Windows 10: New ransomware lets you decrypt your files — by infecting other users

Just when you thought ransomware couldn't get any nastier *Shock

New ransomware lets you decrypt your files — by infecting other users | ZDNet

:)

 

How to Decrypt *.cerber3 files?

Any files that are encrypted with Cerber Ransomware will be renamed with 10 random characters plus the
.cerber (i.e. 2C1OlcaXdF.cerber, Ku7dYlcvkj.cerber) or .cerber2 extension (see

here) appended to the end of the encrypted data filename and leave files (ransom notes) named DECRYPT MY FILES#.vbs, DECRYPT MY FILES#.txt, DECRYPT MY FILES#.html.

The newest variant of Cerber Ransomware will have a .cerber3 extension appended to the end of the encrypted data filename and leave files (ransom notes) named # HELP DECRYPT #.txt, # HELP DECRYPT #.html, and # HELP DECRYPT
#.url.

Trend Micro released a
Ransomware File Decryptor for victims of earlier Cerber infections but it has limitations...must be used on the infected machine, may take several hours to complete decryption, some files may be only partially decrypted.
However, victims of Cerber Ransomware have reported the decryption tool does not work on cerber3 encrypted files.

In cases where a decryption tool does not work and you do not plan on paying the ransom, the only other alternative is to
backup/save your data as is and wait for a possible breakthrough...meaning, what seems like an impossibility at the moment (decryption of your data), there is always hope someday there may be a potential solution so save the encrypted data
and wait until that time. Imaging the drive backs up everything related to the infection including encrypted files, ransom notes and registry entries containing possible information which may be needed if a solution is ever discovered.

There is an ongoing discussion in this topic where you can ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

• Cerber Ransomware Support Topic - #DECRYPT MY FILES#.vbs, .txt, .html

 

How crypto ransomware spreads... is it decryptable...should I pay the ransom

The
master decryption keys and decryptor for all variants of CrySiS ransomware have been released and Kaspersky's

Rakhni Decryptor was updated (v1.17.8.0) to decrypt files encrypted by this infection.

 

Could be used by some embittered Facebook, or other social media site member seeking vengeance, having been humiliated on line.

 

So set up a couple VMs and infect them; get your stuff back for free; kill the VMs. *Wink

 

Doesn't work like this, unfortunately *Sad Only after they get paid, they give keys to decrypt...
Sick busters *Mad

 

*Sad buggers

 

Tempting, so tempting....

<YES, I'm just kidding>

Seriously, this stuff gets worse by the day.
It really is an "arms race" with the criminals.

Sigh.