Hello all. For those of you who are so active in online world, it is something common to hear about ransomeware. Ransomeware can be so dangerous for our data and it can cause a huge effect to our privacy. Its variants are also updated, started from usual ransomeware until the most sophisticated ones such as CTB Locker. CTB locker is a ransomware which will lock your files from your PC until you pay the ransom in order to unlock your files. CTB Locker encrypts your data files, and you need to get the key to decrypt or open your locked files.
If the files have been encrypted, you will be required to pay for certain amount of money. But if you don’t want to pay, you still have many options to unlock your files. Here are 4 methods to open or decrypt the files which have been infected by CTB Locker virus:
Method 1: Backup
The first step that you can do to return your encrypted data is to backup your data as the prevention. If you have backed up your data, you should use the backup to return back your data. This step is useful to clean up the files from CBT locker virus if the backup has not been infected.
Method 2: File Recovery Software
When CTB Locker encrypts the first file and the user makes a backup, encrypt the backup, and then delete the original back up, you can use the recovery file software such as R-Studio or PhotoRec to restore some files which are infected by CBT Locker virus. It is important to be noted that the longer you use your PC after the infection, the harder for recovery file program to restore the encrypted files.
Method 3: Shadow Volume Copies
You can try to restore the files by using the Shadow Volume Copies. But unfortunately, this infection will try to clean up the Shadow Volume Copies on your PC, but in some cases, CTB Locker even sometimes failed to do that, so, using this tool is still recommended to restore your files.
Steps to Restore the Encrypted Files by CTB Locker Using Shadow Volume Copies
1. Download and install Shadow Explorer.
2. Open Shadow Explorer. From your drop-down list, you can choose one of the available Shadow Copies. Choose the updated drive and date that you want to use.
3. Righ-click the encrypted files or all folders and export all of them. You are then required to choose whether you want to restore the files or not, just choose restore. I hope the steps above can help you to restore your files that have been encrypted or at least some of them.
Method 4: Open the file that has been infected by CTB Locker virus by te94decrypt
1. Download this tool from this link
2. Save the copy of encrypted files into USB drive. Test this tool in 3 infected files.
3. Copy the files on your USB root drive.
4. Click [Windows Key] [R] on keyboard or open the Run command from Start Menu.
5. Type this parameter. This assumes that your USB drive is E:
E: \ te94decrypt.exe -k 85
Note: If the parameter doesn’t work, try the alternative like -k 87, -k 88, -k 90, -k 106, or -k186.