I am trying to explain what happened and asking what could be done after being infected
Yesterday a client called and told me something strange happened to his server and most of the file types are change to "CRYPTED!" and the extension of the file was changed to something like "(.xcvo0n)".



I am truly sorry to inform you that all your important files are crypted.
Atention! I do not offer for free the decrypt key's, for that you have to pay x.xx BITCOIN.

You can get bitcoin very easy on this site: www.xyz.com
You have to create an account and to buy x.xx BITCOIN from a seller located in your city.
Then you have to send the amount at this BTC adress: abcadsdfsdfsfsdfsdf
After that, contact me at this email adress: [email protected]
With this subject: acv23-123123

After the payment you will receive the key's to decrypt your files and a tutorial

Here is another list where you can buy bitcoin:

It was easy to guess, he was the victim of "Ransomware".

After a deep looking at his server I find out that:

  1. There was an AV but that AV had no Anti Ransomware module.
  2. The server OS was Windows server 2016 and was up to date and patched and the windows Defender was enabled.
  3. There was some old backup from DB and source-codes.

The data is unique and valuable and he had to do something to save his ***.

  1. Pay the Ransome!
    But as Norton mentioned in the first tip in Ransomware – what can you do about it

Do not pay the ransom. It only encourages and funds these attackers. Even if the ransom is paid, there is no guarantee that you will be able to regain access to your files.

  1. Remove it!
    But How?
    Files are encrypted and the backups are not worth to restore.
    I could not find a practical solution to "how to recover ransomware encrypted files".
  2. Forget everything and start from scratch!


  • What are incident response and disaster recovery plan for facing ransomware in case we ware not reday and had no plan had no backup from DATA?
  • 4
    Step zero: Already have reliable backups. Step one: Never pay; you'll only encourage more attacks.
    – Ghedipunk
    Nov 26, 2019 at 5:46
  • 1
    @R1W: like I said, there are numerous questions about this topic (just follow the link I've posted to find more). Others are for example Getting files back by paying Ransomware, How to deal with encryption virus?, Can I decrypt files encrypted by Odin ransomware? ... In these question you'll also find links for more help, like The No More Ransom Project. Nov 26, 2019 at 6:15
  • 2
    Unfortunately, we are not a malware/ransomware removal site. We don't do tech support.
    – schroeder
    Nov 26, 2019 at 8:11
  • 1
    @R1W: In this case there is likely no "workaround" we can provide. If the ransomware is properly written then there simply is no way to recover the data unless you had a working recovery strategy implemented before (i.e. offline backup). That's the main point of ransomware - to give you no choice but to pay or to accept the loss. Nov 26, 2019 at 13:17
  • 1
    @R1W Your question is akin to "What steps can I do after a car accident to make my car not broken anymore?" - nothing.
    – user163495
    Nov 26, 2019 at 15:27

1 Answer 1


Probably nothing you can do

You may be able to find decryption software for this specific ransomware, but chances are slim.

All you can do is restore from a backup.

What if I don't have a backup?

That's your fault. Your files are lost. Ransomware is nothing new and the warning "The only effective defense against ransomware is a backup" has been out there for years.

See it as a very expensive lesson about the value of backup systems.


Not the answer you're looking for? Browse other questions tagged .