Recommended Posts

Hello,

I am quite sure I have been infected by PClock2 or similar. Unfortunately I stopped the program during the encryption so no screen appeared to me. I only have a folder (in appdata roaming microsoft crypto) with en_files.txt and en_gfiles.txt which are the list of files being crypted. There were a file there called syspoz.exe which has been deleted by malawarebytes I guess, or by me (i can't recall now, sorry). The crypted files has no changed extension, but it is the same as before.

Unfortunately the decrypt_PClock2.exe doesn't want to decrypt because it says that pc is not infected by pclock.. but I am quite sure it is. is there any way to force the program to descrypt files anyway? I will sort a folder with few files to test if it works..

Thank you.

Best Regards

Davide

Share this post


Link to post
Share on other sites

Davide,

If the decryption tool is stating that no infection can be found then unfortunately the files cannot be decrypted.

Share this post


Link to post
Share on other sites
On 8/1/2017 at 0:14 AM, Kevin Zoll said:

Davide,

If the decryption tool is stating that no infection can be found then unfortunately the files cannot be decrypted.

Ok. Thanks anyway. I will keep following similar 3d found here below.

Share this post


Link to post
Share on other sites

There is always a possibility that the encryption scheme can be cracked or a flaw found that will permit decryption.  When or if that happens I cannot answer.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.