len4bfs 0 Report post Posted July 3, 2017 Hi, I have a laptop with files encrypted with cryptolocker and crypt0l0cker . The files all have the file name ending with .enc after the original file name, eg .docx.enc or .pdf.enc or .jpg.enc I cannot do system restore or use shadow copies. I have tried a lot of decryptors but none will work with .enc files. www.barkly.com identifies it as .CryptoHasYou. or Aw3s0m3Sc0t7 version of ransomware but no decryptor available. Please help me. I have submitted the ransom notes and some samples of .enc files. Thanks,len4bfs HOW_TO_RESTORE_FILES.txt yqabuqy.html P8100001.JPG.enc HP Laptop October 14.docx.enc Quote Share this post Link to post Share on other sites
Sarah W 25 Report post Posted July 3, 2017 Hi len4bfs, Unfortunately, crypt0l0cker is not decryptable for free. Some users have had luck with paying Dr Web to assist them with file decryption. Here is the updated policy from Dr.Web (11/25/15): Free file decryption assistance only for PCs protected by Dr.Web at the moment of infection. Quote ... free decryption services are only available for owners of active Dr.Web commercial licenses, the only amendment now being that the license must have been purchased before, not after the infection has been caused by encryption ransomware. If you're not a licensed user for a Dr.Web product you will have to pay for their services. How to submit a request to Doctor Web's support service Submit a request Let us know if you have any success. A good backup procedure is very important and well worth the investment, especially make sure not to keep the backup attached to the system unless you are backing up (it is best to have two different backups). As a note, Emsisoft Anti-Malware would have prevented your system from being compromised and encrypted in the first place. So if you appreciate our support, why not do yourself and your files a favour and check our product out, and consider buying it. Regards, Sarah Quote Share this post Link to post Share on other sites
