Over 1 million tech questions and answers.

issue with encrypted cache of offline files

Q: issue with encrypted cache of offline files

Hello,

since yesterday we have problems with computers where the offline files are enabled and the cache is encrypted.

Users cannot save files the message access is denied is coming up.

It's possible to create a file, which has then 0 bytes and when opening the file the same message is coming up.

If we do not encrypt the offline cache via GPO, everything runs normally again.

This setup worked now for several years without problems.
Any Patchday issue?
Best regards,
Juergen

Read other answers
RELEVANCY SCORE 200
Preferred Solution: issue with encrypted cache of offline files

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

RELEVANCY SCORE 73.2

Hi,
Quick questions I hope.
Formatting the database using the below command, what will happen to user data if it not sync'd
reg add
HKLM\SYSTEM\CurrentControlSet\services\CSC\Parameters /v FormatDatabase /t
REG_DWORD /d 1

Will users loose files that have not been sync'd
Thanks

Read other answers
RELEVANCY SCORE 72.4

I'm using the offline files feature in Win7 (much better implementation, btw - kudos!) and I've run into a problem:  the CSC is using up all the drive space on C:\.  I'd like to move the CSC to D:\, however I've been unable to do so.I've seen this posted here previously (2/2009), however the response was to follow the instructions from Vista (using migwiz.exe).  When I launch migwiz.exe, I have no option of selecting the offline files as outlined in the Vista instructions (http://blogs.technet.com/filecab/archive/2006/12/12/moving-the-offline-files-cache-in-windows-vista.aspx).Are there any other ways of doing this?Thanks!

Read other answers
RELEVANCY SCORE 72

Windows 8.1 is not correctly apply the Default Cache Size/Limit Disk Space Used by Offline Files policy.
I have followed this guide.
http://www.falconitservices.com/support/KB/Lists/Posts/Post.aspx?ID=158
Computer Configuration > Administrative Templates > Network > Offline Files

I have configured the policy as follows:


Locate the following policies:

Limit disk space used by off line files (DISABLED)
Disabling this policy allow limits higher than the default 10% of disk capacity to be used for Offline file cache.Default cache size (10000)
Enabling this policy and configuring a cache size allows you to set the % of disk size that the cache will use.Prohibit user configuration of Offline files. (DISABLED)
Disabling this will allow users to manually set their own % of disk size that the cache will use.
After setting the GPO I formated my CSC and logged in to see what the new setting was.
The result of this in Windows 8.1 was that an offline files cache of 1.29Gb (0.6%) would be created on my 200GB C: drive.
I tried changing the size to 9500 and 9700 but both are still setting a default cache of less than 1 percent.
I re-applied the GPO on several occasions using gpupdate /force to
no avail.

There seems to be a bug in Windows 8.1 with the processing of this GPO item preventing it from creating a cache.
I checked the registry and the values entered into the GPO are what show in the registry.
If I disable the GPO and manually assi... Read more

Read other answers
RELEVANCY SCORE 71.2

I have scoured for a complete fix for this issue since I had 3 laptops using the Offline Files to keep all my documents, pictures, music, etc. in sync between them and a server that moved on to a more peaceful existence without bits and bytes.
There is a Mr Fixit for XP, and Windows 7 but not Windows 8. A Mr FixIt for windows 8 would be appreciated, but even better would be a button or hotkey to allow the Offline Files cache to be completely wiped, in case anyone is listening. Note that the
registry key location for Offline Files in Windows 7 & 8 is completely different even though the same FormatDatabase DWORD is used. 
I found another post that told to do the following to reset the cache:
To reset Offline file in Windows 8, We have to reinitialize the offline files cache all together:

      
Open up registry editor (WARNING: Only for Advanced Users)      
Browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Csc      
Add a new key (folder) called Parameters      
Under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Csc\Parameters, add a new DWORD called FormatDatabase and set its value to 1Save, Close, Reboot (added by me)
However, this did not fix it for me. After some tinkering I learned that the Offline Files registry change did not format the cache unless the Offline Fil... Read more

Read other answers
RELEVANCY SCORE 71.2

Offline Files :
The CSC (Client Side Cache) on fully patched Windows 7 machine would intermittently (Every other day)  flush and rebuild itself when restarting the machine.
The Offline files are redirected ?My Documents?, ?Desktop? and then failing over between DFS target servers (Windows 2008 R2) and shutting the laptop down causes the CSC to rebuild. Its like the Cache thinks its corrupt and rebuilds.

Anyone experienced this issue at all?
Can I provide any further info?

Read other answers
RELEVANCY SCORE 68.8

Setup: Windows 7 X64 Enterprise, no SP1.
Problems:
1) Tried the registry change to clear the offline files cache on c:\windows\csc and move it to d:\csc

http://www.mydigitallife.info/how-to-relocate-or-move-offline-files-client-side-caching-location-in-windows-7-or-vista/ . This doesn't work. Windows simply ignores the reg key "CacheLocation" and post-reboot just recreates c:\windows\csc after
I went through the steps to remove it earlier. Syntax used in the reg key for CacheLocation is \??\d:\csc (I tried with and without the folder created manually).
2) Offlines files when instructed to sync a child folder of a parent drive mapping attempts to sync the entire parent folder. This is really annoying because the parent folder has over 1TB in it.
\\servername\parent\child is right clicked, I choose "always available offline" and I see it start to sync. In the progress bar I can literally see it pulling data like xls and pst files off of the parent folder.
???
What's puzzling is that others seem to have luck in getting #1 to work so it makes me think I'm screwing up the steps but I've check it and tried it twice now.
Any help would be appreciated.
Pete

A:Offline Files Cache location change not working and caching entire parent directory

The default location of the Offline Folders cache is %systemroot%\csc. If you need to move this cache to another location
on your computer for some reason, follow these steps:
1. Set the following REG_DWORD registry key to a value of 1:

HKLM\System\CurrentControlSet\Services\CSC\Parameters\MigrationParamters

Doing this ensures that all items in the cache are migrated

2. Run the Windows Easy Transfer wizard. Once the data has been scanned, a Customize link is displayed. Click this link and
make sure that Windows Settings is checked for all items displayed in the list.

3. Once you have collected the data, set the following String registry key to specify the new cache location:

HKLM\System\CurrentControlSet\Services\CSC\Parameters\CacheLocation

For example, to move the cache to a folder named CSCCache on your D: drive, specify the following value:

\??\D:\CSCCache

4. Now reboot your computer, run the Easy Transfer wizard again and apply the previously gathered files. Then reboot one more
time when prompted by the wizard.
 
Moving the Offline Files Cache in Windows Vista
http://blogs.technet.com/b/filecab/archive/2006/12/12/moving-the-offline-files-cache-in-windows-vista.aspx
Note: migwiz.exe is in system32 in Win7
942960 How to move the client-side caching (CSC) folder to a new location in Windows Vista
937475 How to change the location of the CSC folder by configuring the CacheLocation registry value in Windows VistaSumesh ... Read more

Read other 2 answers
RELEVANCY SCORE 63.6

Hi,
I've got a situation here whereby .TMP files are appearing in network directories, and the files are going missing. The size of the TMP file matches the original file.
I'm trying to narrow down the issue, because I think there may be two problems here.  
1. Offline Files are enabled, to allow profile redirection.    It seems that this is also by default, is allowing Clinet Side Caching when there are network issues.  Does the original file (.doc for example)  get renamed
as a HR234.TMP for example when the Slow link detection sees slow performance? 
2.  If the above TMP file is created when there are network issues, should this resolve itself (sync itself back to the network) when performance improves?
Currently we are in a situation where we have a department that have files missing from many network shares, all the missing files seemlingly replaced with a .TMP file, so do we have to go round to every machine in the department, and manually
sync them to resolve this?  
 

A:TMP files created, files missing Offline files issue?

Hi,
 
After checking the Hotfixes and Security Updates included in Windows 7 and Windows Server 2008 R2 Service Pack 1 in the

Documentation for Windows 7 and Windows Server 2008 R2 Service Pack 1 (KB976932), I found the following hotfix is available:
 
Temporary files do not synchronize correctly to a non-DFS share on a server from a client computer
that is running Windows 7 or Windows Server 2008 R2
 
Regards,
 
Sabrina

 
TechNet Subscriber Support
in forum.

 
If you have any feedback on our support, please contact
[email protected] posting is provided "AS IS" with no warranties or guarantees, and confers no rights. |Please remember to click ?Mark as Answer? on the post that helps you, and to click ?Unmark as Answer? if a marked post does not actually answer your question.
This can be beneficial to other community members reading the thread.

Read other 7 answers
RELEVANCY SCORE 61.6

Hello everyone here
Seem like I am and idiot to it's seem funny it's like lock the door and then throw the key to that room.
I was wondering whether how can I open certificate.ptx file if it's already encrypted. I suddenly found a video on youtube
about encryption thing that can be done by CMD i have no idea what is about just try and follow it i'm not really know
that all the files that save on my desktop are being encrypted automatically. I saw windows asked to save the certificate then I save it on my desktop later on my PC error so I move all my files on desktop to external drive and do Windows reset tool completely
reset. And I've just noticed I can open all my files which I back up :/
Please if somebody have solution please let's me know. Now i'm stuck with all my files like 120Gb :/
Regard,
Sela 

Read other answers
RELEVANCY SCORE 60.4

I have a user on Windows 2000 Pro who is running offline files to our 2003 Server. Everything was working fine until the other day when he ran Synchronization and then certain folders appeared with a red arrow instead of the original double blue arrows denoting offline files. I have never seen this red arrow, does anyone know what this signifies?

Thanks,
 

Read other answers
RELEVANCY SCORE 59.2

Hi,
I'm sitting with a big issue at a customer and ask for your help.
Environment:
- 3x Windows 2008 R2 file servers configured in DFS
- approx. 500x Windows 7 clients (Laptops)
- 3x network shares, Common1, Common2 and Homefolder. 
- "Offline Files" and "Folder Redirection" enabled for entire user profile.
- Everything is controlled by GPOs and there are no login scripts.
Symptom:
Due to some faulty settings in the client GPO and the fact that the "Common" shares was set to allow Offline Caching of files and folders, the majority of clients now suffer from sync issues and conflicts.
Most of the conflicted files are located in the users home folder, but some users are also seeing the same issues with files located on the "Common" shares. The users themselfes are not allowed to enable Offline Files as this is disabled by GPOs.
The only folders that should be treated as Offline Files are the ones in the users home folder.
Solution:
A new set of GPOs have been created that correctly set up "Offline Files" and "Folder Redirection". These are linked to a test-OU and the computers and users applied to that OU are not suffering from the problems above.
Question:
When we move a client, the cache will be deleted and all non-sync'd work will be lost.
Today we manually look at every users sync center and try to resolve the conflicts before we move them to the new OU. This is extremely time consuming when... Read more

Read other answers
RELEVANCY SCORE 59.2

I know I have been hit by CryptoWall. I do however seem to see something that I have heard shouldn't be the case. I am hoping that this is a good sign. I have files that are duplicated but it seems that the original file is still there. ex.
 
Kidz Club.jpg   
 
AND
 
Kidz Club.jpg.5aa
 
Problem remains the same both files are encrypted. Didn't know If this has been reflected in other forums and is something that is recoverable.
 
A response would be appreciated
 
Thanks for all you guys do.

A:Files encrypted but both regular and encrypted files remain.

A repository of all current knowledge regarding CryptoWall is provided by Grinler (aka Lawrence Abrams), in this tutorial: CryptoWall and DECRYPT_INSTRUCTION Ransomware Information Guide and FAQReading that Guide will help you understand what CryptoDefense does and provide information for how to deal with it and possibly decrypt/recover your files. At this time there is no fix tool for CryptoWall.There is also a lengthy ongoing discussion in this topic: CryptoWall - new variant of CryptoDefense. Rather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions, comments or requests for assistance in that topic discussion....from the above topic.CryptoWall victims,If you are thinking about paying the ransom, have decided to pay, or want to help test a few things for me, Please email me at [email protected] or PM me first.There may be other options for you, or can receive assistance with the infection.Nathan (DecrypterFixer), Security Colleague Post #273ThanksThe BC StaffNote: Although this infection has numerous similarities to CryptoLocker and CryptorBit, there is no evidence that they are related other than that they do the same thing.

Read other 1 answers
RELEVANCY SCORE 58

I have looked through all the similar threads but still couldn't find a solution to this.  We have Windows 7 machines logging into a Windows 2008 AD networks. While on the network, our clients are set to use internal DNS set by DHCP. A few of our
folks have offline files setup on their home drives.  These users can successfully log onto their computers offline.  When they attempt to access their offline files however, they receive the message "The system has detected a possible attempt
to compromise security. Please ensure that you can contact the server that authenticated you" along with the option to provide their credentials. Entering their credentials fails of course. The work around for them is to disconnect from the wireless network
or disable the WLAN card. At that point they can access their offline files.  But as soon as they reboot, they receive the same message.  If they reboot with the WLAN card disabled, they will not receive this message and are able to access their
offline files.  Additionally these users are setup with VPN. If they enable VPN, the issue is corrected and they can again access their offline files.

We've attempted removing and rejoining to AD, removing their user profiles and completely rebuilding the laptop from scratch. It appears when the laptop is connected to a wireless network, it wants to contact our AD network. The articles below haven't offered
a solution.  

http://support.micr... Read more

Read other answers
RELEVANCY SCORE 55.6

Hi, I wonder if anyone can help. I have been Googling all over the place last couple of days and looking through hundreds of regkeys but cannot find the answer. 

We have 1800 PC's using Offline files to a NAS location. Even though the Group Policy is set to force PC's Offline no matter what the latency value. I have noticed some PC's that have Offline files enabled but are set to work online. Maybe set manually
before the GPO was applied. Anyway I was wondering if there is a way to detect on numerous PC's whether a PC is set to work Offline or Online? I have been looking to see if a regkey changes when the Work Offline / Online button is pressed on the file menu
of the redirected folder. 

I have found a key that changes if you hit the button Work Online/ Offline button
manually HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\NetCache\OnlineTransitionLog Value - (name of nas share) but this clears when the PC is rebooted or logged out and does not reappear unless you do the switch again manually.
This will not work when I try to scan all the PC's.

Help would be much appreciated. 

Thanks

Read other answers
RELEVANCY SCORE 55.6

In File History > Advanced settings of W8 and W8.1, there was an option to adjust the offline cache size (default 5%). In W10 this option is gone! So I have two questions:

1. Is the default still 5%? Or? (maybe even more intelligent / dynamic?)
2. Is there a way to change the offline cache size / percentage? For example in the registry?

Thanks!

Read other answers
RELEVANCY SCORE 55.2

Hi all,

Please help me choose tools - service provider(s) and/or application(s) - for my goals.

I'd like to start sharing privately videos and photos in some private cloud drive with a group of close people. It would be sort of electronic photo/video album. Most computers are 8" Tablet PCs, OS is Windows 8.1.

There is a question how can I view these photos/videos when one (or more) of these people is offline. The best thing would be an application which automatically caches the photos/videos which are viewed most often or "starred" or "liked" most or "rated" as best. The application would cache (for offline viewing too when there is no internet connection) those mostly viewed/starred/liked/rated photos/videos on each computer, depending on which photos/videos were watched on that particular computer.

What I plan is just keep putting all the photos/videos (probably from all the same computers) to some cloud drive, and - the best thing would be - just let the mostly watched photos/videos to sort naturally in each cache. Or maybe there is some feature to rate photos/videos (somewhat like in windows media player).

Is there a way to auto-cache some amount (let's say up to 2GB or 5GB) of the most often viewed files (for offline viewing) instead of having all of them on those devices? I'm asking this because those tablet PCs have a rather limited storage capacity (and are also limited on internet connection quite often too).

Here are some tag... Read more

A:How to share, auto-sort, cache videos/photos offline view?

Any news regarding these questions, please?.. *bump*

Read other 1 answers
RELEVANCY SCORE 50.8

Hey Everyone,

I am having a huge issue at the moment where our shared files are being encrypted by a virus/trojan. This incident started this morning and was discovered in the afternoon but unfortunately most of the files (around 20-40 GB) were encrypted by this virus. The infected files are Pictures, Excels, Words and PDFs and the processes that likely were responsible for the encryption were shutdown and moved to a temporary folder.

The suspicious processes that were running were:
hovynqoruhup.exe
ynecyc.exe
heap.exe
Heogbawcyhobbb.exe

Using ESET Anti-Virus, they are identified as:
Kryptik.BORN
Kryptik.UDL
Kryptik.BOSI

My question is - how can get my files back?? (I do have some copies of the original files before encryption)
- Are there decrypters out there for these viruses?

I believe this is something that many of you guys here have seen and experienced, if you could share your solutions I would very much appreciated.

Thanks!

-T

A:Files Encrypted by Trojan/Virtus, Looking for ways to decrypt files

Hello and Welcome to TSF.

If you haven't already, please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

Unfortunately, at this time there is no way to decrypt those files without paying the ransom.

To prevent more files from being encrypted, disconnect the infected computer from the internet.

If you haven't already, when you disconnect you may be presented with a screen from the malware writers telling you to pay to get your files decrypted.

Do not run any malware removal tools unless asked by me.

We may be able to recover some or all files from your Shadow Volume Copies, unless the infection has already deleted them.

Do you have another machine that you can use to download the tools to USB drive and transfer them to the desktop of the infected computer?

If so, we want all our members to perform the steps outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help - Tech Support Forum

After running through all the steps, you shall have a proper set of logs. Please post/attach the logs in your next reply.

If you have trouble with one of the steps... Read more

Read other 2 answers
RELEVANCY SCORE 50.8

Hello,

I am a technology consultant helping my client with a very infected pc- I have full remote access to the box and he is available if I have to run something on the box with no network.

His pc became infected with some ransomware scam - the main txt file reads:
 

Your documents, photos, databases and other important files have been encrypted
with strongest encryption and unique key, generated for this computer.

Private decryption key is stored on a secret Internet server and nobody can
decrypt your files until you pay and obtain the private key.

If you see the main locker window, follow the instructions on the locker.
Overwise, it's seems that you or your antivirus deleted the locker program.
Now you have the last chance to decrypt your files.

Open http://43qzvceo6ondd6wt.onion.cab or http://43qzvceo6ondd6wt.tor2web.org 
in your browser. They are public gates to the secret server. 

If you have problems with gates, use direct connection:

1. Download Tor Browser from http://torproject.org

2. In the Tor Browser open the http://43qzvceo6ondd6wt.onion/
Note that this server is available via Tor Browser only. 
Retry in 1 hour if site is not reachable.

Copy and paste the following public key in the input form on server. Avoid missprints.
6K4VBU7-5F45EMO-RDHIDWD-2NUDTWJ-FFZEMGH-2XN24LO-ST2ZTV3-HN2YDM2
UUA2W7C-S6WQGQY-CDANXRT-IHHNKUD-P7GTI7D-TWP3L2M-23R4NW4-TAYTSBX
UAR6HNU-J55JLSN-BAJ6CI3-TOIORZV-XM373T2-SMFTJ7E-HSECWDG-TR22W... Read more

A:Help! Hijacked Files Encrypted - all files renamed with .askyneh (ransomware sca

Hi there,
It appears that you have been infected with CTB-Locker - and unforunately it is a very real ransomware.
Please read below for more information.

The newest variants of CTB-Locker typically encrypt all data files and rename them as a file with a 6-7 length extension with random characters. The newer variants also do not always leave a ransom note if the malware fails to change the background, like it generally does. Compounding matters, the newer CTB-Locker infection has been seen in combination with KEYHolder, TorrentLocker (fake Cryptolocker) or CryptoWall ransomware. Unfortunately, there is still no known method of decrypting your files without paying the ransom and with dual infections, that means paying both ransoms.
A repository of all current knowledge regarding this infection is provided by Grinler (aka Lawrence Abrams), in this tutorial: CTB Locker and Critroni Ransomware Information Guide and FAQ
There is also an ongoing discussion in this topic: CTB Locker or DecryptAllFiles.txt Encrypting Ransomware Support & Discussion.

If you have any questions, it is best that you post in the discussion topic mentioned above.
To avoid confusion I have asked a Moderator to close this topic. Good luck.
Regards,
Alex

Read other 1 answers
RELEVANCY SCORE 50.4

Hello,
System is a Toshiba Satellite L755-S5353 Windows 7 Home Premium 64-bit. Intel Pentium CPU B950 @ 2.10GHz 4GB RAM.

This laptop came into my shop with the FBI screen. After making full backup and scanning with Malwarebytes, Superantispyware, and Symantec Endpoint Protection on my "Server" I was able to actually use the laptop again. But when i go into my documents everything has a .html file extension.

If it is a word document, the file looks like this: "xxxx.docx.html." When I try to open the file it opens up Internet Explorer with a Decrypt Protect screen. Which I know is fake because it is asking me to pay a fee. The link it opens is http://mblblock.in/index.php. I tried to remove the extension but when i try to open the doc or jpeg is says it is corrupted.
Also ran rkill which found nothing. The Antivirus on the machine is McAffee.
I have looked at the backup i made before i did anything and still can open those files from the backup.

I completely reloaded the machine because my customer was in need of the computer. I do have a full backup and still have access the files I want to get back.

Any help would be appreciated!

Mitchell

A:Ransomware encrypted my files. All files have .html extension

You need a cryptography specialist! never had a ransomeware case before. Looks like a real mean piece of malware! Encrypting all your docs and wont give them back untill you pay...

It's ruder than hard disk failure!

Read other 9 answers
RELEVANCY SCORE 50.4

Hello,
System is a Toshiba Satellite L755-S5353 Windows 7 Home Premium 64-bit. Intel Pentium CPU B950 @ 2.10GHz 4GB RAM.

This laptop came into my shop with the FBI screen. After making full backup and scanning with Malwarebytes, Superantispyware, and Symantec Endpoint Protection on my "Server" I was able to actually use the laptop again. But when i go into my documents everything has a .html file extension.

If it is a word document, the file looks like this: "xxxx.docx.html." When I try to open the file it opens up Internet Explorer with a Decrypt Protect screen. Which I know is fake because it is asking me to pay a fee. The link it opens is http://mblblock.in/index.php. I tried to remove the extension but when i try to open the doc or jpeg is says it is corrupted.
Also ran rkill which found nothing. The Antivirus on the machine is McAffee.
I have looked at the backup i made before i did anything and still can open those files from the backup.

I completely reloaded the machine because my customer was in need of the computer. I do have a full backup and still have access the files I want to get back.

Any help would be appreciated!

Mitchell
 

A:Ransomware encrypted my files. All files have .html extension

decmblblock.exe Download Link!!!! This tool fixed the problem!!!

I downloaded the tool and ran it. I removed all the folders it wanted to search except the external i have the back up on. Took around 30 minutes to complete and could view those files again. All word docs, jpegs, and audio files work again.

I notice now i have duplicates of all files. One with the file extension .html(BAD) and one with the actual file extension(GOOD). Now all i have to do is delete the bad files and everything will look like normal again.
:NOTE:

I ran this tool from MY computer. I plugged the backup drive into my computer via USB Adapter
 

Read other 1 answers
RELEVANCY SCORE 49.6

Hi,
 
My company has contracted a ransomware on a computer that was attached to a virtual drive on a server. Although the server couldn't get infected, its virtual drive files (which is a repository) got encrypted.
 
Since I have a couple of files that I had backed up and therefore have the original copies, does a program exist whereby I could load the original file and the encypted file and the program deduces the private key so that it can decrypt the rest of the files?
 
I do not need to remove the malware since I have already done so myself.
 
Thank you,
 
Immortali

A:Retrieve encrypted files if have some original files

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.
We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.
To help Bleeping Computer better assist you please perform the following steps:
*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/529529 <<< CLICK THIS LINK
If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.
***************************************************If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of t... Read more

Read other 2 answers
RELEVANCY SCORE 48.8

i m unable to access any encrypted wifi on my pc
WPS PSK2 is not accessable 
plz. hlp me out

Read other answers
RELEVANCY SCORE 48.4

My offline files seems to work offline all the time, even when it shows me being online. I sync most of my business files to my laptop for working at home at night.

When I edit a file from my Win 7 (pro, 64-bit) laptop, then go to edit it again, I get the version I had changed, but no one else does. This is causing huge difficulty, because my employees will start working in a sales forecast spreadsheet after I reconnect to the network and supposedly sync, but they don't get the latest version. Even doing a manual sync seems to make no difference.

It seems that if someone else edits something on the network share, it does update to my laptop, but when I update something, it doesn't transfer so that everyone else can use it?

Where should we begin looking?

A:Offline files doen't update files changed locally

It may help if you enable transparent caching which can be enabled through Group Policy. I'm not sure this is the same problem but it seems to apply to your problem.

Windows 7 introduces a new feature for Offline Files & Folders called “Transparent Caching”. With transparent caching, the first time a user opens a file in a shared folder, Windows 7 reads the file from the server and then stores it in a cache on the computer’s hard disk drive.

The second and subsequent times a user reads the same file, Windows 7 retrieves the cached file from disk instead of reading it from the server. To provide data integrity, Windows 7 always contacts the server to ensure the cached copy is up-to-date.

The cache is never accessed if the server is unavailable and updates to the file are always written directly to the server. Transparent Caching is not enabled by default and can be enabled through Group Policy at Computer configuration | Administrative Templates | Network | Offline Files | Enable Transparent Caching.

Read other 2 answers
RELEVANCY SCORE 48.4

Hello all, 
I've deployed  Offline files through group policy and setted up slow link when connection speed is below 10Gbps, just everytime.
Folder si offline but when I add new file the file is synced to server within 10 or 20 minutes. I've checked last sync interval but it didn't change. It isn't same as time when file was uploaded to server. Last sync was eq. 16:00 but file was uploaded at
16:15.
Folder is still offline. How is it possible?
THank you.

Read other answers
RELEVANCY SCORE 48

Help please I am a single mom who is a beginning photographer and I lost all of my files to ransom virus.  I have no pictures of my son printed or my work its all on here, I was distraught my mother took my computer to best buy because we did not know what to do they deleted the virus and put new protection on it but said they could not unencrypt the files but they are still on my computer as jpegs but I can not see them what do I do?  Help please im begging I don't know what to do!

A:encrypted files

Hey my friend. Can you tell me the extensions of the encrypted files. Being honest I think you can forget the encrypted files ... you have to be really, really lucky if you can encrypt them.Please download FRST (by Farbar) from the link below and save it to your Desktop.Download Mirror #1If you are unsure whether you have 32-Bit or 64-Bit Windows, see hereDisable all anti-virus and anti-malware software to prevent them inhibiting FRST in any way. If you are unsure how to do this, see THIS.Double-click FRST.exe/FRST64.exe (depending on which version you downloaded) to run it. (if you have Windows Vista / Windows 7 / Windows 8: Please do a Right click on the FRST icon and select Run as Administrator)When the disclaimer appears, click Yes.Click Scan to start FRST.When FRST finishes scanning, two logs, FRST.txt and Addition.txt will open.Copy (Ctrl+C) and Paste (Ctrl+V) the contents of both of these logs into your next post please.

Read other 2 answers
RELEVANCY SCORE 48

Please let me know if i can decrypt my files
 

Read other answers
RELEVANCY SCORE 48

Windows 7 Home Premium
 
All text, documents, pdf files, etc. have been encrypted and can no longer be opened by the parent application. Any folder which contains encrypted files have decryption instructions filed as follows (in .txt and .html files):
 
=========== beginning of file ===========
2C7279099A4A9644C6FCC18573AB94EB
 
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048 using CryptoWall.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
 
 
What does this mean ?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them,
it is the same thing as losing them forever, but with our help, you can restore them.
 
 
How did this happen ?
Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.
All your files were encrypted with the public key, which has been transferred to your computer via the Internet.
Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
 
 
What do I do ?
Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.
If you really value your data, then we suggest you do not waste valuable time searching for othe... Read more

A:Files encrypted by ???

You were infected with CryptoWall. All information about this infection can be found here:http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information

Read other 1 answers
RELEVANCY SCORE 48

Hey everyone,
I encrypted some avi files months ago. Before I reinstalled Windows XP Pro, I moved all files to an external hard drive. Now I cannot play any of those encrypted files with media player. I can't delete or move them. I can't decrypt them either. This is the message I get:

'Windows Media Player cannot access the file. The file might be in use, you might not have access to the computer where the file is stored, or your proxy settings might not be correct.'
Does anyone have a solution? I tried a few things I read on the internet but none worked. Oh yeah, the name of the files are highlighted in green.....I guess its an indicator that the files are encrypted. Please help me. Thanks in advanced.

A:Encrypted Files..help Pls

Bad news I guess.....I installed Advanced EFS Data Recovery 1.0. When I ran the program it identified the files as not decryptable. Is this the end or is there some other solution?

Read other 8 answers
RELEVANCY SCORE 48

I just noticed this morning that some of the word documents on my desktop are opening incorrectly - sample attached. How do I fix that please? It seems to be encrypted and I've no idea how it happened.

Uhmmmm - it wont let me upload it - Ping.JPG.encrpted: Invalid file.

As you can imagine, it's all double dutch inside the file.

I've just taken a snapshot of one of the files

A:Encrypted files?

Theres a chance you have the crypto virus - anything else happening on the machine
any other documents encrypted ??

Have you open any strange email attachments ?

Read other 6 answers
RELEVANCY SCORE 48

I just noticed this morning that some of the word documents on my desktop are opening incorrectly - sample attached. How do I fix that please? It seems to be encrypted and I've no idea how it happened.

Uhmmmm - it wont let me upload it - Ping.JPG.encrpted: Invalid file.

As you can imagine, it's all double dutch inside the file.

I've just taken a snapshot of one of the files

A:Encrypted files?

Theres a chance you have the crypto virus - anything else happening on the machine
any other documents encrypted ??

Have you open any strange email attachments ?

Read other 3 answers
RELEVANCY SCORE 48

message across my desk top that says All my files were protected by a strong encryption with RSA4096. They were encrypted  both public and private. how do i restore my data

A:My files have been encrypted

Hi, Do you know what variant of ransomware is involved? The chances of recovering your data are bleak. Good offline backups are the only safeguard against this type of malware. Jay

Read other 1 answers
RELEVANCY SCORE 48

Dear Sir,

After recovering my data files from a defected HD, some of my files was encrypted. So is there any way to open it on my new HD deployed.

The old one has a Windows 7 Ultimate installed and the actual one is Windows 8.1.

Regards & Thanks.

Chady

A:Encrypted files

What did you use to encrypt the files?

Read other 7 answers
RELEVANCY SCORE 48

About 1/3 of my jpgs files were unintentionally encrypted. I learned about this
after my XP Pro OS totally crashed and was replaced by another XP Pro OS.
I had backed up all my files on a stand alone hard drive. When i attempted to
transfer the jpgs to the new OS, they were blocked. Looking at the files,
I noticed that the ones in green were encrypted. I'm no techie, but I checked
the "advanced" "security" "permissions" section of the files and they matched the jpg files the were not encrypted. Can anyone explain why some of the
jpgs encrypted while others didn't and why they both have the same permissions? Thanks

A:Encrypted JPG files

The "permissions" status has nothing to do with file encryption.

Read other 4 answers
RELEVANCY SCORE 48

I have some Encrypted Files, That I can't open.

I know what password I would have used, but theres no place to give it one.

The files appear green in windows explorer.
Thanks,

Nick
(Feel free to move this to the correct forum, if this isn't the right one.)
 

A:Encrypted Files

um.... what kind of file is it? what is the extension?
 

Read other 2 answers
RELEVANCY SCORE 48

I recently replaced my surface pro 4 and I copied all my data to a USB, changed computers and copied all my data to my bee computer. My old computer is gone. However, there were some files on the old computer that I had encrypted and as such I can't access them now. Is there any way to decrypt the files without access to my old computer?
 

Read other answers
RELEVANCY SCORE 48

Hi,
 
I have been guided to you guys to hopefully help.
 
A message just came up saying my personal files are encrypted and I must pay a fee to get them released.
 
How can I remove this malware and decrypt my files.
 
How do I know which encryption malware I have? I have a screen shot I can upload but don't know how to attach this?
 
 

A:Encrypted files

Did you find any ransom note? These infections are created to alert victims that their data has been encrypted and demand a ransom payment. Check your documents folder for an image the malware typically uses for the background note. Check the C:\ProgramData (or C:\Documents and Settings\All Users\Application Data) for a random named .html file.Does it look like one of these or something else...?* PClock* CryptoFortress* TorrentLocker* CTB-Locker* KEYHolder* CryptoWallIf the ransomware does not look like any of those in the above links...reading through the following information may assist with identifying the crypto malware infection you are dealing with.List of BC Crypto malware Information Guides, FAQs, news, support and discussion topicsOnce you have identified which particular ransomware you are dealing with, we can direct you to the appropriate discussion topic for further assistance.

Read other 3 answers
RELEVANCY SCORE 48

An attorney client of mine came in Monday morning and found his .doc, .wpd, and .pdf files all encrypted. I had set him up a Synology NAS back in November and begin to use Glacier Backup. I also read on Monday about the SynoLocker attack on Synology NAS devices. Indeed, the operating system DSM 4.3-3810 was what we (my client) were running. I never saw any type of ransom note or announcement that we had been hacked. However, the many thousands of files residing on the server had been changed to a date of 8/4/2014 and attempts to open them only resulted in a request for the file to first be converted.  Seeing the newly dated files, the Glacier Backup from the previous day had already been busy updating its locker with the now corrupted files.
 
I have restored what good files I can, but many important files, had only the encrypted backup files. I read on this forum yesterday a quite lengthy and informative discussion about recovering encrypted files and I downloaded the Anti-CryptorBitv2.zip file and attempted to recover my bad files. Still no positive results. I do have the folks at Synology looking into this, but so far, nothing. My client was asking about the ransom, ready to pay, to recover his very important client files. 
 
If not a SynoLocker attack, does anyone have any idea what it could be and how I can recover these files?

A:Encrypted Files

Bleeping Computer's SynoLocker ransomware topic is here.A repository of all current knowledge regarding Cryptolocker is provided by Grinler (aka Lawrence Abrams), in this tutorial: CryptoLocker Ransomware Information Guide and FAQCryptoLocker is a ransomware program that will scan all physical or mapped network drives on your computer and encrypt files with the following extensions using a mixture of RSA & AES encryption.*.odt, *.ods, *.odp, *.odm, *.odc, *.odb, *.doc, *.docx, *.docm, *.wps, *.xls, *.xlsx, *.xlsm, *.xlsb, *.xlk, *.ppt, *.pptx, *.pptm, *.mdb, *.accdb, *.pst, *.dwg, *.dxf, *.dxg, *.wpd, *.rtf, *.wb2, *.mdf, *.dbf, *.psd, *.pdd, *.pdf, *.eps, *.ai, *.indd, *.cdr, *.jpg, *.jpe, *.jpg, *.dng, *.3fr, *.arw, *.srf, *.sr2, *.bay, *.crw, *.cr2, *.dcr, *.kdc, *.erf, *.mef, *.mrw, *.nef, *.nrw, *.orf, *.raf, *.raw, *.rwl, *.rw2, *.r3d, *.ptx, *.pef, *.srw, *.x3f, *.der, *.cer, *.crt, *.pem, *.pfx, *.p12, *.p7b, *.p7c.A repository of all current knowledge regarding CryptorBit and HowDecrypt is provided by Grinler (aka Lawrence Abrams), in this tutorial: CryptorBit and HowDecrypt Information Guide and FAQCryptorBit (HowDecrypt) is a ransomware program that encrypts any data file it finds regardless of the file type or extension (i.e. JPG, PST, MP3, PDF, .DOC, .XLS, .XLSX, .PPTX, .and DOCX documents). When it encrypts a file, CryptorBit (HowDecrypt) will create a HowDecrypt.txt file and a HowDecrypt.gif in every folder that a file was encrypted. The GIF and TXT files w... Read more

Read other 1 answers
RELEVANCY SCORE 48

Hello to everyone, i'd like show you a file, i thank it's encrypted..
One of my customer has found many pdf files (and doc too) renamed with another format (.diyucog), there were no viruses in his computer and do not know what this extension...
unfortunately all files are small..
i have uploaded one of these files, can you help me to know if are encrypted or what?
 
http://www.filedropper.com/ris14ex1pdf
 
Thank you and have a nice day

A:Maybe Encrypted Files

The newest variants of CTB Locker typically encrypt all data files and rename them as a file with a 6-7 length extension with random characters. A repository of all current knowledge regarding CTB Locker and Critroni Ransomware is provided in this tutorial: CTB Locker and Critroni Ransomware Information Guide and FAQMore information in these articles:New CTB-Locker campaign underway increased ransom timer and localization changesNew Critroni variant offers free test decryption and now uses CTB2 extensionCompounding matters, the newer CTB-Locker infection has been seen in combination with KEYHolder or Torrent Locker ransomware. Unfortunately, there is still no known method of decrypting your files without paying the ransom and with dual infections, that means paying both ransoms.There is also an ongoing discussion in this topic: CTB Locker or DecryptAllFiles.txt Encrypting Ransomware Support & Discussion. Rather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions, comments or requests for assistance in that topic discussion.ThanksThe BC Staff

Read other 1 answers
RELEVANCY SCORE 48

All my Windows server 2012 files encrypted and ended by .snatch , even the backup files in veem server encrypted too
how can I decrypt my file please ?

Read other answers
RELEVANCY SCORE 48

Hi everyone, I'm new to the forums.

Excuse my language, but I recently had my computer reformatted by a ****ing idiot IT member who did not back up a single thing. I'm a graphic designer and I lost all my fonts (as in, they are no longer with me and I have no hopes of retrieving them) and and about four projects that were well on their way to being completed.

But that's not important right now.

I had all of my work on a slave drive. For some reason, I decided to encrypt it (actually, I encrypted more than just my work. Random bits of my music collection, various programs, pictures, etc. are also encrypted) and now I can't access any of them.

I tried taking ownership of the files (I disabled Simple File Sharing and then went into the Security tab and did the Owner process, and when I try to clear the checkbox for keeping the file encrypted, I'm denied access.) That's not working.

So, what do I do? Am I in deep trouble, never to see my files again? Please help me. I really need my stuff back.
 

Read other answers
RELEVANCY SCORE 48

Hi

I am sorry if I have posted in the wrong forum...

I have stumbled upon a problem. I have not found a source executable but have alot of encrypted files. The encrypted files has an email appended to the filename. I have found the source user because his user folder has encrypted files. But I can't find any ransom instructions!

Files encrypted has the following file extensions txt, xls, pdf, sql, jpg, mp3, wmv, doc, ppt, gho, xlsm, zip, spf, avi, rar, sldprt, mdb, iso, xml, pdb, rtf (probably more).

What kind of malware could this be?
 

A:Encrypted files

For malware help post here. Malware Removal Assistance
 

Read other 5 answers
RELEVANCY SCORE 48

Hi Quietman7 I have the same problem. My files have .encrypted at the end I also have a ransom note if you need more info to point me in the right direction, thanks

A:Files Encrypted

to Bleeping Computer.You are dealing with TorrentLocker which pretends to be CryptoLocker. Any files that are encrypted with TorrentLocker will have .encrypted appended to the end of the filename. When the encryption process is done, all of your computer drive letters will display a window that contains the ransom note and instructions on how to get your files back.A repository of all current knowledge regarding TorrentLocker is provided by Grinler (aka Lawrence Abrams), in this topic: TorrentLocker (fake CryptoLocker) Ransomware Information Guide and FAQMore information in these articles:* Analysis of ‘TorrentLocker’ – A New Strain of Ransomware Using Components of CryptoLocker and CryptoWall* Cryptolocker variant Torrentlocker making new victims in NL* TorrentLocker Ransomware Cracked and Decrypter has been madeThere is also an ongoing discussion in this topic: TorrentLocker Ransomware (CryptoLocker copycat) Support and DiscussionRather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions, comments or requests for assistance in that support topic discussion. Doing that will also ensure you receive proper assistance from our crypto malware experts since they may not see this thread. To avoid unnecessary confusion...this topic is closed.ThanksThe BC Staff

Read other 1 answers
RELEVANCY SCORE 48

I have a top level folder where all folders, subfolders and files are encrypted.
I purchased these Adobe Lightroom tutorials which are mainly Quicktime formatted. The folders also contain several PDF files. These files where received as Zip files and extracted by me. The folder and file names display with green text.
My backup software skips all encrypted files and I am not allowed to copy these files to another location. I tried using file properties to remove the encryption but this failed.
Attempting to copy any of these files gets me a "File Access Denied" dialog. See screenshot jpg.

Thanks for any help, Floyd.

A:Encrypted Files

It appears that the files were NTFS encrypted by an account other than your own and you thus have no access to them. The account is not identified by name because it does not exist on your computer. You will not be able to open these files. You need to contact whoever sold you the tutorials.

Read other 2 answers
RELEVANCY SCORE 48

all files encrypted with this message:
 
"Warning !! You have a computer found pirated content! All your files are encrypted! To decrypt files you need visit the site
http://utrozen.pixub.com and follow the instructions posted on it. If the site is for some reason unavailable
refer to the [email protected] Your id 335495.
 
You can enter a password 5 times. above this
limit, all files will be deleted! Independent attempts to decrypt the data can lead to Their loss. "

 
 
This virus has infected my coputer. This is the Trojan horse TR / Crypt.Xpack.171354.He has encrypted all files. Avira has found that this virus has encrypted my files.
I cleared the virus. But how do I decrypt files?
thanks
Rob

A:All files encrypted

The BC staff has advised our Security Colleagues who specialize in crypto malware ransomware with a link to this topic.Please submit a sample of an encrypted file here: http://www.bleepingcomputer.com/submit-malware.php?channel=3with a link to this topic.You can also submit samples of suspicious executables or any malware files that you suspect were involved in causing the infection. Doing that will be helpful with analyzing and investigating.These are common locations malicious executables may be found:%Temp%%AppData%%LocalAppData%%ProgramData%%WinDir%

Read other 8 answers
RELEVANCY SCORE 48

Recently some damage happened to a user account with lots of encrypted files (virus or something), and now the files aren't accessible, even with that account (which is the original account that encrypted the files in the first place). When trying to decrypt the files, all I get is 'access denied'.

There is a program, 'Advanced EFS data recovery' by Elcomsoft, which can recover the files, however it costs an arm and a leg and I'm wondering, if that program can recover the files then surely why can't I?

The program searched for a 'certificate' (it scanned the whole drive) with which to decrypt the data, I'm wondering, once I have this certificate to hand how I can decrypt the data manually with it?

This data is very important so any help is much appreciated.

Thanks in advance

A:Encrypted files

You mean you'd created a 'certificate' to encrypt your files, then never backed it up on a usb stick drive...

On the first crash/damage, you couldn't recover those files unless taking back the certificate.

If you are on 7 Ultimate you can use that EFS Application Tab:

-Encrypt or Decrypt a Folder or File - Vista Forums

-Encrypted File System (EFS) Certificate Backup - Vista Forums

-Encrypted File System (EFS) Certificate Restore - Vista Forums

Those tutorials might give you an hand...

Read other 4 answers
RELEVANCY SCORE 48

Dear All
 
Yesterday my system effected with virus and it has changed all my docs, jpgs,picture,movies extenstion to ECC. i was not aware about this virus and i format my C drive and reinstall the new windows.I though that it would remove after formatting the hard disk partition where my windows install but unfortunatly my all files are remain same after installing the new windows.
 
Please advice how to restore my all files in actual format.
 

A:Encrypted files (.ecc)

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.
We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.
To help Bleeping Computer better assist you please perform the following steps:
*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/573899 <<< CLICK THIS LINK
If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.
***************************************************If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of t... Read more

Read other 7 answers