Infected with Vortex Ransomware? Need to decrypt your files?
What is Vortex Ransomware
Vortex Ransomware is a cryptographic virus, that mostly attacks users in Poland, but may also be distributed in other counties. Vortex Ransomware code is based on AESxWin – a free program for encryption and decryption. It uses AES-256 cryptography and adds .aes and .ZABLOKOWANE extensions to encrypted files. After encoding, Vortex creates a text files (ODZSZYFRUJ-DANE.txt (or “#$# JAK-ODZYSKAC-PLIIKI.txt”)), and places it on the desktop. Here is an example of the message it contains:
!!!! U W A G A !!!! Masz Problem Ze Znalezieniem Potrzebnych Danych ? Nie Moesz Otworzy Swoich Dokumentw? Po Otworzeniu Wanych Plikw Widzisz Tylko Nic Nie Mwicy, Dziwny Cig Znakw? Twoje Istotne Pliki Zostay Zaszyfrowane ! Twoje Zdjcia, Dokumenty, Bazy Danych, Zostay Zaszyfrowane Niemozliwym Do Zlamania Algorytmem Aes-256 Metody Tej Do Szyfrowania Zawartosci Dokumentw Uzywaja Sluzby Wywiadowcze I Wojsko.
Gdy To Czytasz Proces Jest Zakoczony, Wytypowane Pliki Zostay Zaszyfrowane A Sam Program Usunity Z Twojego Komputera. Odzyskac Twoje Dane Mozna Tylko Przy Pomocy Dedykowanego Programu Deszyfrujcego, Wraz Z Jednorazowym Kluczem Wygenerowanym Unikalnie Dla Ciebie! Dwa Pliki Odszyfrujemy Bez Opaty Aby Nie By Goosownymi, Za Pozostae Bdziecie Pastwo Musieli Zapaci 100$ Aby Odzyska Pliki Skontaktuj Si Z Nami Pod Adresem: Hc9@2.pl Lub Hc9@goat.si Radzimy Decydowa Si Szybko, 4 Dni Od Zaszyfrowania Opata Zostanie Podniesiona Do 200$.
Kontaktujac Sie Z Nami Pamietaj Aby Podac Id-komputera I Date DANE: IP=X ID=X Data=21-11-2017 00:33:09
Various versions of this virus demand from $100 to $200 in BitCoins. One of the alternative versions of Vortex Ransomware is called Flotera and it also appends .aes suffix. Malefactors use following e-mail addresses for communication: email@example.com, firstname.lastname@example.org, Hc9@2.pl, Hc9@goat.si. Follow the guide below to remove Vortex Ransomware and decrypt .aes or .ZABLOKOWANE files for free.
How Vortex Ransomware infected your PC
It spreads or can spread through email spam and malicious attachments, exploits, fake updates, repackaged and infected installers. E-mails are distributed all over the world. You can also get this ransomware on file-sharing networks, including torrent files. Ransom is asked to be paid in BitCoins, that also makes the task difficult for the police, as the user in this network is often anonymous. Encryption starts in the background. Way to protect your computer from such threats is to use antiviruses with crypto-protection like HitmanPro.Alert with CryptoGuard.
First of all, don’t panic. Follow these easy steps below.
1. Start your computer in Safe Mode with networking. To do that, restart your computer before your system starts hit F8 several times. This will stop system from loading and will show Advanced boot options screen. Choose Safe mode with networking option from the options list using up and down arrows on your keyboard and hit Enter.
2. Log in to the system infected with the Vortex Ransomware virus. Launch your Internet browser and download a reliable anti-malware program and start a full system scan. Once the scan is complete, review scan results and remove all entries detected.
SpyHunter 4 – fully removes all instances of Vortex Ransomware – files, folders, registry keys.
Step 2: Remove following files and folders of Vortex Ransomware:
Remove following registry entries:
Remove following files and folders:
Powiadomienie o przejeciu wierzytelnosci DOC.js
How to decrypt files infected by Vortex Ransomware (.aes or .ZABLOKOWANE files)?
Use automated decryption tools
There is ransomware decryptor from Kaspersky that can decrypt .aes or .ZABLOKOWANE files. It is free and may help you restore .aes or .ZABLOKOWANE files encrypted by Vortex Ransomware virus. Download it here:
You can also try to use manual methods to restore and decrypt .aes or .ZABLOKOWANE files.
Decrypt .aes or .ZABLOKOWANE files manually
Restore the system using System Restore
Although latest versions of Vortex Ransomware remove system restore files, this method may help you to partially restore your files. Give it a try and use standard System Restore to revive your data.
- Initiate the search for ‘system restore‘
- Click on the result
- Choose the date before the infection appearance
- Follow the on-screen instructions
Roll the files back to the previous version
Previous versions can be copies of files and folders created by Windows Backup (if it is active) or copies of files and folders created by System Restore. You can use this feature to restore files and folders that you accidentally modified or deleted, or that were damaged (in our case – Vortex Ransomware by Vortex Ransomware). This feature is available in Windows 7 and later versions.
- Right-click the file and choose Properties
- Open the Previous Version tab
- Select the latest version and click Copy
- Click Restore
Restore .aes or .ZABLOKOWANE files using shadow copies
- Download and run Shadow Explorer.
- Select the drive and folder where your files are located and date that you want to restore them from.
- Right-click on folder you want to restore and select Export.
- Choose export location and view restored files.
Protect your computer from ransomware
Most modern antiviruses can protect your PC from ransomware and crypto-trojans, but thousands of people still get infected. There are several programs that use different approach t protect from ransomware and lockers. One of the best is HitmanPro.Alert with CryptoGuard. You may already know HitmanPro as famous cloud-based anti-malware scanner. Check out ultimate active protection software from SurfRight.
Information provided by: Alexey Abalmasov