Kaspersky
Solved

Decrypt Ransomware .eking files

  • 18 July 2021
  • 1 reply
  • 1253 views

our server got affected  Ransomware  .eking extension.

icon

Best answer by Caos 19 July 2021, 10:22

Hi,

Probably is a ransomware Phobos variant.

In terms of recovering/decrypting the files, this type of virus usually encrypts the files with very high bit keys, and in very rare cases a decryptor can be created, usually due to failure or careless programming of the malware.
But in the vast majority it is not possible, at least at the moment.

You can check if the ransomware that attacked you currently has the possibility to be decrypted here: https://id-ransomware.malwarehunterteam.com/index.php?lang=en

You can find information that can help you here: https://www.nomoreransom.org/en/index.html

Also try the utilities offered by Kaspersky: http://support.kaspersky.com/viruses/utility


If you are a Kaspersky user with a valid license, open a support ticket in my Kaspersky account (home product) or Kaspersky Company Account (corporate product), send them a sample of an encrypted file, and if you have the same file unencrypted.

Regards

View original

1 reply

Userlevel 7
Badge +11

Hi,

Probably is a ransomware Phobos variant.

In terms of recovering/decrypting the files, this type of virus usually encrypts the files with very high bit keys, and in very rare cases a decryptor can be created, usually due to failure or careless programming of the malware.
But in the vast majority it is not possible, at least at the moment.

You can check if the ransomware that attacked you currently has the possibility to be decrypted here: https://id-ransomware.malwarehunterteam.com/index.php?lang=en

You can find information that can help you here: https://www.nomoreransom.org/en/index.html

Also try the utilities offered by Kaspersky: http://support.kaspersky.com/viruses/utility


If you are a Kaspersky user with a valid license, open a support ticket in my Kaspersky account (home product) or Kaspersky Company Account (corporate product), send them a sample of an encrypted file, and if you have the same file unencrypted.

Regards

Reply