Allen M 0 Report post Posted August 3, 2017 I'm attempting to use decrypt_GloveImposter to recover family photos and personal records saved on an external hard drive. Everything was renamed to a .726 file extension. I've already formatted the computer and reinstalled windows to ensure the virus was removed. I have the decrypt_GlobeImposter.exe tool as well as several files that were encrypted and some backups I had in Dropbox. On my fresh copy of windows, if I try to put the encrypted and backup file on top of the decrypt_GlobeImposter.exe as instructed, I just get "The Decrypter could not determine a valid key for your system..." Error message: https://www.dropbox.com/s/1bn9ldn7efxxala/Screenshot 2017-08-03 00.55.49.png?dl=0 Did I make a mistake by formatting the system or is there still some way to recover my files? Folder with encrypted and unencrypted files. https://www.dropbox.com/sh/8vzo6ddjcu8cdd5/AABRl98UCn5ckG4gr6z2wQ5sa?dl=0 Encrypted file: https://www.dropbox.com/s/tw8go1pg6u8lrh8/Admin 0301_1509.html..726?dl=0 Original file: https://www.dropbox.com/s/ql4m7owrbbnksi5/Admin 0301_1509.html?dl=0 Any help would be appreciated! Thanks, Allen Download Image Admin 0301_1509.html Admin 0301_1509.html..726 Quote Share this post Link to post Share on other sites
Melissa P 1 Report post Posted August 3, 2017 I am having the same issue with the decrypt_GlobeImposter tool trying to repair my encrypted files with the ..726 extension. I have not done a total reformat of my system yet but have cleaned it and removed the trojan. Any help would be greatly appreciated. 1 Quote Share this post Link to post Share on other sites
G.R. 0 Report post Posted August 3, 2017 The tool is designed to work with .crypt files, and won't see anything with .726 extensions. I guess you could try renaming the .726 files to .crypt, but it would be nice if there was an updated tool for this soon. Quote Share this post Link to post Share on other sites
Константин 0 Report post Posted August 4, 2017 Please tell somebody of staff guys, what is estimated time to get here an easy ..726 version decryptor, without renaming? or after key finding its catching all ..726 files automatically.... Quote Share this post Link to post Share on other sites
Henkles 0 Report post Posted August 4, 2017 I've been hit with the 726 extensions. Any help would be very appreciated. I tried running the tool and it fails (same error as above) I changed the extension to .crypt and it still failed. Please help!! Quote Share this post Link to post Share on other sites
Allen M 0 Report post Posted August 4, 2017 Renaming the files to .crypt will start the decrypter, but this tool only works with GlobeImposter v1. Apparently they still don't have a way to unlock v2 yet. Quote Share this post Link to post Share on other sites
Fabian Wosar 390 Report post Posted August 4, 2017 There is, unfortunately, no known way to decrypt files encrypted by GlobeImposter2 that doesn't involve the cooperation of the ransomware authors. Sorry, but you will have to restore your latest backups. Quote Share this post Link to post Share on other sites
rookieplayer 0 Report post Posted August 5, 2017 please see here: https://www.bleepingcomputer.com/forums/t/644166/globeimposter-crypt-pscrypt-ext-back-fileshtml-ransomware-support/?p=4303056 I have uploaded sample encrypted and decrypted files hope someone comes up with a tool to decrypt it. thanks Quote Share this post Link to post Share on other sites
