0

Recently the virus called Ransomeware affected my system and changed my database file extenstion from .mdf to .mdf.ziptox1 and showing as files are encrypted

Now I am not able to run the database, even If I rename back to .mdf. Then I bought Systools SQL Recovery and tried with renamed .mdf file. No luck, its not showing all data and seems like data deleted/corrupted.

The virus is asking me to email and pay for recovery. However, I don't want to do such activity.

ATTENTION !
All Your Files Was Encrypted !
E-mail addresses: Martezon@india.com

Is there any way to retrieve data?

  • 2
    Check out nomoreransom.org. If they cannot help then there is probably no way to get the files back. That's one of the reasons one should have recent backups. – Steffen Ullrich Jan 13 '17 at 20:45
  • @SteffenUllrich Thanks a lot. As of now no solution found it seems. But looks very useful link – Developer Jan 13 '17 at 20:54
  • 1
    Offline and/or versioned backups are the best defence against ransomware attacks. Clean the virus out or nuke from orbit then restore. Never pay the ransom, the attackers don't always release the data, they sometimes leave a followup malware that activates a few months later and you would often be supporting other criminal activities too. – Julian Knight Jan 13 '17 at 21:58
  • It's been broken, but it seems like nomoreransom hasn't included it yet... – J.A.K. Jan 14 '17 at 0:49
1

Ransomware can prove deadly if a proper backup system is not in place.

Corporations are starting to find out the real cost of having a poorly designed, or no back up system in place. A good backup system can stop ransomware right in its tracks.

Ransomware encrypts files, effectively scrambling them unless the correct encryption key is applied. This key can be determined, but requires extensive study that many organizations do not have time/money for. In countless cases, organizations have just paid for the key due to this reason. If you do in fact get a key after payment is entirely up to the unknown entity.

What I suggest to do:

Determine if the file was overwritten or simply copied, encrypted then the original deleted. Deleted files can be recovered, and depending on how the ransomware was designed, you can recover your original files.

0

Judging by the "ziptox1" extention, this is a recent version of Purge, aka Globe ransomware. Luckily, the key generation is predictable, and it has been cracked.

To fix, you will need an encrypted file, and the decrypted version. Doesn't matter what file, could be the (publicly available) sample pictures of windows. They have to be at least 65KB. Because the encryption is a stream cypher (RC4), the filesizes of the two will match exactly.

Globe3 decryptor

or

Globe2 decryptor.

Drag and drop the pair of files into the tool, and voila.

  • These tools have never really made sense to me. If I had an non-encrypted version, I should have a proper backup system in place to pull the file from. Why not just pull all of the files from a backup then? – dark_st3alth Jan 14 '17 at 3:36
  • 1
    That's a false dichotomy. Like i said, even if you have no backup, the unencrypted version of some files is publicly available... this can save someone with no full backup. – J.A.K. Jan 14 '17 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.