Leaderboard


Popular Content

Showing content with the highest reputation since 06/09/20 in all areas

  1. 2 points
    In theory it's possible. If private keys are released that be can use to decrypt files, or if someone finds a vulnerability in the way the ransomware encrypts files.
  2. 2 points
    This information may help specialists. I have added even more samples on my article. We will try to analyze all incoming samples in the hope that something will change. You need to collect all encrypted files. If decryption becomes possible, information will be published and you will receive a message from support specialists. A rare specialist works on weekends. I work daily, but unfortunately my strength and desire to help you is not enough to decrypt.
  3. 2 points
    In the sample, that encrypts files with the .avdn extension, there is no code from the real MedusaLocker Ransomware. There is a small piece of code in the another sample that adds a 'random' extension to encrypted files, but this piece is not base. He is well defined by antivirus engines as Avaddon Ransomware.
  4. 2 points
    DrWeb support usually do not use international names of ransomware.
  5. 2 points
    Results of checking your files: https://id-ransomware.malwarehunterteam.com/identify.php?case=9da99e33569fe0af64a43b520f35bababd09ad3c https://id-ransomware.malwarehunterteam.com/identify.php?case=2e2e29f85fe2918c33683e2faeade22e51cf81ec https://id-ransomware.malwarehunterteam.com/identify.php?case=2f1a3356c8705f995285ab41e9456bc61f11d20e
  6. 2 points
    Hello. Information was sent to virus monitoring team, please, wait for reply. I received such a message from Dr.Web specialists. They are working on decryption.
  7. 2 points
    This is the general all decryptors page from Emsisoft. There is no decryptor for files encrypted by this ransomware yet. https://www.emsisoft.com/ransomware-decryption-tools/free-download
  8. 2 points
    I must say more precisely -> You trust Emsisoft Personally, I only help a little to unmask the ransomware.
  9. 2 points
    The ransomware doesn't need to put important information on the same hard drive/partition as the files it encrypted. This is why I recommend waiting to reinstall Windows.
  10. 2 points
    Don't reinstall Windows until we know for certain what is needed to decrypt files. If there is something other than what's contained in the encrypted files and the ransom notes that's necessary for decryption, then you could wipe that out by reinstalling Windows, thus making it impossible to decrypt your files. For now just rely on Anti-Virus software to clean up the system. If you're not certain if it's clean, then let us know, and we can assist you.
  11. 2 points
    Specialists of several companies (Emsisoft, DrWeb) are working on decryption of files that are encrypted by Avaddon. There are currently no decryptors and successful decryption methods without paying a pay for ransom.
  12. 2 points
    I am waiting for the verification results. I have provided samples of files and malware, it remains to wait and hope. It is worse when they immediately say that "decoding by our forces is impossible."
  13. 2 points
    My WSC does not recognise EAM either. Recommending that we should "uninstall EAM, restart the PC twice, and then reinstall EAM", on top of having to constantly disable and re-enable EAM components to deal with the still unfixed issue of excessive CPU usage, is uncceptable for a piece of software that is not exactly cheap.
  14. 1 point
    The problem is solved! I got my files back. You are amazing!!!!
  15. 1 point
    Sir, is there any possibility that the decrypter will be maked in the future?
  16. 1 point
    Our analysts believe the ransomware is secure, and that we will not be able to make a decrypter for it.
  17. 1 point
    It's impossible to include a key we don't have. This is a newer variant of STOP/Djvu. Fortunately your ID is an offline ID, however we don't yet have the private key for it. I recommend running the decrypter once every week or two so that you can see when we've been able to add the private key for your variant. There is more information at the following link: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/
  18. 1 point
    I have already looked through a lot of files. I have no way to decrypt them. Extortionists has changed encryption. You need to send to Dr Web files. They will let you know when files can be decrypted. It may happen in the future. They re-open the ticket and report by email. It is important not to drop email. There will be no other means of communication.
  19. 1 point
    12 days have passed since I sent the files and samples. No news yet. I check e-mail every day.
  20. 1 point
    Is this what you are talking about? If it is then that is because you are using Windows 10 and it doesn't need to say Windows 10. All program installers (not just EEK) look like that.
  21. 1 point
    It's possible your files were encrypted by one ransomware, and then encrypted by another as well. We wouldn't be able to tell for certain without seeing an encrypted file and a copy of the ransom note.
  22. 1 point
    I don't think it does, however please note that it isn't possible for an application or script to modify the HOSTS file unless it has administrator rights, and you should never allow an application you do not trust to run with administrator rights.
  23. 1 point
    Necessary requirements are indicated on the page https://legal.drweb.com/encoder/?lng=en and in the form of sending files, they can be attached to the message. For different decryption, different elements may be needed. File pairs may not be needed if there is an encoder file that was found. But what will happen in each case, I do not know. You can try to send only encrypted files and a note with ID. The encoder name in the DrWeb database is Trojan.DownLoader33.50335, Trojan.DownLoader33.59028 SHA-256: 05af0cf40590aef24b28fa04c6b4998b7ab3b7f26e60c507adb84f3d837778f2 SHA-256: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6 But you can only specify a link to the article. It has both earlier and newer Avaddon Ransomware samples.
  24. 1 point
    You'll have to wait for @Amigo-A as I have no contacts at Dr. Web.
  25. 1 point
    More than likely not. There are too many threads about this ransomware to keep track of, or to be able to reply to all of them. Our recommendation is to keep an eye on BleepingComputer's newsfeed, as they will usually report on new developments with ransomware decrypters: https://www.bleepingcomputer.com/ If you have an RSS feed reader, then they also have an RSS feed so that you don't have to manually check for news: https://www.bleepingcomputer.com/feed/
  26. 1 point
    For reference: Previously, this method was still in CryptoMix Ransomware and some other ransomware. In the same way, it was possible to decrypt files encrypted offline with keys if the PC was disconnected from the Internet or the ransomware server was inaccessible.
  27. 1 point
    For you it may "little",but for us your and emsisoft's service always biggest. And sir please,can you react to my previous questions? Please sir I'm expecting your answer.
  28. 1 point
    Ok thank you sir. I always trust you.and I'm waiting only for your AVADDON decrypter.I never trust them. Please consider my request. Shall I reinstall windows or not? because till AVADDON affect my pc,I used windows 7 professional.now it has expired and no secure.so I'm going to upgrade to 10. Are there any problems to my important ransomware affected files by upgrade my windows?. Please sir ...answer. Should I keep those files in same pc with same windows or can I move them to another disk?
  29. 1 point
    I did not have time to add this yesterday. Avaddon ransomware and its operators do not care about decrypting files after paying the ransom. Most likely, they will receive a day and hide. This has already happened to those who paid the ransom. They received neither a decryptor nor a feedback. The page that should automatically propose this turned out to be inoperative - error 404. This may be a temporary technical problem, but any such incident means that the extortionist will spit about your files. They need money, money, and again money. Be careful! Do not let yourself be fooled!
  30. 1 point
    It's a long story. All versions of the Windows need comprehensive antiviral/antimalware protection. There is not one Windows that would defend itself without outside help.
  31. 1 point
    Thanks a lot for your great help sir. You are one of the true AVENGERS who save the real world from ransomware and malware. I use your Antivirus sir. And please I kindly request you to create 100% successful way to decrypt avddon infected files. There are many important files there.i spent a lot of time to create them.but in a few seconds that ransomware has spoiled my works. Please sir please...I'm waiting for your answer.
  32. 1 point
    The information about the encryption used can be found at the following link: https://translate.google.com/translate?hl=en&sl=ru&tl=en&u=https%3A%2F%2Fid-ransomware.blogspot.ru%2F2016%2F11%2Fdharma-ransomware.html It's secure encryption, and there's no way to crack it. If you were able to get a memory dump from the ransomware while it was encrypting files, then in more than likely wouldn't help. RSA keys use a public key to encrypt, and a private key to decrypt. The private key is kept safely in a remote server while the ransomware uses the public key to encrypt files, and there's nothing you can learn from the public key that would help with decryption of files. I would believe the keys are generated securely, and if they were generated on a remote server then you could never be entirely certain what time they were generated, and so even if there was the possibility of a time-based RNG exploit then you wouldn't be able to do anything with it. They won't get powerful enough fast enough. The odds are much better of law enforcement catching the criminals and confiscating their database of private keys. We don't normally recommend that, however if you feel that's the only way to get your files back in a reasonable amount of time then we understand that you have to do what you feel is best.
  33. 1 point
    Every software company goes through occasional periods where their software has bugs. We understand it's frustrating, but we had to make a lot of changes to Windows Security Center integration to meet Microsoft requirements going forward, and with changes like that it's not abnormal for there to be at least a few bugs. Keep in mind as well that problems with Anti-Virus registration with the Windows Security Center aren't uncommon regardless of whose Anti-Virus you're talking about. Microsoft API's aren't always bug-free either.
  34. 1 point
    Dear Amigo-A, Thanks for your response Okay then I'll be waiting for the positive result. Hope it'll help to restore my files soon *finger crossed* ☺️ Btw can you tell me how long does it take for the decryption specialist figured out to decrypt avdn files? because i urgently needed my files Thank you so much for your help
  35. 1 point
    Apparently, the files were encrypted by Phobos Ransomware. You can check it yourself through the service ID Ransomware
  36. 1 point
  37. 1 point
    @Manoj Kumar The Emsisoft Decryptor was updated with the key for the .usam extension.
  38. 1 point
    Avaddon Ransomware uses the .avdn extension. Are you sure you have an .pvdn-extension? Attach several encrypted files and a note from the ransomware to the message. Most likely the note will be in html-format (for example, 567432-readme.html), so you need to put for it in the archive and only then attach it to the message. Otherwise, forum protection will distort this file and I will not find there what needs to be seen. Or send files to me using the site https://dropmefiles.com/
  39. 1 point
    This is a newer variant of STOP/Djvu. Fortunately your ID is an offline ID, however we don't yet have the private key for it. I recommend running the decrypter once every week or two so that you can see when we've been able to add the private key for your variant. There is more information at the following link: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/
  40. 1 point
    Encrypted files and a ransom notes from extortionists need to be saved, it is possible that the files can be decrypted in the future.
  41. 1 point
    If an EAM installation is not already in a workspace, then it can be easily added to one by downloading via the "Add device" button in your workspace's overview in MyEmsisoft. Downloads from MyEmsisoft should also already be linked to your account, and not require activation.
  42. 1 point
    We don't find them. They're donated by victims with offline ID's who have paid the ransom. That's why we can't know when we'll receive a private key for an offline ID.
  43. 1 point
    In 2020.6 we added a new service for handling reporting to the Windows Security Center. As for why exactly WSC isn't reading the status of EAM correctly, we're not certain if that's a bug on our side or Microsoft's (WSC has always been flaky). The only known fix for this issue right now is to uninstall EAM, restart the PC twice, and then reinstall EAM. We recommend downloading from MyEmsisoft if you already have an account, otherwise you can find alternate downloads at the link below: https://help.emsisoft.com/en/1597/download-installation/
  44. 1 point
    I'm not just asking for a date, because the file gets today's date when downloading it from a message. I set the encryption date in another way. It could be June 9th.
  45. 1 point
    @Cineatic Hier gibt es einen laufenden Thread dazu https://support.emsisoft.com/topic/33516-why/
  46. 1 point
    Any files with an ID that ends in t1 should be decryptable once someone donates the private key for the .nlah variant to us.
  47. 1 point
    There are no decrypters for this one yet. I've asked for more info, as last I've heard is a couple of weeks old. If one employee on one workstation managed to infect an entire network and get all of the company's files encrypted, then that's a major IT security failure on the part of the company. In some countries they could be held liable for that by regulatory authorities for failure to comply with information and network security regulations.
  48. 1 point
    I think those settings only apply to UWP apps (from the Microsoft Store). They run in an AppContainer, and their access to the system is restricted by more than just whether or not they have admin rights. EAM by contrast is a traditional Windows application, and doesn't run in an AppContainer.
  49. 1 point
    This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ This is an offline ID, however we don't yet have the private key for it. I recommend running the decrypter once every week or two so that you can see when we've been able to add the private key for your variant. There is more information at the following link: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ Google tarafından sağlanan çeviri: Bu bir çevrimdışı kimlik, ancak henüz özel bir anahtarımız yok. Varyantınız için özel anahtarı ne zaman ekleyebildiğimizi görebilmeniz için şifre çözücüyü haftada bir veya iki kez çalıştırmanızı öneririz. Aşağıdaki bağlantıda daha fazla bilgi var: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/
  50. 1 point
    Hello All! I return to the topic) Obviously, the problem was in the AdGuard WFP-driver. EAM has nothing to do with this situation! After changing the network settings in AdGuard, the problems with the tcpip.sys have not yet recurred! At least - a little over 10 days already😉
  • Newsletter

    Want to keep up to date with all our latest news and information?
    Sign Up