Britec Tech Support Forum

[attachment=2259]

my pc infected with New Hard Ransomware ( 98E8 file) Help Please
files after infected become :

[attachment=2258]

akhmedtaia  I have upload the photo to the forum

its already encrypt your data I am sure you can't do much to get it back

  Scan with Malwarebytes' Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Install the progam and select update.
• Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• At the bottom click Export and choose Text file.
  

Why type of ransomware is it? does it display a image on desktop? We need more information about the ransomware you have so we can see if there is a tool to decrypt your files.

(12-23-2016, 12:37 PM)Compton Wrote: [ -> ]akhmedtaia  I have upload the photo to the forum

its already encrypt your data I am sure you can't do much to get it back

  Scan with Malwarebytes' Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Install the progam and select update.
• Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• At the bottom click Export and choose Text file.
  

Thanx, but ..
i uses : Malwarebytes 3.0.4.1269 Premium --- No infect
- G DATA INTERNET SECURITY--- No infect
Ransomware Defender--- No infect
GridinSoft Anti-Ransomware--- No infect
avast anti-ransome- --- No infect
-----------------------
any decrype , please ?

Scan with Farbar Recovery Scan Tool


Please download Farbar Recovery Scan Tool x64 and save it to your Desktop.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• When the tool opens click Yes to disclaimer.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
  

Please attach .txt files into your next reply.

(12-23-2016, 12:42 PM)Britec Wrote: [ -> ]Why type of ransomware is it? does it display a image on desktop? We need more information about the ransomware you have so we can see if there is a tool to decrypt your files.

please check file on dropbox
https://www.dropbox.com/sh/cqu0k70uue81uua/AABo25PGNoVToNLfd3zOiCpoa?dl=0

files after encrypted
------------------------
edit:
i delete Ransomware source file

I don't think they have a decryptor tool for cerber ransomware

Yeah Cerber 3, not good news I am afraid.

https://www.bleepingcomputer.com/news/security/check-point-releases-working-decryptor-for-the-cerber-ransomware/

(12-23-2016, 12:47 PM)Britec Wrote: [ -> ] Scan with Farbar Recovery Scan Tool


Please download Farbar Recovery Scan Tool x64 and save it to your Desktop.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• When the tool opens click Yes to disclaimer.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
  

Please attach .txt files into your next reply.

ok, i check my pc when i comeback home
first , see this analyse
https://malwr.com/analysis/MjNlOWE0MWQ4NGE3NDUzZGIzN2M1ZWQyM2VlZmMxMmI/

That's not Cerber3 but Cerber 4.0 / 5.0 you are SOL. Best thing is to use a backup image and re-install from there.