Ransomware Hits Windows 10 Litar Extension

scottalanmiller

Posting for @Lakshmana who is having an issue logging in. @Grey was on the LI thread as well.

I am in need of help of .litar ransomware attack in one of my friend machine. Data present in the machine is 300 GB.All the files are in the format like test.docx.litar.

Troubleshooting Done :
1)The Windows 10 OS which is reinstalled for the machine

2)Tried to rename the test.docx.litar to test.docx file
After renaming the files also the same test.docx.litar is automatically renamed for the file

3)Tried deleting the .litar extension from the registry edit and restarted the machine.After doing this the name of the file can be changed as test.docx.When we try to open the file it showing as File got corrupted cannot retrieve

4)Tried some antivirus(which was not tried by me)to delete the virus which did not worked.

5)Before installing the OS some text file was there in the machine to send the money but unfortunately that file was deleted because the OS was reinstalled in the machine

Help : All data is required for my friend is there any possibility retrieve data without any corruption ?

Referred Link : https://lnkd.in/fVDBAcZ

DustinB3403

Try this? https://malwarefixes.com/remove-litar-ransomware-litar-decryption/

Being that he reinstalled the OS I have no idea if it'll work or not.

Dashrender

Sounds like he is SOL. really - reinstalled the OS before he had his data back? /shakes head.

Laksh1999

@DustinB3403 said in Ransomware Hits Windows 10 Litar Extension:

Try this? https://malwarefixes.com/remove-litar-ransomware-litar-decryption/

Being that he reinstalled the OS I have no idea if it'll work or not.

My friend reinstalled the OS as per his friend suggestion that virus issue will not be there after the OS reinstallation.but the machine was having the same issue.But the data is there in the machine.when the file is copied to different hard disk that is also getting affected

scottalanmiller

@Laksh1999 said in Ransomware Hits Windows 10 Litar Extension:

@DustinB3403 said in Ransomware Hits Windows 10 Litar Extension:

Try this? https://malwarefixes.com/remove-litar-ransomware-litar-decryption/

Being that he reinstalled the OS I have no idea if it'll work or not.

My friend reinstalled the OS as per his friend suggestion that virus issue will not be there after the OS reinstallation.but the machine was having the same issue.But the data is there in the machine.when the file is copied to different hard disk that is also getting affected

Well the data is encrypted already. Reinstalling the OS will remove the ransomware, but the damage is already done. So removing the ransomware is important, but doesn't address the issue of retrieving the lost data.

hobbit666

If the files have been encrypted with a "Offline key" you may be able to restore.
See here
https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/

Overwise unless you've got a backup your out of luck.

Dashrender

@hobbit666 said in Ransomware Hits Windows 10 Litar Extension:

If the files have been encrypted with a "Offline key" you may be able to restore.
See here
https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/

Overwise unless you've got a backup your out of luck.

LOL - sure, assuming the key isn't somewhere that would be lost by an OS reinstall.

Spiral

Spiral

Maybe they have a couple keys...