Windows 10: Encypted files can not be decrypted

Hello My Folder has this look on it. https://prnt.sc/JZxqoaEyjidQ When I go right click > properties > general advanced > the folder is not encrypted > https://prnt.sc/_yXuaelUx07d But hen I try to open some of my Excel files, images or Word documents this is what errors I getExcel Photo 2Images Photo 3Word Photo 4When I try to decrypt some of this files where I get the errors, this is what it says to me Photo 4please help

:)

 

How to Decrypt *.cerber3 files?

AFAIK it's still not possible to decrypt your files for free...

In addition to what has been mentioned in the prior posts, you might want to read this:

https://www.bleepingcomputer.com/news/security/cerber-ransomware-switches-to-cerber3-extension-for-encrypted-files/

And I strongly suggest to read/do:

• How to remove ransomware the right way: A step-by-step guide
• The smartest way to stay unaffected by ransomware? Backup!

 

Corrupted Win10 Profile, and Can't Decrypt Files

Hey there, Andre:

Thank you very much for your quick response. I finally got a chance to try troubleshooting per your suggestions. Here's what I came up with.

I apologize if I wasn't clearer in my issue originally. The files themselves were never actually ON the same drive as the OS. THE OS was on drive C. My files were on drive F. However, I had somehow encrypted those files with my profile... and now that
profile is corrupted.

I tried the suggestions on that you linked, and these are my results:

• Option 1: Change File Ownership to "Personal" in the context menu results in following error:
  
  • An unexpected error is keeping you from applying properties to the file. IF you continue to receive this error, you can use the error code to search for help with this problem.
  • Error 0x80071771: The specified file could not be decrypted.

• Options 2 and 3: Decrypt Folder or File, (respectively), in Advanced Attributes:
  • Trying to remove encryption by deselecting the "Encrypt contents to secure data" checkbox in the Advanced Attributes window yields the following error:
    • An error occurred applying attributes to the file: F:\EXAMPLEFOLDER\EXAMPLEFILENAME: The specified file could not be decrypted.
• Options 4 and 5: Decrypting Folders and Files in Command Prompt, respectively:
  • When running cmd prompt in Admin mode, and executing the cipher /d and cipher /d/s: commands, the following error is thrown:
  • F:\EXAMPLEFOLDER\EXAMPLEFILENAME\: the system cannot find the path specified.0 file(s) [or directorie(s) were decrypted.
  • This is problematic, because I can click on the folders and files themselves from the windows GUI.
    

I still have the corrupted profile on my computer... is there a way to reach into it to extract the cipher?

Thank you so much for your help! (Didn't expect to take a crash-course in Windows security, but there we are, LOL).

Best,

Chris

 

File system decryption - cannot decrypt file

m:\Dat1\>cipher /d m:\Dat1\my.txt

Decrypting files in m:\Dat1\

my.txt [ERR]
my.txt: The specified file could not be decrypted.

0 file(s) [or directorie(s)] within 1 directorie(s) were decrypted.

m:\Dat1>cipher /c my.txt

Listing m:\Dat1\
New files added to this directory will not be encrypted.

E my.txt
Compatibility Level:
Windows XP/Server 2003
Users who can decrypt:
Certificate thumbprint: 5E65 6397 2032 D218 4C7C 054D C54D 9740 60D2 3268
No recovery certificate found.
Key information cannot be retrieved.
The specified file could not be decrypted.

The main questions:

1) IF I have in my Windows account imported certificate (Personal, pfx) having exactly SAME thumbprint - should Windows decrypt file?

2) If Windows has several EFS certificates installed - does it select certificate to decrypt file automatically?