📎 AI Summary:
The forum discussion revolves around the effectiveness of new decryption tools for ransomware, specifically referencing a recent Emsisoft decryptor that claims to free files encrypted by BadBlock ransomware. The original poster is unsure about its reliability and invites community opinions. Contributors express skepticism, noting that many ransomware private keys are generated and stored on servers, making decryption challenging, while some mention that antivirus programs may intercept encryption processes rather than truly decrypt files. Overall, the sentiment suggests cautious optimism but realistic skepticism about the decryption tool's capabilities.
Neemobeer

Neemobeer

Windows Forum Team
Staff member
Joined
Jul 4, 2015
Messages
8,995
#3
I'm very skeptical these will work. For one, lots of these ransomware malware generate the private key on a server, so you never see it on the wire. When I say "on the wire" I mean some ransomware will generate the private cert client side and transmit it and if your network has network monitoring you can extract the key to decrypt. The only case these descriptors would work is if the authorities had seized the bad guys servers and have access to the private keys.
 

RichM

RichM

Well-Known Member
Joined
May 9, 2016
Messages
322
#4
Don't be. On a Linkedin Forum I'm on, an alert shop owner used a new Eset program aimed at
Crypto Locker captured files and effortlessly removed the encryption.
 

Neemobeer

Neemobeer

Windows Forum Team
Staff member
Joined
Jul 4, 2015
Messages
8,995
#5
It probably doesn't remove the encryption then, it more likely has a file system filter driver that intercepts the encryption process and reverts the file back then. That would be do able.
 

You must log in or register to reply here.