sasha07 0 Report post Posted June 25 Hello Emsisoft team, My PC recently got infected by .Moba ransomware and i have deleted the virus but ALL of my files being encrypted. Is there possible way to decrypt it with decryptor tools or something else to restore my files? *Error: Unable to decrypt file with ID: qp2fsC4LLuGAT7ke4j1JaMbzd7pTwmwXWay6661d* please help me Quote Share this post Link to post Share on other sites
sasha07 0 Report post Posted June 26 13 hours ago, sasha07 said: Hello Emsisoft team, My PC recently got infected by .Moba ransomware and i have deleted the virus but ALL of my files being encrypted. Is there possible way to decrypt it with decryptor tools or something else to restore my files? *Error: Unable to decrypt file with ID: qp2fsC4LLuGAT7ke4j1JaMbzd7pTwmwXWay6661d* please help me I FOUND A SOLUTION. Sorry my english is bad. The only thing that work for me are the following steps. 1 we must go to %temp% and delete everything in here. 2 I've download an antimalware (to delete the virus) , I dont remember the name but it's an program with a blue M. This help a lot cause after the analyze i found 32 files with the virus. And of course I delete everything 3 after that the only problem left are the encrypted files. Honestly I didn't find a way to desencrypt them, BUT lucky me I was able to make a recovery of them. Go to a file, delete *.moba* in the name,after that. Right click / properties/ latest version. And if u have a little bit o luck it might be a point in the past. My example. Today is 26/06 .My file can go back to 9/06. So, i restore every file with this... NOT EVERYTHING, but worst is nothing. Sorry again my English is terrible, I hope i really help someone Quote Share this post Link to post Share on other sites
GT500 823 Report post Posted June 26 1 hour ago, sasha07 said: Go to a file, delete *.moba* in the name,after that. Right click / properties/ latest version. Usually that doesn't work, as most ransomwares will delete shadow copies (which is where old versions of files are stored). Note that there is more information at the following link, including a way to recover some video files:https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ Quote Share this post Link to post Share on other sites
