Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


All my files have the extension 004.JPG.qupvybb

  • Please log in to reply
3 replies to this topic

#1 tadifero


  • Members
  • 5 posts
  • Local time:01:02 PM

Posted 01 September 2016 - 10:06 AM

All my files have the extension 004.JPG.qupvybb
No way to decrypt ?
thank you all

Edited by tadifero, 01 September 2016 - 10:09 AM.

BC AdBot (Login to Remove)


#2 cybercynic


  • Members
  • 560 posts
  • Gender:Male
  • Location:Edge Of Tomorrow
  • Local time:08:02 AM

Posted 01 September 2016 - 11:01 AM

You need to upload an encrypted file and the ransom note here: https://id-ransomware.malwarehunterteam.com/


The site will attempt to make a positive ID of your ransomware and give you guidance on what to do next.

We are drowning in information - and starving for wisdom.

#3 Demonslay335


    Ransomware Hunter

  • Security Colleague
  • 3,561 posts
  • Gender:Male
  • Location:USA
  • Local time:07:02 AM

Posted 01 September 2016 - 11:16 AM

Most likely it is CTB-Locker based on the random extension (Maktub also used random extensions of that length but hasn't been as active lately). ID Ransomware will have the best chance at identifying if you provide it a ransom note.

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.

#4 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,769 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:02 AM

Posted 01 September 2016 - 12:30 PM

Alma Locker also uses a random 5-6 character extension.

CTB-Locker will leave files (ransom notes) with names like DecryptAllFiles.txt, DecryptAllFiles_<user name>.txt, !Decrypt-All-Files.[7-random].html that contains ransom instructions but the newer variants do not always leave a ransom note if the malware fails to change the background like it typically does. An AllFilesAreLocked_<user name>.bmp image file may be left in the My Documents folder which contains further instructions on how to pay the ransom.

Maktub Locker displays a ransom note named _DECRYPT_INFO_[random].html.
Alma Locker will leave files with names like Unlock_files_<random>.html, Unlock_files_<random>.txt.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users