Hi guys 1 of my server system is got encrypted with ransomware with extension .1btc

If you guys have any idea that if there is any decryptor is available do let me know.

The ID of ransomware is ID R8W2RM4578DXTX48

As per my knowledge this ransomware is from Lockcrypt family.

 

https://www.removeallvirus.com/delete-1btc-virus-pc-recover-locked-files

 

F** Mofos ... Cowards stilling from the poors ..

 

Yeah they are asking for 2 bitcoins which is around 10000 $ i think

 

Do you know how the virus got in to your system? Doesn't help you much, but may save someone else.

 

it came from Brute RDP which is windows remote desktop protocol. RDP usually used to remotely access your server machines with port 3389 but i dont know how they are exploiting RDP
some ransomware exploits some email ports to enter your system but this .1BTC ransomware is exploiting only RDP as of now.SO main target is machines running microsoft server 2012 and 2008 as of now

 

2 bitcoins is $23,400 USD right now.

I'm sorry to hear about your woes, my friend. Is there any way to get your machine offline, pull out the hard drive, then use a disk docking station to retrieve your important stuff; then perform a format and reinstall of windows?

If so, this is your best bet. Just be careful to not spread the virus onto another machine.... Perhaps use safe mode on the other computer while reading/retrieving your files.

 

Last edited: Feb 20, 2018

I already remove this virus.But the files are still encrypted

 

https://malwaretips.com/blogs/remove-your-personal-files-are-encrypted-virus/

 

teach your server not to visit porn sites while on duty. creepy stuff, havent seen anything like this in real. my last virus infection was on purpose back in 99 - you need to take care of your network security - seriously. if you run windows you need anti malware/virus on every maschine connected directly or indirectly to the web. and switch to another os on your server as theres nothing ms servers do better than linux

 

Last edited: Feb 20, 2018

Haha seems like you never ever visited or learn about how IT infrastructure works. Check about wanna cry ransomware which shook half of the world last year.It didn't even spare the hospitals all data got encrypted.
Do you think that hospital archival data server was visiting porn sites . It can happen to everybody. It didn't happen to you because most of the time they target corporate world not the local computers.

 

If you knew anything about it you wouldnt get infected in first place, youd had your server up and running in no time without serious data loss and wouldnt ask for a solution on an audio forum

 

Dont provoke me to write anything nasty.

I know how things work and i was just asking for decryptor.
Since its warez site so i was expecting if somebody is having any idea for decryptor.
And mind you they sent ransomware in disguise of far cry crack.so you never know.
So beware nexttime

 

Last edited: Feb 21, 2018

just infect you network with senseFULL viruses like a bitcoin digger....

 

Ransomware is bad, but:

No backup?
Your fault!

Especially on _servers_ !

 

I have backup

Otherwise i would be like

 

Your best option now would be to just wipe it down, restore, and lock it down.

Unless you have both keys to the cypher and the algo [you have the short key: R8W2RM4578DXTX48] decrypting it without the long key which could be anything is a fool's errand. Things like this is why distributed clustered RNDs are becoming more important.

I want to wax and wane poetic about MS Server vs SE *NIX but as it will do no good now and maybe not even be up to you - I recognize that it would be in poor taste.

 

Being a Windows OS user, I am too much familiar with .1btc Ransomware attack. Because somedays ago, my System files also locked with .1btc file extension. I was also too much worried and like you I also didn't want to pay ransom fee. I shared my problem with one of the my friend who is a technical expert. He advised me an appropriate .1btc Ransomware removal instruction. If you are also want to deal with such a ransomware attack then you must visit - http://www.removemalwarevirus.com/eliminate-btc-ransomware-easy-way-to-delete-btc-ransomware

 

Perhaps use a Debian Live CD instead. That is something most of the viruses wouldn't even understand.

 

You've never posted here before, sorry if I'm wrong but clicking on your link is the last thing we should do.
especially in retrospect of this topic.