Ransomware is a kind of virus/malware that attacks computers and encrypts your data, making all your files inaccessible. After paying the “ransom,” hackers provide a means to decrypt the data and get back all your files.
We’ve performed dozens of ransomware recovery jobs in the past couple year (since they started to become widespread). Often, we are even able to decrypt and recover your data without paying the ransom.
Option 1: We determine if it’s possible for us to decrypt your files without paying the ransom. If so, you’ll pay our $300 fee (or $400 if your drive is larger than 2TB) + a $100 “encryption” fee.
Option 2: If we need to pay the ransom to decrypt the files, we’ll determine the total amount of ransom to be paid and let you know. If you want to continue (now knowing the cost of the ransom), you’ll pay us the ransom amount up-front/non-refundable. We’ll convert this to Bitcoin and pay it to the virus’ owner. They will (hopefully, and in all cases so far) provide a decryption tool that we’ll use to decrypt your data. Assuming we get back data you want, our standard $300 fee is due ($400 if the drive is over 2TB).
Most or all of your files will be unreadable (they will not open). Also, the file names or extensions of your files may be different (see the list below). You will also see “ransom letters” in the form of .html or .txt files in most of your folders. These are the files that provide the links to the Tor (darknet) sites that specify the ransom amount.
Some ransom viruses encrypt boot-up, so the computer cannot start at all. In these cases, you will know for sure you have Ransomware because the message will pop-up during boot-up (and Windows will be completely inaccessible).
.R5A, .R4A, .encrypt, .locky, .clf, .lock, .cerber, .crypt, .txt, .clf, .coverton, .enigma, .czvxce, .{CRYPTENDBLACKDC}, .scl, .crinf, .crjoker, .encrypted, .code, .CryptoTorLocker2015!, .ctbl, .html, .locked, .ha3, .cry, .crime, .btc, .kkk, .fun, .gws,
.keybtc@inbox_com, .kimcilware, .LeChiffre, .locky, oor., .magic, .fucked, .KEYZ, .KEYH0LES, .crypted, .cbf, .LOL!, .OMG!, .EXE, .RDM, .RRK, .RADAMANT, .kraken, .darkness, .nochance, .oshit, .oplata@qq_com, .relock@qq_com, .crypto, .helpdecrypt@ukr.net, .pizda@qq_com, .dyatel@qq_com, _ryp, .nalog@qq_com, .chifrator@qq_com, .gruzin@qq_com, .troyancoder@qq_com, .AES256, .enc, .hb15, .vscrypt, .infected, .bloc, .korrektor, .remind, .rokku, .encryptedAES, .encryptedRSA, .encedRSA, .justbtcwillhelpyou, .btcbtcbtc, .btc-help-you, .only-we_can-help_you, .sanction, .sport, .surprise, .vvv, .ecc, .exx, .ezz, .abc, .aaa, .zzz, .xyz, .micro, .xxx, .ttt, .mp3, .better_call_saul, .xtbl, .vault, .xort, .trun, .CrySiS, .EnCiPhErEd, .73i87A, .p5tkjw, .PoAr2w, .xrtn, .bitcoinrush@aol.com.xtbl, centurion_legion@aol.com.xtbl
.CryptoHasYou., 7ev3n, Alpha Ransomware, AutoLocky, Bandarchor, BitCryptor, Booyah, Brazilian, BrLock, Browlock, Bucbi, BuyUnlockCode, Cerber, Chimera, Chinese Ransom, CoinVault, Coverton, Cryaki, Crybola, Cryptear, CryptFIle2, CryptInfinite, CryptoDefense, CryptoHost, CryptoJoker, CryptoLocker, CryptoMix, CryptoTorLocker2015, CryptoWall, CryptXXX, CryptXXX 2.0, CTB-Locker, CTB-Locker WEB, DeCrypt Protect, DMALocker, DMALocker 3.0, EDA2 / HiddenTear, El-Polocker, Enigma, Fakben, Fury, Gomasom, Gopher, Harasom, Hi Buddy!, HydraCrypt, iLock, iLockLight, Jigsaw, Job Crypter, JobCrypter, KeRanger, KeyBTC, KEYHolder, KimcilWare, KryptoLocker, LeChiffre, Linux.Encoder, Locker, Locky, Lortok, LowLevel04, Mabouia, Magic, MaktubLocker, MireWare, MM Locker, Mobef, NanoLocker, Nemucod, Offline ransomware, OMG! Ransomware, Operation Global III, PClock, Petya, PowerWare, RaaS, Radamant, Rakhni, Rannoh, Ransom32, Rector, RemindMe, Rokku, Samas-Samsam, Sanction, Scraper, SkidLocker / Pompous, Sport, Strictor, Surprise, SynoLocker, TeslaCrypt 0.x – 2.2.0, TeslaCrypt 3.0+, TeslaCrypt 4.1A, TeslaCrypt 4.2, TorrentLocker, Troldesh, TrueCrypter, UmbreCrypt, VaultCrypt, Virus-Encoder, Xorist, XRTN, Zlader / Russian
There are new Ransomware viruses created every day. If your virus isn’t listed above, chances are, we can still help recover your data.
-Learn more about Ransomware recovery on Wikipedia and find stats about Ransomware infections here.
Can we recover your failed hard drive, SSD, flash drive, or RAID?