- What does _all-files-encrypted stand for?
- DecYourData ransomware encryption process.
- How to remove DecYourData Ransomware from your computer
- How to decrypt _all-files-encrypted files
- Data Recovery
- Automated decryption tools
- Other software
What does “_all-files-encrypted” mean?
If you see, that your files are unreadable and have got new extension “id-
DecYourData encryption process.
The encryption, that DecYourData proceeds, can be divided into several steps. At first the virus creates new keys in the Registry Folder in order to make the system think, that all executed processes are legitimate. Then it infects system processes, by the means of which it searches and modifies files. DecYourData encrypts only definite file formats, such as documents, media files, archives, databases and etc. Moreover, it attacks website files, such as .xlsx format. As the result, the files are unreadable and have got new extensions – “id-*ID* [email@example.com]_all-files-encrypted”. There is one unusual feature: DecYourData doesn’t use a dot in the extension. The purpose of this attack is to make a victim pay for the decryption services provided by hackers. For this purpose they usually drop the ransom note called “Help for decrypting id-*ID* [firstname.lastname@example.org].txt”. As the rule, hackers try to assure victims, that the only way to restore files is to get the decryption key. Unfortunately, due to the novelty of this virus, it’s really the only method to restore 100% of encrypted files. However, in the most cases, hackers stop all contacts with the victims, once the’ve been paid. Moreover, they can easily send a malicious software instead of the decryptor and make the situation much worse. That’s why we strongly recommend you to avoid all contacts with them. Specially for this case, we’ve prepared the detailed guide on how to remove DecYourData ransomware and decrypt _all-files-encrypted files!
Fill subject with your ID like this: id-xxxxx
How to remove Tor+ Ransomware from your computer?
We strongly recommend you to use a powerful anti-malware program that has this threat in its database. It will mitigate the risks of the wrong installation, and will remove DecYourData from your computer with all of its leftovers and register files.
Solution for Windows users: our choice is Norton 360 . Norton 360 scans your computer and detects various threats like DecYourData, then removes it with all of the related malicious files, folders and registry keys.
If you are Mac user, we advise you to use Combo Cleaner.
How to decrypt _all-files-encrypted files?
Once you’ve removed the virus, you are probably thinking how to decrypt _all-files-encrypted files or at least restore them. Let’s take a look at possible ways of decrypting your data.
Restore _all-files-encrypted files with Data Recovery
- Download and install Data Recovery
- Select drives and folders with your files, then click Scan.
- Choose all the files in a folder, then press on Restore button.
- Manage export location.
Decrypt _all-files-encrypted files with other software
Unfortunately, due to the novelty of DecYourData ransomware, there are no decryptors that can surely decrypt encrypted files. Still, there is no need to invest in the malicious scheme by paying a ransom. You are able to recover files manually.
You can try to use one of these methods in order to restore your encrypted data manually.