Windows 10: Problem while decryption of Files

Hi there,


I decrypted a few of the folders and files while in my last windows. But a few weeks earlier I reinstalled my Windows and now when I tried to decrypt my files I was unable to access them. Some error 80070771 keeps on prompting. Can anyone help me out so I may able to regain the access to my files.

:)

 

How to Decrypt *.cerber3 files?

AFAIK it's still not possible to decrypt your files for free...

In addition to what has been mentioned in the prior posts, you might want to read this:

https://www.bleepingcomputer.com/news/security/cerber-ransomware-switches-to-cerber3-extension-for-encrypted-files/

And I strongly suggest to read/do:

• How to remove ransomware the right way: A step-by-step guide
• The smartest way to stay unaffected by ransomware? Backup!

 

How to Decrypt *.cerber3 files?

Any files that are encrypted with Cerber Ransomware will be renamed with 10 random characters plus the
.cerber (i.e. 2C1OlcaXdF.cerber, Ku7dYlcvkj.cerber) or .cerber2 extension (see

here) appended to the end of the encrypted data filename and leave files (ransom notes) named DECRYPT MY FILES#.vbs, DECRYPT MY FILES#.txt, DECRYPT MY FILES#.html.

The newest variant of Cerber Ransomware will have a .cerber3 extension appended to the end of the encrypted data filename and leave files (ransom notes) named # HELP DECRYPT #.txt, # HELP DECRYPT #.html, and # HELP DECRYPT
#.url.

Trend Micro released a
Ransomware File Decryptor for victims of earlier Cerber infections but it has limitations...must be used on the infected machine, may take several hours to complete decryption, some files may be only partially decrypted.
However, victims of Cerber Ransomware have reported the decryption tool does not work on cerber3 encrypted files.

In cases where a decryption tool does not work and you do not plan on paying the ransom, the only other alternative is to
backup/save your data as is and wait for a possible breakthrough...meaning, what seems like an impossibility at the moment (decryption of your data), there is always hope someday there may be a potential solution so save the encrypted data
and wait until that time. Imaging the drive backs up everything related to the infection including encrypted files, ransom notes and registry entries containing possible information which may be needed if a solution is ever discovered.

There is an ongoing discussion in this topic where you can ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

• Cerber Ransomware Support Topic - #DECRYPT MY FILES#.vbs, .txt, .html

 

Cannot decrypt folder but files and sub-folders contained do decrypt

Hi Paola,

Thank you for your interest in this problem.

• Which encryption software did you use to encrypt the files?
  
  All of the encryption done was using EFS in Windows 10 Pro.
  
• How did you encrypt the files?
  
  The files were encrypted by selecting a folder in File Explorer then right clicking to choose Properties, pressing the Advanced button to the Advanced Attributes screen then checking the box: "Encrypt contents to secure data." Then pressing “OK”
  back to Properties, “OK” again to the Confirm Attribute Changes, select "Apply changes to this folder, subfolders and files," and OK once more. The encryption then proceeds and all subfolders and files are encrypted. The files were then decrypted by much
  the same process but rather unselecting the "Encrypt contents to secure data" box. This decrypted all the contained files, but the folder and all subfolders remained encrypted. After this the contained files could not again be encrypted by encrypting the
  folder because the "Encrypt contents to secure data" box for the folder was already checked.
  
• How are you able to verify that the files inside the encrypted folders were already decrypted?
  
  By selecting a file and again choosing Properties / Advanced to observe whether the box: "Encrypt contents to secure data" was or was not checked.