coming in middle-to-end of last week I believe. It's pushed aggressively because they took over the distribution network of TeslaCrypt pretty much. It's unknown if it will be crack-able yet.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#9 CarlesX

CarlesX

  • Members
  • 78 posts
  • OFFLINE
  •  
  • Local time:06:55 AM

Posted 25 May 2016 - 03:59 PM

AFAIK, reports of it started coming in middle-to-end of last week I believe. It's pushed aggressively because they took over the distribution network of TeslaCrypt pretty much. It's unknown if it will be crack-able yet.

Hmm, I see. Just trying to determine how long it takes for security companies etc. to come up with solutions (=how much I will have to wait for someone to come up with a decryptor for Cerber).



#10 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:10:55 PM

Posted 25 May 2016 - 04:41 PM

It of course isn't always guaranteed. Some ransomware use proper encryption. For example, there are still ransomwares from 2014 that have not been cracked. It's just recommended to backup the data and hope for the future.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#11 CarlesX

CarlesX

  • Members
  • 78 posts
  • OFFLINE
  •  
  • Local time:06:55 AM

Posted 25 May 2016 - 04:46 PM

It of course isn't always guaranteed. Some ransomware use proper encryption. For example, there are still ransomwares from 2014 that have not been cracked. It's just recommended to backup the data and hope for the future.

Yea I know, one can only hope. Thanks anyway :)



#12 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,600 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:55 PM

Posted 25 May 2016 - 06:25 PM

Rather than have everyone with individual topics, it would be best (and more manageable for staff) if you posted any more questions, comments or requests for assistance in the above support topic discussion noted by Demonslay335. To avoid unnecessary confusion, this topic is closed.

Thanks
The BC Staff
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users