Como descriptografar arquivos criptografados por 'Space Rangers AOL.COM Ransomware'?

Question

Meu sistema Windows Server 2012 R2 foi infectado pelo ransomware 'Space Rangers AOL.COM' e todos os arquivos foram criptografados. Todos os arquivos têm extensão com '.wallet'.

Existe uma maneira de descriptografar / recuperar os arquivos? Infelizmente não tenho arquivos de backup.

    

Answer 1

Alguns recursos que podem ajudá-lo são os seguintes:

• O ID Ransomware é um site que tenta identificar a ameaça específica de ransomware em que você foi atacado, analisando a nota de ransomware exibida em seu computador. computador ou um arquivo criptografado de amostra. Do site:

Upload a ransom note and/or sample encrypted file to identify the ransomware that has encrypted your data.

Também é capaz de fornecer informações sobre os próximos passos a seguir se houver métodos conhecidos para descriptografar seus arquivos, embora o próprio site não forneça este serviço:

This service is strictly for identifying what ransomware may have encrypted your files. It will attempt to point you in the right direction, and let you know if there is a known way of decrypting your files.

• O No More Ransom é um site lançado por várias organizações de segurança, incluindo a Kaspersky e a Intel Security. Ele fornece links para ferramentas para descriptografar arquivos atacados por várias ameaças do Ransomware (visite o site para ver a lista atual). Do site:

If you have been infected with one of these types of ransomware click on the link under its name and it will lead you to a decryption tool

Este site também tem informações sobre prevenção de um ataque de ransomware , reproduzido aqui por conveniência:

1. Back-up! Back-up! Back-up! Have a recovery system in place so a ransomware infection can’t destroy your personal data forever. It’s best to create two back-up copies: one to be stored in the cloud (remember to use a service that makes an automatic backup of your files) and one to store physically (portable hard drive, thumb drive, extra laptop, etc.). Disconnect these from your computer when you are done. Your back up copies will also come in handy should you accidentally delete a critical file or experience a hard drive failure.
2. Use robust antivirus software to protect your system from ransomware. Do not switch off the ‘heuristic functions’ as these help the solution to catch samples of ransomware that have not yet been formally detected.
3. Keep all the software on your computer up to date. When your operating system (OS) or applications release a new version, install it. And if the software offers the option of automatic updating, take it.
4. Trust no one. Literally. Any account can be compromised and malicious links can be sent from the accounts of friends on social media, colleagues or an online gaming partner. Never open attachments in emails from someone you don’t know. Cybercriminals often distribute fake email messages that look very much like email notifications from an online store, a bank, the police, a court or a tax collection agency, luring recipients into clicking on a malicious link and releasing the malware into their system.
5. Enable the ‘Show file extensions’ option in the Windows settings on your computer. This will make it much easier to spot potentially malicious files. Stay away from file extensions like ‘.exe’, ‘.vbs’ and ‘.scr’. Scammers can use several extensions to disguise a malicious file as a video, photo, or document (like hot-chics.avi.exe or doc.scr).
6. If you discover a rogue or unknown process on your machine, disconnect it immediately from the internet or other network connections (such as home Wi-Fi) — this will prevent the infection from spreading.