Rhino

Member
  • Content Count

    1
  • Joined

  • Last visited

Community Reputation

0 Neutral

About Rhino

  • Rank
    New Member
  1. Hi, Thank you for the great work you're doing. My laptop was hit by the MILYB ransomeware on January 27th while entering a super-legitimate website via the Chrome-font.exe download. I noticed the damage the next day. In my machine there are a lot of files which are named in Hebrew. In every directory were the virus "visited", the vast majority of the files were encrypted, however only those with files-names in English got the MERRY addition. The Hebrew-named were encrypted, but with no rename. I downloaded and operated the very recent version of your Decrypter and successfully decrypted English-named files with Merry extensions, however the decrypter ignored all the Hebrew-named files (I guess because the decrypter is primarily looking for the MERRY extension). The decrypter worked on those files only if I manually added the Merry extension. My questions: Since I have hundred of such files which are encrypted with no MERRY extension, is there a way to make the Decrypter work on them (without renaming them one by one, which is not realistic)? Alternatively, is there a way to add this extension to a mass of files? Assuming there is a way, in the case the extension is added to a file that was Not encrypted, will the decrypter identify it as encrypted an attempt to "decrypt' it? Will such a "decryption" process damage (the unencrypted yet marked) file? In addition, I have a comment about the Decrypter (1.0.0.45) - it took me a while to find a pair of files as input for the decrypter that actually resulted success in decryption of all other files. In many cases after loading the sample file (Docx, Png, Jpg etc.), the decrypter failed to fix any other files except the original source. Eventually I loaded a pair of Pptx files the proved to be a "good source" for decrypting other files. Thanks!!