Spandan

Decryptor provided not working on any other files other than those of emsisoft for paradise (.fc) ransomware

Recommended Posts

My files were encrypted with .fc extension for which i downloaded the decryptor provided here and even found key. But only those files related to emsisoft were decrypted and others showed message : file not supported, wrong file marker

bangalore0a2.zip_Support_{9AUjMs}.FC 0046 Jagarnath.jpg_Support_{9AUjMs}.FC 210153.pdf_Support_{9AUjMs}.FC ---==%$$$OPEN_ME_UP$$$==---.txt

log.txt

Edited by Spandan
few files attached and couldnot attach files a bit larger showed error -200

Share this post


Link to post
Share on other sites

Attach a ransom note and several encrypted files with .fc extension to your message. 

Share this post


Link to post
Share on other sites

attached a few files and the ransom note but could not attach a backup file which i really wanted since all of em are corrupted but its showing error... Attaching a log file too

Share this post


Link to post
Share on other sites

Now even my boot files are corrupted  and I can't open my laptop unless its in safe mode... Else it keeps rebooting in a loop

Share this post


Link to post
Share on other sites
On 5/5/2020 at 5:38 AM, Spandan said:

attached a few files and the ransom note but could not attach a backup file which i really wanted since all of em are corrupted but its showing error... Attaching a log file too

I've forwarded the files you've attached to our malware analysts for them to review.

Share this post


Link to post
Share on other sites

I've been told that the issue is more than likely that the files you're trying to decrypt were encrypted with a different key than the files you are trying to use as your file pair. We won't be able to know for certain unless you send us the files you used as your file pair.

Share this post


Link to post
Share on other sites

It is there... The 0046 one is the file i used as the pair but the original one is also encrypted now... Nearly 95% of my files are now done with... What can i do now

Share this post


Link to post
Share on other sites

Ok so now i am able to turn it on in normal mode and new files are no longer encrypted. I just need to recover a few really important documents  else everything is perfect. And here are the logs of frst. Thanks a lot for help guys... just need the key now

Addition.txt FRST.txt Shortcut.txt

Share this post


Link to post
Share on other sites

Are you still able to find a file pair to use with the decrypter?

Share this post


Link to post
Share on other sites

Do you have any encrypted files that you had copied to external hard drives, CD's or DVD's, sent via e-mail, or downloaded from an online source that you could download again?

Share this post


Link to post
Share on other sites

I've forwarded your file pair and log to our ransomware decrypter developer so that he can take a look at it.

  • Upvote 1

Share this post


Link to post
Share on other sites

The issue appears to be that your files weren't all encrypted by the same key. Based on what you've sent us thus far, it looks like your files were encrypted with at least three different keys. Fortunately different keys are used on different files, so you should be able to decrypt your files, it's just going to take a lot more time than normal.

Go ahead and try a file pair, run the decrypter, and see what it decrypts. After than, find another file pair to try (something that wasn't decrypted), and use it with the decrypter and see what it decrypts, then try that over and over again until you've managed to decrypt everything.

  • Upvote 1

Share this post


Link to post
Share on other sites

I will do that but is it possible for you to send me the keys since i am not sure whether i will find so many paired files

 

Share this post


Link to post
Share on other sites

We only have the information you've sent us thus far, and we wouldn't have keys for anything you've not tried file pairs for yet.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.