Windows 10: Initiative wants to help ransomware victims decrypt their files

Remember folks, having a backup/system image is still the best defense you can have for this kind of attack.

System Image - Create in Windows 10 - Windows 10 Forums

This initiative wants to help ransomware victims decrypt their files for free

This initiative wants to help ransomware victims decrypt their files for free | ZDNet

The No More Ransom Project

:)

 

Zepto ransonware

Those appear to be the instructions provided by the malware creator for victims who are willing to pay the ransom. If you are having problems with the instructions, you may want to ask other victims who have already successfully gone through that process.
There is an ongoing discussion in this
topic where you can ask repost the above information. Other victims have been directed there to share information, experiences and suggestions.

Some ransomware victims have reported they paid the ransom and were successful in decrypting their data. Other victims reported they paid the ransom but the cyber criminals did not provide a key to decrypt the files, while others reported the key and decryption
software they received did not work or resulted in errors. Keep this in mind if you are considering paying the ransom since there is no guarantee decryption will be successful.

 

How to Decrypt *.cerber3 files?

Any files that are encrypted with Cerber Ransomware will be renamed with 10 random characters plus the
.cerber (i.e. 2C1OlcaXdF.cerber, Ku7dYlcvkj.cerber) or .cerber2 extension (see

here) appended to the end of the encrypted data filename and leave files (ransom notes) named DECRYPT MY FILES#.vbs, DECRYPT MY FILES#.txt, DECRYPT MY FILES#.html.

The newest variant of Cerber Ransomware will have a .cerber3 extension appended to the end of the encrypted data filename and leave files (ransom notes) named # HELP DECRYPT #.txt, # HELP DECRYPT #.html, and # HELP DECRYPT
#.url.

Trend Micro released a
Ransomware File Decryptor for victims of earlier Cerber infections but it has limitations...must be used on the infected machine, may take several hours to complete decryption, some files may be only partially decrypted.
However, victims of Cerber Ransomware have reported the decryption tool does not work on cerber3 encrypted files.

In cases where a decryption tool does not work and you do not plan on paying the ransom, the only other alternative is to
backup/save your data as is and wait for a possible breakthrough...meaning, what seems like an impossibility at the moment (decryption of your data), there is always hope someday there may be a potential solution so save the encrypted data
and wait until that time. Imaging the drive backs up everything related to the infection including encrypted files, ransom notes and registry entries containing possible information which may be needed if a solution is ever discovered.

There is an ongoing discussion in this topic where you can ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

• Cerber Ransomware Support Topic - #DECRYPT MY FILES#.vbs, .txt, .html

 

I was looking at that website the other day. It it very nice and has got a lot of useful information.

 

Good site, thank you for the info even though I haven't fallen victim to a cryto locker yet. And because I regularly backup my data I highly doubt I'll ever become a victim. But I know a lot of people who should absolutely visit that site *Wink