Btcware

[Theamoebson 0]

Hi. Firstly thanks for creating this forum... A ray of hope. OK so I have a Btcware infection with all files changed to '. Btcware' does anyone know if a decrypter will become available for this? I am tempted to pay up and hope for the key but I would absolutely hate to do that. I have searched this forum and this seems to be a new one I think... 

[Sarah W 26]

Hi Theamoebson,

BTCWare is unfortunately not decryptable. You can either backup your files and wait for a solution, or pay the criminals (we do not recommend this) currently.

RDP is how these criminals usually enter, so please secure it with a strong password.

Regards,

Sarah 

[Theamoebson 0]

Thanks for your reply Sarah. Do you mean that it will never by decrypterable or just currently? 

[Sarah W 26]

Hi Theamoebson,

Well, the keys may be recovered or leaked later on, but you may be waiting a long time. The encryption is secure though, unfortunately.

Regards,

Sarah

[Demonslay335 25]

@Theamoebson

Do you still have some encrypted files, and their originals that we can take a look at? We might be able to help with this ransomware now. We do need a sample of the malware if you can find it.

[Theamoebson 0]

Hi

Sorry for the very late reply - I had rather given up on this...There seems to be a few decypters now available but on certain .DOCX files the restored versions are corrupted. Any ideas?

[Demonslay335 25]

No-one has released a decrypter for the original ".btcware" extension without an email address, but we're still working on it. I still need the files from you that I requested.