Kaspersky
Solved

.karl ransomware [MOVED]

  • 23 September 2019
  • 3 replies
  • 8358 views

hello comunity!
I have been attacked by a ransomware that puts .karl extension in all files and encrypted all my files. Please do you have any information how to decrypt these files. Please help, i lost all my baby girls photos!

Moderator: Moved to the correct forum.
icon

Best answer by Caos 23 September 2019, 12:25

Hi,

In terms of recovering/decrypting the files, this type of virus usually encrypts the files with very high bit keys, and in very rare cases a decryptor can be created, usually due to failure or careless programming of the malware. But in the vast majority it is not possible, at least at the moment.

You can check if the ransomware that attacked you currently has the possibility to be decrypted here: https://id-ransomware.malwarehunterteam.com/index.php?lang=en

You can find information that can help you here: https://www.nomoreransom.org/en/index.html

Also try the utilities offered by Kaspersky: http://support.kaspersky.com/viruses/utility

If you are a Kaspersky user with a valid license, open a support ticket in my Kaspersky account, send them a sample of an encrypted file, and if you have the same file unencrypted.

In my personal opinion: Tools that may decrypt files infected by Karl is not yet available at this time.

Karl ransomware is known to be a representative of recent editions from STOP malware family and it is so unfortunate for victims that malware researchers have yet to find a solution to freely restore files with .karl extension. Unlike old variants that can be decrypted by STOPDecrypter tool, attackers made significant changes to most recent versions of Karl. By applying proper asymmetrical encryption to these variants, the offline key decryption method no longer seen as alternative solution to recover .karl files.

But you can try to recover your files by using the STOPDecrypter decryption tool.

Regards
View original

3 replies

Userlevel 7
Badge +9
Hi,

In terms of recovering/decrypting the files, this type of virus usually encrypts the files with very high bit keys, and in very rare cases a decryptor can be created, usually due to failure or careless programming of the malware. But in the vast majority it is not possible, at least at the moment.

You can check if the ransomware that attacked you currently has the possibility to be decrypted here: https://id-ransomware.malwarehunterteam.com/index.php?lang=en

You can find information that can help you here: https://www.nomoreransom.org/en/index.html

Also try the utilities offered by Kaspersky: http://support.kaspersky.com/viruses/utility

If you are a Kaspersky user with a valid license, open a support ticket in my Kaspersky account, send them a sample of an encrypted file, and if you have the same file unencrypted.

In my personal opinion: Tools that may decrypt files infected by Karl is not yet available at this time.

Karl ransomware is known to be a representative of recent editions from STOP malware family and it is so unfortunate for victims that malware researchers have yet to find a solution to freely restore files with .karl extension. Unlike old variants that can be decrypted by STOPDecrypter tool, attackers made significant changes to most recent versions of Karl. By applying proper asymmetrical encryption to these variants, the offline key decryption method no longer seen as alternative solution to recover .karl files.

But you can try to recover your files by using the STOPDecrypter decryption tool.

Regards
Thanks for your answer! I hope some time later this problem will be solved. I will backup all this damaged files.
Userlevel 7
Badge +9
Hi,

You´re welcome

Regards

Reply / Ответить