Ransomware

[Garry_TS]

There are situations in data recovery when you are able to open a folders tree, but files can't be opened.
There is no shifts caused by translator damage, no software encryption like EFS.

You are beating brain under this problem, but if take a closer look you will see the answer. It's ransomware.

What are the signs of ransomware?

All file structure can be opened, but files can't be.

If you will check first sector of JPG there will be something like:



Also, usually there is a specific file in root of partition or home catalog:



When you open it you will see something like



For example, in case from picture there was a Spora ransomware which encrypts files with .xls, .doc, .xlsx, .docx, .rtf, .odt, .pdf, .psd, .dwg, .cdr, .cd, .mdb, .1cd, .dbf, .sqlite, .accdb, .jpg, .jpeg, .tiff, .zip, .rar, .7z, .backup extensions and doesn't change names of files.

Is there any solution ?

For now, there is no solution from ACELab because it's not our business specialization.

I recommend to check special resources like NoRansom from Kaspersky Lab and ID Ransomware from Malware Hunter Team and google for detailed info about your type of ransomware and possible decryptors.

How can I protect from ransomware

* Make a regular backups
* Use anti-virus software
* Do not open suspicious attachements

[Amarbir[CDR-Labs]]

Thanks Pavel,
I do not take any ransomeware cases myself

[cuumaytinh]

With ramsoware there's no way except that you have the key to decode. Some ransoware only encodes the first few sectors first. but most of it will encrypt the whole file.

[net2]

Excellent article Garry, thank you.

OPEN QUESTION: Why are some labs offering ransomware recovery? do they just intermediate between customer and Hacker?

[arvika]

Source of the post Excellent article Garry, thank you.

OPEN QUESTION: Why are some labs offering ransomware recovery? do they just intermediate between customer and Hacker?

No. They develop solutions recovery from some type of ransomware.

[Amarbir[CDR-Labs]]

Source of the post Excellent article Garry, thank you.

OPEN QUESTION: Why are some labs offering ransomware recovery? do they just intermediate between customer and Hacker?

Well,
I do not agree to above post .Mostly they are repairing videos photos and databases based on stop.djvu ransomeware .Yes they act as intermediaries also between party and hacker