Home

Ransomware recovery

Details

Category: Uncategorised

Last Updated: 13 December 2016

Hits: 1076

Ransomware is a type of malicious softare that encrypts your files, then asks for a ransom to recover them.  Encrypted files cannot be read without a special key to decrypt them.

Usually there's either a text file, desktop image, or sometimes a popup warning that your files have been encrypted, something like this:

 

Many computer service shops and consultants will tell you that if you don't have a backup, the only way to recover your files if you've been hit by a ransomware infection, is to pay the ransom. This isn't necessarily true.

This is an actual image of a text notification from a ransomware demand.  This was found on a computer belonging to a client that called CB Services when they discovered they were infected.

This particular ransomware had several common errors in the encryption functions.  These particular errors have been known about for years; the German's use of the  Enigma machine to encrypt messages during World War 2 was also compromized by these exact errors.

With a good knowledge of the mathematics behind the encryption, these errors can be exploited to recover files without paying a ransom, which is what was done in this case.  There are a few ransomware variants that actually do the encryption properly, which means there are no errors to exploit, but without a thorough analysis of the encryption, which should easily take an hour or more, there is no way to know whether it's done properly.

Paying the ransom only encourages the criminals to continue.  If your computer tech almost immediately tells you they can't recover your files without paying, then you may very well need to call someone else.

 

CB Services has this expertise, so give us a try.