Over 1 million tech questions and answers.

what are encrypted files ?? do we have any way to encrypt or decrypt and file ??

Q: what are encrypted files ?? do we have any way to encrypt or decrypt and file ??


1) What are encrypted files and how do we know which files are encrypted and which are not.
2) i know its against the TSF rules to discuss anything related to password recovery or anything like that but just curious to know when anybody forget the password and if they are able to remove or change the password , would it affect encrypted files in anyway ??

3) Is their any way we can make any file encrypted or if we need to how we can remove encryption of any file.


Preferred Solution: what are encrypted files ?? do we have any way to encrypt or decrypt and file ??

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

A: what are encrypted files ?? do we have any way to encrypt or decrypt and file ??

An encrypted file or folder is a file or folder that only someone with the appropriate permissions can view.

If you are the administrator of a computer with folders or files on it that you have created then you can encrypt them and only someone with the appropriate permissions i.e you and anyone else you give permission to can see and view the contents of that folder or file.

You can only do things with the file if you created it or are the administrator or have the appropriate permissions.

Read other 9 answers

I have an odd case. It appears to me that I have signs of a encryption type virus, but there is no ransom note to be found anywhere.
Symptoms - 2 shared drives on a server where all file modified dates are changed to yesterday and are all unable to be opened. At the same time, other shared drives on this server have no issues whatsoever. Also, there are no hardware/software problems that I can detect on the machine.

A:Shared Drive Files Suddenly Encrypted, No Ransom/Decrypt File

How do you know the files are encrypted?
What errors are you seeing when you try to access the files?

Read other 2 answers

Hi i am trying to create a batch file to do the following
ask for user input
encrypt user input then add it to example.txt

then later in the batch file
look at the txt file
grab the input from the txt file
decrypt it
show on screen as echo undecrypted


Read other answers

A few days ago, I noticed a popup saying computer wanted to reboot and would if I didn't postpone it. I wasn't doing anything, so I went ahead and did it. The windows updates (running Windows 7 Professional 64-bit) applied and I got back to the desktop. Adobe put up a box saying there was an update for it too, so I clicked on it. Before I could start it though, I got a windows box that said "Encrypting File System" and told me to backup my file encryption certificate and key. After some searching on google with a different computer, I found that this sometimes come up even if you have never encrypted anything as I have not. So I went ahead and let it save the key to a flash drive. I did the cipher /u command to find if any files were encrypted. It found thousands of files in 7 directories. Mostly pictures (.jpg) on the second hard drive and they weren't viewable.

Error: "Windows Photo Viewer can't open this picture because you don't have the correct permissions to access the file location."

Filenames were green in explorer. So I tried using the backup of the encryption certificate and key. It seemed to restore just fine, but all the files were still encrypted. I tried the decript command "cipher /d" but that wanted to either be in the directory or specify the directory/filename and the list from the /u just flew by and would only scroll back so far.

After some more searching, found a .vbs script to find all the encrypted files... Read more

A:decrypt files files that I didn't encrypt

Well, from what I've been able to find and try, looks like those last two directories are simply not recoverable. Since I didn't encrypt them in the first place, I don't seem to have a key for it.

So, for the future...
What made it encrypt those directories so I can not do it again?
What should I do now to prevent problems like this again? Just backup my encryption key and try and remember where I backed it up to? The current one should be good for a while. One of the many things I tried was extending the expiration date to 2113.

Read other 1 answers

A few months ago, I performed a repair of Windows XP Pro SP2 to recover from some issues (never figured out what, though).

Recently, I tried to access a file that I had encrypted (using NTFS encryption through Windows). I found that I couldn't open, decrypt, or move the file to a FAT32 flash drive (access denied). Thinking that the repair install had done something to the encryption, I logged on as the Administrator and attempted to take ownership of the file, but Access was denied again. I then attempted to edit the file permissions and was able to add all users to the list of accounts allowed to access the file. But when I tried to access it, access denied.

Thinking perhaps that the file was corrupted, I deleted it and restored a copy from a backup made in December (my backups only go back 2 weeks). The restore was successful but the probel remained. So, I tried to restore the file again, but this time to a FAT32 flash drive with the settings set so that security descriptors would not be restored (I use Windows built in backup utility). The restore failed. I tried the same thing again but to an NTFS drive but it failed again.

Can anyone help me?

A:Encrypted File Won't Decrypt

You might try cipher from a command line using the /d switch.The encrypted file needs to be sitting on an ntfs volume. I believe the read only attribute may need to be removed as well. More on it here. Click the "cipher" link on that page.

Read other 4 answers

Hi guys!

I have a user with files encrypted.
She is going for leave for 3 weeks and now she forgot her password.
I have extract PFX file at the time she encrypt the file.

Can I use the PFX file to decrypt those file?
Anyone have idea?


A:Decrypt an encrypted file with PFX

What kind of Encryption using which program and which OS? Is it standard Windows Encryption on an XP box?

Read other 2 answers

I was infected with the CTB locker. My IT cleaned my computer from it but my files on the computer are still encripted, or at least it looks like that.
I opened the http://w7yue5dc5amppggs.onion/ page with Tor Browser as I was instructed in the message received with the CTB locker and here got the option to decrypt 1 encryted file before I pay 2,5 Bitcoins to convince me that decrypt is working. So I have uploaded 1 file with the extension "ingoauj' (all my infected files have this extension) but I received the message that this file is not encryted. 
Is this possible? It says that is not encrypted but I cannot open it.
Could someone help me?


A:decrypt CTB locker encrypted files

The newest variants of CTB Locker typically encrypt all data files and rename them as a file with a 6-7 length extension with random characters. The newer variants also do not always leave a ransom note if the malware fails to change the background, like it generally does. Compounding matters, the newer CTB-Locker infection has been seen in combination with KEYHolder, Torrent Locker (fake Cryptolocker) or Cryptowall ransomware. Unfortunately, there is still no known method of decrypting your files without paying the ransom and with dual infections, that means paying both ransoms.A repository of all current knowledge regarding this infection is provided by Grinler (aka Lawrence Abrams), in this tutorial: CTB Locker and Critroni Ransomware Information Guide and FAQThere is also an ongoing discussion in this topic: CTB Locker or DecryptAllFiles.txt Encrypting Ransomware Support & Discussion. Rather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions, comments or requests for assistance in that topic discussion.ThanksThe BC Staff

Read other 1 answers

I have two account on my windows xp computer(laptop). I encrypted a folder using windows encryption. somehow my that account got deleted so using restore i recovered my account. But now i am getting access denied message while trying to access that fodelr. Please help me to decrypt that folder.

A:Decrypt files encrypted by another user

You need to login as administrator.

Read other 4 answers
A:decrypt files encrypted by CTB any news

There is no way to decrypt the files. Did you need other assistance cleaning your computer?
See here.

Read other 3 answers

ok sir, i seriously need help or information regarding my situation so plzz plzz help. i had some files colored green for 1-2 years but i ignored it as i didnt knew what it meant. i thought it was jst a random thing like changing icon or something. now that i ve realized that it is encyrpted and cant copy it or open it i dont know what to do. seems my kid sister messed it up accidently few years ago :?( as when i go to the properties>advanced then there?s her name under the "users who can access this file" since then i have change my O.S many times and every time those files were there colored green. right now i am using win 8.1 i dont understand this certificate or key stuff but still after reading a few article when i tried to click the option "back up keys" it shows erroe that the certificate or key is not availiable for export on this machine. now sir, plzz tell me what r my options and what can i do. if i cant do anything then at least tell me that so that i can hard reset my hdd whith no hope. thank u very much sir

A:decrypt encrypted files error

Hello Shawn, and welcome to Seven Forums.

If you didn't backup the EFS certificate before installing Windows 8.1 and importing the certificate afterwards, then I'm afraid that you lost access to the encrypted green file.

If you like, you can just delete them.

Read other 3 answers

Unfortunately i have done a format and install clean operating system again(xp)! And i am unable to decrypt my originally encrypted files. Is there any possible way to decrypt ? I tried alot of sotware to decrypt, none works.
Help me pls!

A:How to Decrypt Encrypted files on Windows XP

Right here is some copy-pasta that helped me in the past.

Hi!!Thank you for giving me the opportunity to answer your question, Iappreciate that. I am also so glad to know that you have found asolution for your problem.Now I will repost my comment here to make it the official answer.isit the following pages for step by step instructions:"TweakXP.com - De-crypt Encrypted files on Windows XP":http://www.tweakxp.com/article37355.aspxor may be this one do the trick (it sounds more advanced):"encrypted file system recovery":http://www.beginningtoseethelight.org/efsrecovery/index.phpThe following program claims to recover the encrypted files, you cantry with the trial version:"ELCOMSOFT: Advanced EFS Data Recovery":Advanced EFS Data Recovery (or AEFSDR) is a program to recover(decrypt) files encrypted on NTFS (EFS) partitions created in Windows2000, Windows XP and Windows Server 2003.http://www.elcomsoft.com/aefsdr.htmlFor additional reference see:"Encrypting File System in Windows XP and Windows Server 2003":http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/cryptfs.mspxSee also this chapter at Microsoft's support site for better understanding:"Ch 17 Encrypting File System":http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prnb_efs_qutx.aspBest regards,Click to expand...


Read other 2 answers

Hi all,
Thanks in advanced for your advises :D!
The situation is as follow:
- Our AD server is 2012 R2 v. 6.3 Build 9600.
- Users below are using Windows 7 Professional and joined domain.
- I created new certificate in Public Key Policy/ Encrypting File System as Administrator and push down to the domain group
- We started doing encryption EFS for our users...most are ok, except one PC A.
- User A who is using PC A we cant encrypt his files. Pop up is 'The Parameter is Incorrect' when doing EFS encryption.
- if User B log in to PC A, his files on PC A can be encrypted. If user A log in to user B PC, his file can be encrypted as well.

- So seems like issue is only at PC A and only with user A
so my 1st Question: Why is this happening and how to prevent this? (possibility is user profile corrupted but why and where it's corrupted?


- I decided to copy all User A files (including Outlook pst), delete his profile and recreated new profile with same name
- Copy all his file over, set up outlook with old pst file again. And start doing encryption include outlook files.

- Encryption went smoothly.
- Next day (or may be when user restart etc..) when open, Outlook prompt Access denied for his pst file.
- All other files that was encrypted together with pst files (doc, xls etc.) are able to open and use normally
- At the same time, one more user reported having this Outlook access denied... Read more

Read other answers

Hey Everyone,

I am having a huge issue at the moment where our shared files are being encrypted by a virus/trojan. This incident started this morning and was discovered in the afternoon but unfortunately most of the files (around 20-40 GB) were encrypted by this virus. The infected files are Pictures, Excels, Words and PDFs and the processes that likely were responsible for the encryption were shutdown and moved to a temporary folder.

The suspicious processes that were running were:

Using ESET Anti-Virus, they are identified as:

My question is - how can get my files back?? (I do have some copies of the original files before encryption)
- Are there decrypters out there for these viruses?

I believe this is something that many of you guys here have seen and experienced, if you could share your solutions I would very much appreciated.



A:Files Encrypted by Trojan/Virtus, Looking for ways to decrypt files

Hello and Welcome to TSF.

If you haven't already, please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.


Unfortunately, at this time there is no way to decrypt those files without paying the ransom.

To prevent more files from being encrypted, disconnect the infected computer from the internet.

If you haven't already, when you disconnect you may be presented with a screen from the malware writers telling you to pay to get your files decrypted.

Do not run any malware removal tools unless asked by me.

We may be able to recover some or all files from your Shadow Volume Copies, unless the infection has already deleted them.

Do you have another machine that you can use to download the tools to USB drive and transfer them to the desktop of the infected computer?

If so, we want all our members to perform the steps outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help - Tech Support Forum

After running through all the steps, you shall have a proper set of logs. Please post/attach the logs in your next reply.

If you have trouble with one of the steps... Read more

Read other 2 answers

Hi thanks for the help in advance. Here's my issue

I encrypted some files using windows xp EFS a few months ago and since that time I have not done anything to my windows xp installation except change the password. When I tried to decrypt the files, i am getting access denied. I changed the password back to the original, but it still is not working. Under the certificate manager, I see the original certificate that was made when I initially encrypted the files but when I try to export the certificate, it says private key not found. I think I should have the necessary information to get the private key but I haven't found a way. I would really appreciate any help!

A:Cannot decrypt encrypted files using EFS due to missing priv key

Here's what Microsoft has to say a bought Private key cannot be found

Read other 1 answers

I have had a RAID, and lost the settings.
Then, recovered the files, therefore it have recovered as flat regular files.
I don't see it as Encrypted (green) and don't get access denied.
I have uploaded four files (in a zip).
Two as Chinese and Gibberish, is the Encrypted files.
The other two (cer & pfx) are the certificate.
The password for the certificate is 1234 (Certificate password is not like the original user password - Have other certificates, so you could show me the process IF you know the way).
Please show me that it is possible to Decrypt it, and return to me the original text.
All Windows installation is the same, and the same user name.
GOD bless you.


Read other answers

Hi! First of all: very nice Forum, I must say A shame I didnt come here before.

So I was dumb enough to click on a file I shouldnt have clicked on. Its actually the same story as here:
and here:

I hope it is ok to link to other sites. If not, I will of course remove the link. Actually the second link is _exactly_ what happened to me. I killed svchost.exe (I saw very high activity) and produced a blue screen. I immediately removed my SSD (my main hard drive) and replaced it with the HDD from my laptop (both Windows 7 Ultimate).
Long story short: I secure erased my SSD and reinstalled my system. Most of the virus scanner (offline scanner and online scanner and even when I uploaded the file containing the virus it self!!) didnt even identify the threat.
I still have a copy of my old system (for some backup reasons). I am certain this is no threat to my new system as I do not execute anything from it (mostly files like emails and some data from other programs) but please correct me if I am wrong here!

So everything is fine so far but in those few minutes I actually had the system activated while infected, the Virus managed to encrypt over 1TB of data. Mostly Video and music files. I even sent the file containing the virus to an anti virus site requesting help. That guy asked me if I had some encrypted/decrypted fil... Read more

A:Removed a Virus -> How can I decrypt the files it encrypted?

Hi Feos and welcome to TSG. As your system is no longer infected this should be in a different forum so I am going to request that it is moved.

A helper in the general forums may have a solution for you, but as far as I know if you do not have the encryption keys there is no way of decrypting the files or reproducing the key required.

Read other 2 answers

Yesterday , I had this problem , ransomware cryptlocker infected computer and locked all files, Today i downloaded a free software, and decrypted all files, with working!!!!!,      Iam Happy Now!!!!!!!!!!!!,  LOL

A:I Found The Way To Decrypt All Ransome encrypted Files

Hello azharssm -
We would all be very interested in your solution if you would care to leave the steps here.
As you did not mention the "free software" program, can you please list it here.
BleepingComputer hosts the solutions for almost all infections, but we do not list this yet.
We host solutions for many Ransomeware type infections, but cryptlocker would be great to add to the list.

Read other 8 answers

Hello all!
Sorry, i don't know if that's the correct place to post this.
I'm new, sorry if my english is bad, but i'm not so good handling this language.
However, i caught the virus that in italy is called "polizia di stato" (state police), and i know that it's almost the same of the american virus of FBI, as i understood looking around in the net.
I manually deleted it.
Howevere 2 other viruses came in my computer at the same time:
one with a VARIABLE name, and Dirty Decripter.
The first disabled Task Manager and all the ways to reactive it, but i was able to delete every copy it made of himself in my computer.
I removed also Dirty Decrypter, and actually, there aren't more than 50% of .doc/.xls files encrypted by it.
Now, there is only one doc and only one excell file that i need, and they are encrypted. After that, i looked around in the net to find some decrypters, but no one of them worked correctly.
I'd like to know if there is a working decripter to solve the problem. If not, and if in this forum there are some developers, i think that can be helpful somethig i have:
2 wersions of the same file, one version encrypted, and the other with the SAME contents but not-encrypted, and i have them shurely for .doc, and maybe also for .xls.
Starting with theese couples of files should be possible to make a decrypter, but at this step, i need help, because i'm no more than a noob in programming. Obviously, if a decrypter already exist, i'd like to heave the link!
&#... Read more

A:Decrypt files encrypted by Dirty Decripter

Hello Barnack
Please repost your topic here... → Virus, Trojan, Spyware, and Malware Removal Logs
If I just move it there you will not get "Reply Notifications"

Read other 3 answers

(firstly you need to remove ransomeware virus from your system)
Finally got the solution for decrypt ransomeware encrypted files..!! (SORRY FOR MY ENGLISH)
There Are Two Softwares for it :   1:  Kaspersky Xorist decrypter ( it is did for me, it decrypted all .LOCKED files like  (doc,docx,jpeg,and video files and other all, )  download it from any website it is free, search in google and download, it is only 601 KB!!!!!!!  and open it and scan it will scan whole computer it takes about 45 minutes for me, and it will create  a new version of our file,  but .LOCKED files will not deleted ,  we need to delete all .LOCKED files from our computer, type .LOCKED in search bar. and delete it.
second software is 2: kaspersky rectordecryptor ( it did not work for me , i think it is for another type of ransomeware )
Sure it will decrypt all encrypted files!!!!!!!!!!!

Read other answers

Doctor Web has developed an algorithm that successfully decrypts files encrypted by Trojan.Encoder.10465.

Trojan.Encoder.10465 poses a threat to Windows computers. The Trojan is written in Delphi. The encoder appends the extension .crptxxx to the infected files and also saves to the disk a text file named HOW_TO_DECRYPT.txt, which contains the following content:
All your files are encrypted with AESalgorithm!
For decrypt use this instructions:
Download tor browser
Run tor and go to: http://vejtqvliimdv66dh.onion
Or you can use tor2web services
in log panel enter your id (CRPTksrjghkrkwkrjthkewVM)
follow next instructions
if server is down, try connect later
locker version 3.0.0
The id parameter can assume various values on different infected computers.

If you have fallen victim to this malicious program, follow the recommendations below:
do not remove any files from your computer or reinstall the operating system. It is also not recommended to use the infected computer until you get detailed instructions from Doctor Web?s technical support;
if you have run an anti-virus scan, do not try to cure or remove the threats that were detected?our technical support specialists may need them during their search for a decryption key;
try to remember as much about the circumstances of the infection as possible: this can involve receiving dubious email messages, downloading programs from the Web, or visiting websites;
if you hav... Read more

A:It is possible to decrypt files encrypted with Trojan.Encoder.10465

omidomi said:

Once again, we would like to point out that our free decryption service is only available to users who have purchased commercial licenses for Dr.Web products.Click to expand...

When you've got organizations like No More Ransom and ID Ransomware giving consumers the ability to decrypt their files for free, forcing them to purchase a license for Dr.Web's products comes across as scummy to me.

Read other 0 answers

Hello Guys,
My Files in External Hardisk is unreadable eg.(Word,Excel,Dwg. Etc).
My PC was attacked by Ransomware Cryptowall 3.
How to decrypt and open the files without paying.

A:Decrypt my Files in External Hardisk Encrypted by Cryptowall 3

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.
We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.
To help Bleeping Computer better assist you please perform the following steps:
*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/568591 <<< CLICK THIS LINK
If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.
***************************************************If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of t... Read more

Read other 2 answers


My PC got attacked by CryptoLocker ransomware. Once I got ransomware message after being attacked, I scaned my PC with Malwarebytes Anti-Malware and deleted ransomware. (then rescanned with hitman pro)

But even after that all my files (Doc, ppt, excel, pdf, zip, image, video, etc.) are still encrypted. Please help me decrypt them. For reference I have attached ransomware notes.

Looking forward for positive reply.

Thanks in advance.


Read other answers

How do I get back the files that were in an encrypted folder in Windows XP? I went to the User I used to encrypt them (right click on folder->encrypt folder and subfolders) and undid that option, but even though the folder and subfolders are no longer listed in green color (the color of encrypted folders) the files themselves are still gone, just the folders themselves remain, but no files at all that used to be visible in those folders. I hate encryption. I never thought it meant "hide these files from everyone, including ME." It's so stupid. How do I decrypt my folders, or, perhaps more accurately, how do I decrypt the files that used to be visible inside the folders and subfolders in the previously-encrypted folder? I even did the lengthy thing related to Certificates and still the files themselves are hidden from me. And they're not simply "hidden files" because I tried that option in options->View but it didn't do the trick. There's gotta be another way.

A:How do I get back the files that were in an encrypted folder in Windows XP? I went to the User I used to encrypt them (right cl...

It sounds like you may have already tried one of these steps.Perhaps one of the others will restore the files for you.

Read other 2 answers

I had my photos[which is present in drive(E other than the one having windows installed(C] which i had encrypted using built in encryption option in windows8-64bit to prevent data from loss.

Then few days earlier i formatted drive (Cand upgraded my system to windows 8.1-64bit.
But I got worried when i saw that i m unable to access my all photos and videos that i encypted.It turned green.I could not even move or view them.

Then i installed windows 7 ultimate-64 bit thinking might this would help.But in vain.Presently I m on windows7-64bit os.

I tried to change the owner permissions but i was unable to.It said access denied.Maybe its asking for the owner that was on windows8-64 bit,(earliest one on which i encrypted the files).And now the owner has changed due to change in os and the thumbprint too.

Sir those files are really important for me.what can i do to get them back

A:Cant Decrypt 'encrypted files on previous version of Windows' after a format

As stated in this guide, if you don't have the key you will not be able to access the encrypted files.


The encryption system is extremely secure, if it wasn't it would serve no purpose and there is no way to break it without the encryption key.

Encryption would generally only be used for high risk information like banking details or anything you would not want an unauthorized user or a hacker to get access to. Photo's and movies are better just backed up to DVD's to keep them safe. Hard drives will always fail in time, so you should only leave data on your system that has not been backed up if you don't mind loosing it.

Read other 1 answers

We have encrypted file/folder in desktop windows 7 as described in  "msdn.microsoft.com/en-us/library/cc875821.aspx"

 and ?Using EFS?
section and Exported Data Recovery Keys using ?mmc.exe?.
Once ?Data recovery key? is exported  from desktop windows, we are importing same using below command line arguments in winPE.
?Certutil -f -p XXXX -importPFX ?path of the Data recovery key.pfx?  ?
EX:- ?Certutil -f -p 1234 -importPFX ?f:\mykey.pfx? ?
Key is not imported correctly in  WinPE environment.  It returned <NULL>
So we have imported the same key in another desk top windows, using below command line arguments it is working fine and we are able to decrypt the files.
Certutil -f -user -p 1234 -importPFX ?f:\mykey.pfx? ?.

please help us to import the certificate in
WinPE 3.1 and  decrypt the files.

Read other answers

Please see this topic for some details:
In every folder on my two internal and three external hard drives I have two files which have appeared. One is an HTML file called READ_TO_DECRYPT!!! which opens to give instructions into how to obtain a 'key phrase' to decrypt them. This must be done within seven days. I have not attempted to follow these instructions. The second file is called Thumbs and is a Data Base file which I have never opened. I have attached a copy of the first file to this post. Data Base files aren't permitted as attachments.
These files are all dated 5 July 2013 at various times in the afternoon and evening (British Summer Time).
I did not notice the problem had occurred until Sunday 7th July - I did not start up my computer at all on 6th July.
As far as I can tell all my Excel and Word files have been encrypted on all my hard drives. Many of the tens of thousands of .jpg files on all the hard drives have also been rendered unreadable, but not all of them.
I am seeking help to find a method of restoring all my files - many years of photography are at stake!
Contents of my DDS log follow. Thanks to anyone who can help.
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702  BrowserJavaVersion: 1.6.0_23
Run by David Campbell at 18:30:46 on 2013-07-08
Microsoft Windows XP Home Edition  5.1.2600.... Read more

A:Files in hard Drive Encrypted and Ransom Sought for 'Key Phrase' to Decrypt

Heya,Fabian asked me to take a look at your logs, there are a few entries that seem to be connected to the infection. In order for us to get a better idea of what we're facing we would like to take a look at them. Could you please collect and upload the following files to: http://www.bleepingcomputer.com/submit-malware.php?channel=100c:\windows\temp\csrssc.exec:\windows\system32\yayxvUnL.dll(a sample of the thumbs file)regardsmyrti

Read other 19 answers

I expect this is going to be basic to the most of you but here goes. I am running Win 7 on my main laptop and XP on my spare. I am using a Freecom Usb hard drive to transfer files. When I go from Win7 to XP I find that the text on the files is green and can't be opened in XP. If I go back to Win 7 I find that they are encrypted and I have to decrypt to transfer them. How can I stop this happening please?
Also can I link the computers up with each other to save transferring in the above manner? Thanks in anticipation. Peter.

A:Encrypt decrypt, that is the question

"Green" files are encrypted, password protected, etc...

If you have bitlocker on or other HDD/ file encryption on Windows 7, that may be the issue.

Regards. . .



Read other 2 answers

I have 2 partitions c and d. i encrypted some files in d:. yesterday i formatted ma lap and i installed a fresh copy of win7. today i tried to copy that files into a cd it displays an error. then i tried to decrypt that files it also getting an error. even i cant open that files. plzzzzzz some one help me

A:Problem with Encrypt and Decrypt

Did you have a password before you formatted? Try using that same password and decrypt again. Restart before decrypting if you have to.

Edit: password on your user account, if it wasn't clear.

Read other 9 answers

I have an FTP bat file that runs on an NT server. My client wants to encrypt the password when the bat file is idle and decrypt when the bat file is running. Do you have any script that can do this process? Thank you.

Read other answers

I'm looking for a way to secure my "files" hard drive (not my primary OS hard drive). I want something that would allow me to decrypt it on boot, with a decryption password of some type. It would then need to also encrypt again when shutting down.

Could anyone recommend a program for this? It would also be preferred if the separate actions had their own executable or way to be run from command line so I could use it with another project of mine, but this isn't required.

Thanks to anyone that can point me in the right direction!

A:How do I encrypt and decrypt harddrive on computer boot?

Hi Danny,

I would recommend you try TrueCrypt.


Read other 2 answers

Hi All

I used the files and folders Encrypt attribute: "Properties>General>Encrypt contents to secure data"
to encrypt a folder and all its contents. The folder and all its contents are green of colour. Now this is on the D-drive. I formatted my windows C drive and now I cannot access any of the files inside the encrypted folder.

I try setting permissions but they are set for administrators and I'm an administrator. How do I decrypt them?

Thank you

A:Solved: Windows Folder Encrypt Attribute - How to Decrypt?

Read other 6 answers

I had installed a folder lock software, version-5.2.6 but it turned out really bad for me,the software has automatically encrypted all my files which was of 80GB size & which contained some of my important files in it.
Please help me to recover those files or the procedure to decrypt the files.

A:how to decrypt an encrypted 80 gb folder?

The same software and password should solve the problem.

Read other 1 answers

3 years ago i had a blackberry curve 8520 and i didnt know how to use it much. sadly i clicked on encryption thinking it was setting a password for my blackberyy device. 2 years later i swapped it out and got the new blackberry curve. now for a year i have been dealing with a message everytime i put my memory card in that says 'an encrypted memory card has been inserted' etc so i basically cant view the files i have on this card and they are really important to me. im pretty sure i know the encryption password i just want to know is there any way at all, any way possible i can de-crypt this card without the original device??

A:De-Encrypt My Encrypted Memory Card

Read other 6 answers

I have downloaded and used Kakasoft Shared folder protector to limit the access of some of my LAN-shared folders. The problem is that in my pc I had some "marica.exe" malware. Now, when I try to access my encrypted/protected folder I can only see this marica.exe and none of my files/folders. Hard disc appears to have 5GB of data on it, but I can't figure out how to restore them or fix this encrypted thing in order to make it work again... any ideas?? Note that i have not forgotten my password...
Thank you in advance,

A:I can't decrypt/restore encrypted folder

If the infection is gone I would try a restore point and see if your password works again.

Read other 1 answers

Hi, i have an excel encrypted with windows 8.1 EFS. Key is lost and now not able to open the excel. Below is the way to encrypt file from how to geek. Any way i can decrypt my excel?


Read other answers

   Hi, I've been attacked by DirtyDecrypt virus but finally I "killed" it. Unfortunately alll my JPG and PDF files are ecrypted now!!!!!!
   Interesting fact: sometimes when I look inside a folder using Windows Explorer with "Medium Icons" some pictures show their content! This means that the image is still inside and can be seen!
   On the other hand when I try to open it using all the available possible programs all I get the virus picture telling me:
           File is encrypted
          This file can be decrypted using the DirtyDecrypt.exe
           Press CTRL+ALT+D to run DirtyDecrypt.exe
          Check the paths:
I tried decrypt_mblblock.exe but all I get is a message telling me that no encrypted file can be found.
What could/should I do next!

A:DirtyDecrypt : how to decrypt the encrypted images

Forgot to mention: using a hex editor I discovered that the header of the JPG files is corrupt. I tried to use another JPG file's header but it didn't work.

Read other 2 answers

Help. Ready to throw laptop away....
I was given a secondhand (but very new) HP Laptop <g class="gr_ gr_106 gr-alert gr_gramm gr_inline_cards gr_run_anim Style multiReplace" data-gr-id="106" id="106">that  is</g> running Windows 7 Professional.
In order to give all the previous owners files back to them and to clear some space on the <g class="gr_ gr_192 gr-alert gr_gramm gr_inline_cards gr_run_anim Punctuation only-ins replaceWithoutSep" data-gr-id="192" id="192">laptop</g>
I put all their files onto a Seagate External Hard Drive. 
In order to check that the previous owners will be able to open the hard drive with all their files I tried a) opening the hard drive (which was in the G: drive) and then b) trying to open an individual file.
I have run into problems with both despite having changed me to the Administrator. <g class="gr_ gr_2273 gr-alert gr_gramm gr_inline_cards gr_run_anim Punctuation only-ins replaceWithoutSep" data-gr-id="2273" id="2273">First</g>
a pop up comes up at the bottom right of the screen, where the task icons are, only giving me 10 minutes or so to look at files on the external hard drive if I click on that balloon. Once I have clicked on that I am able to open the hard drive and can see
all the files listed but I am unable to open any individual files as it says I do not have permission. Then in orde... Read more

Read other answers

How can I move a file from a bitlocker drive to a drive without encryption.
Bitlocker does not decrypt files when moving file from hard drive to another device. 
Computer (1) with bitlocker.  Computer (2) without bitlocker
When I move a file from Computer (1) to Computer (2) the file is not accessible on Computer (2).  I moved the file via an unencrypted USB.  The file is not being decrypted when it is moved to the USB.  
I can remove the decryption one file at a time by going to properties and advanced attributes by unchecking the "Encrpyt contents to secure data".  I have not found a way to have bitlocker to properly decrypt as the file or multiple files
are moved to another device.  
This is happened before and after a motherboard replacement that required a new encryption.

Read other answers

Not if it is the right forum but I can not open any file , the name of my files are fine. next to the folders I have some files encrypted files. HELLOREADME16.TXT . I can not find information on this virus. What I can do??
Thank you

A:Hello , I need help encrypted files. HELLOREADME16.TXT file with instructions an

sorry, I change the title and repeated

Read other 1 answers

OS Version: Microsoft Windows 7
Professional, Service Pack 1, 64 bit
Processor: Intel(R) Core(TM) i3-2310M CPU @ 2.10GHz, Intel64 Family 6 Model 42 Stepping 7
Processor Count: 4
RAM: 3936 Mb
Graphics Card: Intel(R) HD Graphics Family, 1840 Mb
Hard Drives: C: 110 GB (62 GB Free); D: 121 GB (120 GB Free);
Motherboard: LENOVO, 7827AE6
Antivirus: None

All of my files disappeared and encrypted in another suspicious rar file - "All_Your_Document". I do not know the password. My folders are still there but inside are empty. Hard disk space capacity remains the same and there are so many "album art.jpg" inside the encrypted folder which I have never possessed them before.
Refer to my attached screenshots. Is my computer being hacked and controlled by someone else?

Does anyone experience the same issue before? Pls help!


Read other answers

OS Version: Microsoft Windows 7
Professional, Service Pack 1, 64 bit
Processor: Intel(R) Core(TM) i3-2310M CPU @ 2.10GHz, Intel64 Family 6 Model 42 Stepping 7
Processor Count: 4
RAM: 3936 Mb
Graphics Card: Intel(R) HD Graphics Family, 1840 Mb
Hard Drives: C: 110 GB (62 GB Free); D: 121 GB (120 GB Free);
Motherboard: LENOVO, 7827AE6
Antivirus: None

All of my files disappeared and encrypted in another suspicious rar file - "All_Your_Document". I do not know the password. My folders are still there but inside are empty. Hard disk space capacity remains the same and there are so many "album art.jpg" inside the encrypted folder which I have never possessed them before. I read the text document - "All your files in archive" mentioning that I have to follow some steps to get password as in order for me to extract my files back?!?

Refer to my attached screenshots. Is my computer being hacked and controlled by someone else?

Does anyone experience the same issue before? Pls help!

Read other answers

Hello everyone here
Seem like I am and idiot to it's seem funny it's like lock the door and then throw the key to that room.
I was wondering whether how can I open certificate.ptx file if it's already encrypted. I suddenly found a video on youtube
about encryption thing that can be done by CMD i have no idea what is about just try and follow it i'm not really know
that all the files that save on my desktop are being encrypted automatically. I saw windows asked to save the certificate then I save it on my desktop later on my PC error so I move all my files on desktop to external drive and do Windows reset tool completely
reset. And I've just noticed I can open all my files which I back up :/
Please if somebody have solution please let's me know. Now i'm stuck with all my files like 120Gb :/

Read other answers

how can I remove ctb-locker virus?
after that, how can I decrypt my all encrypted file?
Thanks so much

A:All files encrypted by ctb-locker and file extentions changed!!!

Hello ehsan_shafaghat and welcome to Bleeping Computer
Unfortunately at this time there is no way to retrieve the private key that can be used to decrypt your files without paying the ransom on the CTB Locker Site.
Please read this for more information.

Read other 3 answers

My backup software is reporting that some of my files are encrypted with the Windows 7 encrypted file system (EFS), but to my knowlege, I haven't encrypted any folders or files. Is there a way to locate encrypted files (maybe using the Windows Explorer)?

A:How can I search for files encrypted with Encrypting File System (EFS)?

Run the following command from an elevated command prompt:
cipher /u /n
See also http://technet.microsoft.com/en-us/library/bb490878.aspx
Here is a PowerShell command to accomplish the same thing, but it is slower than Cipher.
get-childitem c:\ -Recurse -Force -ErrorAction SilentlyContinue | Where-Object {$_.Attributes -ge "Encrypted"} | format-list fullname, attributes

Read other 3 answers

Hi Folks, here is the situation -

Windows 2000 SR 1

I recently had to reinstall Windows 2000 to a new partition after some recent OS problems.

The problem now is that I formerly had a directory which I decided to encrypt using Win 2000's new encryption technology.

From what I understand is that the key used to encrypt the folder is based off my old SID. Now that I have reinstalled I am unable to view or delete any of the contents in that folder, even with Local Admin access and full ownership.

I've checked MS kbase and the only recourse would have been if I have used the backup tool to backup the key. Regardless to say I have no backups.

Now it would be nice if i could recover those encrypted files however I would be happy at this time if I could simply delete the whole folder.
I can view the filenames of the files but am unable to view/delete the files.

Any suggestions?

BTW the original WinNT directory has also been deleted.

A:Win2000 Server - Encrypted a folder, reinstalled, now cannot decrypt folder

did you ever find any resolution to this issue? I have a sorta/kinda similar situation where Active Directory became corrupt and SID's got cross-linked. Long story short I have the old SID and need to know how to apply it to a new user object in Active Directory. I've searched everywhere without luck on this one.

Read other 1 answers

I know I have been hit by CryptoWall. I do however seem to see something that I have heard shouldn't be the case. I am hoping that this is a good sign. I have files that are duplicated but it seems that the original file is still there. ex.
Kidz Club.jpg   
Kidz Club.jpg.5aa
Problem remains the same both files are encrypted. Didn't know If this has been reflected in other forums and is something that is recoverable.
A response would be appreciated
Thanks for all you guys do.

A:Files encrypted but both regular and encrypted files remain.

A repository of all current knowledge regarding CryptoWall is provided by Grinler (aka Lawrence Abrams), in this tutorial: CryptoWall and DECRYPT_INSTRUCTION Ransomware Information Guide and FAQReading that Guide will help you understand what CryptoDefense does and provide information for how to deal with it and possibly decrypt/recover your files. At this time there is no fix tool for CryptoWall.There is also a lengthy ongoing discussion in this topic: CryptoWall - new variant of CryptoDefense. Rather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions, comments or requests for assistance in that topic discussion....from the above topic.CryptoWall victims,If you are thinking about paying the ransom, have decided to pay, or want to help test a few things for me, Please email me at [email protected] or PM me first.There may be other options for you, or can receive assistance with the infection.Nathan (DecrypterFixer), Security Colleague Post #273ThanksThe BC StaffNote: Although this infection has numerous similarities to CryptoLocker and CryptorBit, there is no evidence that they are related other than that they do the same thing.

Read other 1 answers