jollyn asked 4 years ago
All my data in my pc was ecrypted by Malware that changed the extention dmfl, like bellow image
imgur.com/m4XM91K
So, i tried to remove and it might be successful. but i failed to decrypt my data
PersonalID contains this text.
——————————————————————————————–
ATTENTION!
Don’t worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-egvXx8HqOt
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
helpmanager@mail.ch
Reserve e-mail address to contact us:
restoremanager@airmail.cc
Your personal ID:
0272omflAsdhkiHB0BeOYp11e96WUUdLVpUDghIAtVFD8udSrf0DNV
———————————————————————————————–
PersonalID file have this key below
HB0BeOYp11e96WUUdLVpUDghIAtVFD8udSrf0DNV
As a result of running decrypt_STOPDjvu, this log was made.
File: C:\$Recycle.Bin\S-1-5-21-443403463-1245195482-3657680235-1001\$RWD529I\rss.dat.omfl
Error: No key for New Variant online ID: HB0BeOYp11e96WUUdLVpUDghIAtVFD8udSrf0DNV
Notice: this ID appears to be an online ID, decryption is impossible
i read the guide that online ID encryption is unable to decrypt, so let me try other software shadow explore or qphotorec.
I try to run other program, shadow explorer , but some problem just like below image is being.
i visited shadow explorer website to check the faq and found same problem, but it was not my case.
imgur.com/5yy9ov2
What Can I do for recovering my data?
sorry for my poor english, but i can understand english text perfectly.
please help me.
Myantispyware team Staff answered 4 years ago
If the list of restore points is empty, then the ransomware virus has deleted all shadow copies. In this case, the last opportunity to recover encrypted files is to use PhotoRec.
