Cyber Ransomware - virus

hellagrant

Distinguished
Jul 6, 2009
3
0
18,510
Need some general guidance please. It looks like this is something called "Cerber Ransomware". After opening a file sent my an anonymous sender from craigslists, many files have become locked.

2d9a2s5.png
 
Solution
Go into Control Panel>Administrative Tools>Services and scroll through to the Volume Shadow Copy entry. Is it set to Automatic and is it running?

If it is, you might have a good chance of recovering the files using Recuva or similar. Recuva is free from http://www.pirirform.com, the CCleaner people.

If that Service is disabled, there's little chance of recovery. Just don't waste money on the scum who raied your machine - they have no reason to give you a decryption key once they've been paid.

bignastyid

Splendid
Moderator
I guess you learned the lesson of why you shouldn't open attachments from unknown sources. I hope you had a backup of your data that wasn't attached to the system and the time of infection. It is possible to remove the ransonmware, but there is no way of decrypting the files.
https://www.pcrisk.com/removal-guides/9842-cerber-ransomware
http://www.bleepingcomputer.com/news/security/the-cerber-ransomware-not-only-encrypts-your-data-but-also-speaks-to-you/
https://blog.malwarebytes.com/threat-analysis/2016/03/cerber-ransomware-new-but-mature/
 

schwatzz

Estimable
Jun 23, 2014
82
0
4,610
If you want your files back, you will have to do whatever he wants. Even then, there is a pretty good chance you won't see those files again, these ransomware people couldn't care less what happens to you.
 
Go into Control Panel>Administrative Tools>Services and scroll through to the Volume Shadow Copy entry. Is it set to Automatic and is it running?

If it is, you might have a good chance of recovering the files using Recuva or similar. Recuva is free from http://www.pirirform.com, the CCleaner people.

If that Service is disabled, there's little chance of recovery. Just don't waste money on the scum who raied your machine - they have no reason to give you a decryption key once they've been paid.
 
Solution

hellagrant

Distinguished
Jul 6, 2009
3
0
18,510


Will try this. Thank you.

So I been reading articles regarding this type of scam, amazing. People actually pay!!! no wonder why this is a growing trend, hundreds even thousands!!!!