I have a server that can no longer boot to Windows 2008 Server. The screen shows: your server was encrypted. to decrypt contact: firstname.lastname@example.org
One of the drives that has data on it was removed and put into a Windows 7 machine so I can see if the data was intact. It shows that it is not formatted however when I run a utility to detect files, it finds them but they are all renamed to a random name with different extensions (most have a .SWF extension). I cannot seem to find out what type of ransomware this is before I attempt to pull the data off and decrypt it. I can offer remote access to the machine if required.
Edited by hamluis, 16 June 2017 - 02:35 PM.
Moved from MRL to Ransomware - Hamluis.