none
Mr. Dec ransomware

    Question

  • Hi

    Recently my server (windows 2012 r2) attacked by Mr. Dec ransomware. All my files are encrypted as a file type .[id]xxx[id]. Unfortunately i doesn't have any recent back up. Is their any descriptor to decrypt the files

    Friday, April 19, 2019 6:19 PM

All replies

  • Does not sound good for you.  Ransomware decryption keys are held by the bad guys - the ones who encrypted your system.  No known way to recover other than to rebuild your environment from scratch and recover from whatever backup you may have.  Or, the least attractive, pay the ransom, recover your files, back them up, and then rebuild your system from scratch to ensure you have removed the infection.  Then restore your data files only.  I would not try to install any executables because they may be infected.

    tim

    Saturday, April 20, 2019 1:38 PM
  • Hi,

     

    Considering data security, I’d like to strongly suggest you perform a full back up regularly.

     

    From the current situation, you may check the following link as reference:

     

    Mr. Dec Ransomware. How to remove? (Uninstall guide)

    https://www.2-spyware.com/remove-mr-dec-ransomware.html

     

    Note: This is a third-party link and we do not have any guarantees on this website. And Microsoft does not make any guarantees about the content.

     

    Hope these are helpful. If you have any question, please feel free to let me know.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, April 23, 2019 1:43 AM
    Moderator
  • Hi,

    Was your issue solved?

    If yes, would you like to share your solution in order that other community members could find the helpful reply quickly.

    If no, please reply and tell us the current situation in order to provide further help.

    Best


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, April 26, 2019 7:04 AM
    Moderator