hotbit

Rannohdecryptor strange behaviour [In progress]

11 posts in this topic

Hello, 10th February i tried the last version of Rannohdecryptor on a directory that was infected by CryptXXX v.3 on May 2016. It worked smoothly, recovered all the files.

I forgot i had another directory to recover, tried same version of Rannohdecryptor yesterday but i got the message that cannot decrypt files.. downloaded new version, same problem. I tried today and still no luck, i remembered the program wrote a log, so I checked it and it says:

0x0924 CryptXXX: cannot receive keys for ID: 45F6B2D368D4, please check your internet connection

but my connection has no problems at all and nothing seems to changed in last 10 days... seems there's something broken on the key recovery, how to fix it?

Thanks in advance

Maurizio

 

Share this post


Link to post
Share on other sites

Hi,

 

Please provide us screenshot of the error.

 

BR

Share this post


Link to post
Share on other sites
Hi,

 

Please provide us screenshot of the error.

 

BR

 

 

hello, pls check attached file and this is what i see in log file

 

09:29:04.0008 0x1334 Initialize success

09:30:14.0510 0x0e84 CryptXXX: ransom notes path: G:\!Recovery_45F6B2D368D4.txt

09:30:14.0540 0x0e84 CryptXXX: user ID: 45F6B2D368D4

09:30:15.0560 0x0e84 CryptXXX: cannot receive keys for ID: 45F6B2D368D4, please check your internet connection

09:30:16.0740 0x0e84 Can't init decryptor

09:30:17.0870 0x087c Deinitialize success

post-620660-1487772548_thumb.png

Share this post


Link to post
Share on other sites

I reported this same problem on this forum previously on February 15th - no reply and have not been able to resolve it.

 

Here is my screenshot, seems the same as Hotbits. my ID was !1492AEB6801B

 

thanks

 

Sean

post-620213-1488817431_thumb.png

Share this post


Link to post
Share on other sites

Posted (edited)

I've had the same issue for at least 2 weeks now.

 

10:32:20.0287 0x3998 Initialize success

10:32:43.0830 0x3100 CryptXXX: ransom notes path: C:\Users\***\Desktop\***\!C78CA9520AF2.txt

10:32:43.0830 0x3100 CryptXXX: user ID: C78CA9520AF2

10:32:44.0136 0x3100 CryptXXX: cannot receive keys for ID: C78CA9520AF2, please check your internet connection

10:32:46.0857 0x3100 Can't init decryptor

post-622438-1489674558.jpg

Edited by epierson_cec

Share this post


Link to post
Share on other sites

Hi,

I also have the same problem and here is attached my report.

Having the "cannot receive keys" statement makes me think that maybe Rannohdecryptor is connecting to a database with keys or similar and in case of success it decrypts the files. If that is so does that mean that we are unlucky and our ID's are not there? And could we hope for a solution for that issue?

post-624359-1491416023.jpg

Share this post


Link to post
Share on other sites
Hi,

I also have the same problem and here is attached my report.

Having the "cannot receive keys" statement makes me think that maybe Rannohdecryptor is connecting to a database with keys or similar and in case of success it decrypts the files. If that is so does that mean that we are unlucky and our ID's are not there? And could we hope for a solution for that issue?

 

Hello,

 

please attach a recorded video where the problem is reproduced.

Thank you.

Share this post


Link to post
Share on other sites
Hello,

 

please attach a recorded video where the problem is reproduced.

Thank you.

 

I am not sure I fully understand you. What exactly I should record on the video? What I do is just to select a *.crypt file, the ransome note and run Rannohdecryptor. No matter what type of file I have picked up for decryption (jpg, doc, txt) I always get the same message:

"CryptXXX: cannot receive keys for ID: 9AC1FE5C1AAF, please check your internet connection"

My internet connection is ok.

 

Thanks

 

Share this post


Link to post
Share on other sites

I concur, No need to video this problem it is as simple as it has been described here. It happened to me after an initial successful decryption - do your servers block or inadvertently lock out subsequent attempts to decrypt the same ID number?

 

I can only suggest to the Kasperky lab people to do that. Decrypt part of a computers data then try to do more on a second attempt. That is where it stopped for me.

 

Any others on this board have the same conditions make it give the error?

 

We would love to see a fix for this

 

Thanks

Share this post


Link to post
Share on other sites
I concur, No need to video this problem it is as simple as it has been described here. It happened to me after an initial successful decryption - do your servers block or inadvertently lock out subsequent attempts to decrypt the same ID number?

 

I can only suggest to the Kasperky lab people to do that. Decrypt part of a computers data then try to do more on a second attempt. That is where it stopped for me.

 

Any others on this board have the same conditions make it give the error?

 

We would love to see a fix for this

 

Thanks

 

Hello,

 

the situation is not fully clear.

How KART is related with the issue ?

Thank you.

 

Share this post


Link to post
Share on other sites

 

 

Hi Dmitry, where did anyone mention KART? what are you referring to so we can give you the information you need?

 

We run the decryptor and get the message "Can not decrypt this file" in the box marked ERROR. Please look at the previous postings for the screen shot.

 

This is all that happens. Instead of deccypting the process ends with that pop up.

 

 

Cheers :dash1:

Share this post


Link to post
Share on other sites