How to cure all files from a virus that adds the .value extension?

Question

Encryption

Hello!
The secretary opened the letter, all her files were renamed, and some garbage was registered in them, when opening, even after we return the extension, there is still information that you need to send SMS and all that.
Who faced? Do you have detailed instructions on how to win? Or maybe someone in the teamviewer mode can help solve the problem?

Answer 1

As a rule, even anti-virus companies are no longer able to help, since ransomware makes it impossible to decrypt without a key that (maybe) is in the ransomware.
If shadow copies were not enabled, you can say goodbye to these files with 99.9% probability.

Answer 2

No way.
For the future habrahabr.ru/post/101971

Answer 3

Don't mess with extortionists. Otherwise, you will finance their future activities.
Contact antivirus companies and maybe even the police.
Ransomware can also make mistakes in the code, due to which decryption by experts can be successful.

Answer 4

Yesterday it was already:
vmartyanov.ru
antifraud.drweb.ua/encryption_trojs -> Free decryption of user data

Answer 5

Do not listen to these "experts": they understand absolutely nothing in the subject area, especially since they have not even looked at your files. A link to the Dr.Web form is given, go there. And yes, are you sure it's value and not vault? For vault, yesterday we rolled out a decryption for almost all cases.

Answer 6

The most reasonable thing is to restore data from a backup.
This data is encrypted, no one except those who encrypted it can decrypt it.
Contacting anti-virus companies and other places is a pointless undertaking.
In general, there are three options -
1) Restore from backup.
2) We pay the attackers and hope that they will help.
3) Forget about the data and do without them.
There are no other options.

Answer 7

How many similar questions can you ask? RESERVE your data correctly and sleep well.

Answer 8

Vladimir Martyanov , let's solve the problem already. I will take it out separately, what would be in front of everyone, it will be useful not only to me.
I send you several files, you confirm receipt of the files here, then immediately say whether you can decrypt or not. If yes, I buy a license, you decrypt files on the whole computer accordingly.
I'm leaving a review. A lot of satisfied customers come to you.
I repeat, I can’t upload files through the Doctor Web form, due to the lack of a license

Answer 9

if there are no backups, then gaplyk
https://threatpost.ru/updated-cryptowall-encrypts-...

Answer 10

In some cases, since there are lazy and narrow-minded entities among virus writers, recovering deleted files can help. Recuva or R studio can help in this case.

Answer 11

kaspersky had a service, you need to send an example of an encrypted file there, and they will give you a medicine, you don’t need a license, I treated one client like this about six months ago, everything is ok