Kumar78 Posted October 8, 2016 Share Posted October 8, 2016 I caught a virus on my PC drive at work and it appears to have changed all my file to *.A50E files. I believe I've cleaned the virus but how do I get my files back so that I can view them? Link to comment Share on other sites More sharing options...
bigcid10 Posted October 8, 2016 Share Posted October 8, 2016 there encrypted,maybe Link to comment Share on other sites More sharing options...
dac Posted October 8, 2016 Share Posted October 8, 2016 Do you have a restore point so you can restore it to a date before the virus. Link to comment Share on other sites More sharing options...
knowledge-Spammer Posted October 9, 2016 Share Posted October 9, 2016 try with http://www.tweaking.com/ Link to comment Share on other sites More sharing options...
Kalju Posted October 9, 2016 Share Posted October 9, 2016 These are encrypted files and if somebody still don't know, then restore point don't restore personal files. So, if You dont have code to decrypt these files, You'll not get them back any way. Link to comment Share on other sites More sharing options...
luisam Posted October 9, 2016 Share Posted October 9, 2016 Was it a Ransomware? Did you get any message about paying some amount of money to get the codes to decrypt? Ransomware is BAD NEWS and if you "cleaned" the ransomeware virus, quite probably you broke the connection to recover encrypted files. By the way, do you recognize the original format some of those files? Copy it, change to original format and try to open it Link to comment Share on other sites More sharing options...
Kumar78 Posted October 9, 2016 Author Share Posted October 9, 2016 1 minute ago, Kalju said: These are encrypted files and if somebody still don't know, then restore point don't restore personal files. So, if You dont have code to decrypt these files, You'll not get them back any way. Windows no longer shows the System Restore points. No idea why this happen.... Link to comment Share on other sites More sharing options...
Kalju Posted October 9, 2016 Share Posted October 9, 2016 4 minutes ago, Kumar78 said: Windows no longer shows the System Restore points. No idea why this happen.... Windows allocates them a very little space, and the parents will automatically be deleted, it is also possible to turn them off. In general, they do not help almost never. You may check, maybe they are at all disabled. Link to comment Share on other sites More sharing options...
knowledge-Spammer Posted October 9, 2016 Share Posted October 9, 2016 25 minutes ago, Kalju said: These are encrypted files and if somebody still don't know, then restore point don't restore personal files. So, if You dont have code to decrypt these files, You'll not get them back any way. maybe not 100%right i seen a video days ago with some new Hitler 2 Ransomware at 1st i was think pc was no good with out a reinstall but he used http://www.tweaking.com/ and seemed to fix lots of the problems easy i am not saying this will work for u but maybe try and see ? Link to comment Share on other sites More sharing options...
Skunk1966 Posted October 9, 2016 Share Posted October 9, 2016 do you remember which virus was detected? Or do you have a logfile from your AV or Malwarebytes? Link to comment Share on other sites More sharing options...
lepicane Posted October 9, 2016 Share Posted October 9, 2016 Upload you file to https://www.nomoreransom.org/crypto-sheriff.php and it will tell you what ransomware it is and if there is existing medicine. Link to comment Share on other sites More sharing options...
Holmes Posted October 9, 2016 Share Posted October 9, 2016 This could have something to do with it: I hope its not the ransomware that got shut down if it is your SOL because the master decryption key was deleted. I tried looking up that extension in google and didnt find anything. Could be the new cerber ransomware as it changes extensions to a random four character extension: http://www.bleepingcomputer.com/news/security/cerber-ransomware-switches-to-a-random-extension-and-ends-database-processes/ This could be what your looking for and it has information that may help you to. It may be this as the new cerber version changes the filename to random characters and the extension to four random characters. If you deleted it then go to the recycle bin and recover the files if they got deleted and there not in the recycle bin and see if there there and recover them. If not then you may be sol we need addiional information. Link to comment Share on other sites More sharing options...
Jordan Posted October 9, 2016 Share Posted October 9, 2016 i know my reply doesn't resolve this problem but i only wanted to remind you guys the importance of backups (on external hdd/usb preferably) Don't count on the Windows built-in system restore points. it doesn't help in many cases! Link to comment Share on other sites More sharing options...
dac Posted October 9, 2016 Share Posted October 9, 2016 I make 2 backups of everything of any importance I had a jump drive to die in the past Link to comment Share on other sites More sharing options...
JimmySvert Posted October 9, 2016 Share Posted October 9, 2016 3 hours ago, jordan4x said: i know my reply doesn't resolve this problem but i only wanted to remind you guys the importance of backups (on external hdd/usb preferably) Don't count on the Windows built-in system restore points. it doesn't help in many cases! 2 hours ago, dac said: I make 2 backups of everything of any importance I had a jump drive to die in the past I think that everyone should always keep backup of certain files that are personal, important and cannot be recovered from web sources (in case u don't have them encrypted on the cloud). And always have a second pc/ laptop, strictly for offline and private use only. Link to comment Share on other sites More sharing options...
Holmes Posted October 10, 2016 Share Posted October 10, 2016 Kumar hasnt posted in a day or two I hope hes ok. It sounds like the new cerberthree he got hit at his work and the new cerberthree targets database processes and changes encrypted files to random characters for the filename and four random characters for the extensions it uses. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.