0

My system, excel, rar and zip files are encrypted by Odin ransomware and my ethics never allow me to pay ransom to thieves.

  1. I tried recovery softwares but only recovered old deleted files - no solution to encrypted file.
  2. Restore points are also deleted by ransomeware and I have no system image to recover system restore points.
  3. I tried to create a decryption key but language in encryption is a mixture of Korean, Japnees & Chinees. So I failed to create a decryption key.
  4. Another solution is to wait for any antivirus organization to find a solution and provide decryption to Odin but I am not sure when that solution will be in the market.

Is there any solution to decrypt or recover my files?

  • 2
    No backups or restore points, then you're out of luck, sadly. Pay, or wait for some sort of decryption tool (when/if that happens). – INV3NT3D Oct 5 '16 at 13:13
  • how can i contact attacker because file for contact available. – Khan Oct 5 '16 at 15:01
  • If they haven't listed contact information on any of the documents they provided you, then you will not be able to contact them. I am sorry Khan, it might be time to approach your superiors about the situation. – INV3NT3D Oct 5 '16 at 15:09
4

You won't be able to get your files back by any trivial means, sadly. You may be able to remove the ransomware itself, but you will not be able to retrieve your files without paying the ransom, for now, regardless of the language it was written in. The method used to encrypt these files makes them effectively useless unless you have the private keys, which they definitely won't give you, and you definitely won't guess. For anyone who is curious, Odin uses RSA-2048 bit and AES-128 bit ciphers.

Eventually, as you mentioned, there may be some sort of decryption tool for this strain of ransomware. Companies like Kaspersky and Sophos have already released tools for older varieties of ransomware. But until the time when a tool exists for this version of Odin specifically, you do not have many options.

Cold storage/offline backups are the best method for dealing with ransomware right now after the fact. Not to kick you while you're down, but avoiding malicious links, untrusted websites and downloads is the best way to avoid ransomware. Although I'm sure you've learned this lesson by now.

If you are on windows you could always try something like ShadowExplorer, you may have file backups you weren't aware of (hopefully).

The long and short of it is, your files are stuck in limbo until you pay for the decryption key, magically locate backups, or a method for decrypting this strain of ransomware becomes available, if it ever becomes available.

  • Thanks INV3NT3D for your brief & Concise reply but i looking for some solution or some decryption technique to revert my File back to original form / format – Khan Oct 5 '16 at 14:39
  • 1
    @Khan No problem at all. As I said, though, there is no solution currently. I am sorry your job is at risk. Also, if your computer is on a corporate/SOHO network, please disconnect it immediately. If it is a single file you need, some variants of ransomware allow the decryption of a single file as a "show of good faith". Outside of that, sadly, you're stuck – INV3NT3D Oct 5 '16 at 14:44
2

https://www.nomoreransom.org/index.html

This is from Dutch Police and Europol, try them and hope you can recover your files.

  • Normally, link-only answers are discouraged, but given this particular answer, it makes sense. – schroeder Oct 11 '16 at 19:45
1

First of all you need to be sure what virus you have and it's version. Go to - id-ransomware.malwarehunterteam.com and upload your files.

Once you have an answer, go to Bleeping Computer forum's section dedicated to your specific ransomware - http://www.bleepingcomputer.com/forums/f/239/ransomware-help-tech-support/

There are a lot of malware experts that are on the edge of recent ransomware news.

If decryptor is available - they will help you (free of charge) If decryptor is not available - you just have to wait and be sure - they will notify you of the progress.

There are lot of sites with removal guides like - http://myspybot.com/odin-virus/ they often promise gerat results but those tips don't work.

There are even cases when solid tech support companies that say they can help with ransomware - they charge you 1000 usd for help and go pay 500 usd to hackers for decrypting files and then have 500 in profit :)

0

You CAN try several methods to recover your files without paying a ransom. The first one is related to Windows Previous Versions feature that allows recovering separate files. However, this thing works only if you had System Restore activated on your computer. Next, you can use Shadow Explorer that recovers files with the help of volume shadow copies or Data Recovery Pro that is the paid one but will cost you 20 euros or less. All these options are clearly explained in this guide: http://www.2-spyware.com/remove-odin-ransomware-virus.html If you decide to use any of them, make sure you follow every step in an exact order!!

  • Please disclose your relationship with the links you provide. The link is to your own site. – schroeder Jul 3 '17 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.