IPB

Welcome Guest ( Log In | Register )

 
Reply to this topicStart new topic
> Rannohdecryptor strange behaviour [In progress], cannot decrypt files but they were on previous attempt
hotbit
post 21.02.2017 13:01
Post #1


Newbie
*

Group: Members
Posts: 2
Joined: 21.02.2017




Hello, 10th February i tried the last version of Rannohdecryptor on a directory that was infected by CryptXXX v.3 on May 2016. It worked smoothly, recovered all the files.
I forgot i had another directory to recover, tried same version of Rannohdecryptor yesterday but i got the message that cannot decrypt files.. downloaded new version, same problem. I tried today and still no luck, i remembered the program wrote a log, so I checked it and it says:
0x0924 CryptXXX: cannot receive keys for ID: 45F6B2D368D4, please check your internet connection
but my connection has no problems at all and nothing seems to changed in last 10 days... seems there's something broken on the key recovery, how to fix it?
Thanks in advance
Maurizio
Go to the top of the page
 
+Quote Post
Artem Ershov
post 21.02.2017 17:52
Post #2


Technical Support Engineer
**************

Group: KL Russia
Posts: 6599
Joined: 15.06.2015




Hi,

Please provide us screenshot of the error.

BR


--------------------
In english: GSI report | AVZ report | KSC10 Traces | KES10 Traces | KSC9 Traces | KES8 Traces(RUS) | klnagchk log(RUS)
На русском: Отчет GSI | Лог AVZ | Трассировки KSC10 | Трассировки KES10 | Трассировки KSC9 |Трассировки KES8 | Отчет утилиты klnagchk

Please evaluate support help by using "Rating" option!
Пожалуйста, оцените оказанную помощь, используя опцию "Rating" в названии топика!


Подписаться на новости о корпоративных продуктах
Go to the top of the page
 
+Quote Post
hotbit
post 22.02.2017 18:09
Post #3


Newbie
*

Group: Members
Posts: 2
Joined: 21.02.2017




QUOTE(Artem Ershov @ 21.02.2017 14:52) *
Hi,

Please provide us screenshot of the error.

BR



hello, pls check attached file and this is what i see in log file

09:29:04.0008 0x1334 Initialize success
09:30:14.0510 0x0e84 CryptXXX: ransom notes path: G:\!Recovery_45F6B2D368D4.txt
09:30:14.0540 0x0e84 CryptXXX: user ID: 45F6B2D368D4
09:30:15.0560 0x0e84 CryptXXX: cannot receive keys for ID: 45F6B2D368D4, please check your internet connection
09:30:16.0740 0x0e84 Can't init decryptor
09:30:17.0870 0x087c Deinitialize success
Attached File(s)
Attached File  error.png ( 19,91K ) Number of downloads: 16
 
Go to the top of the page
 
+Quote Post
Sean L
post 6.03.2017 20:25
Post #4


Newbie
*

Group: Members
Posts: 3
Joined: 15.02.2017




I reported this same problem on this forum previously on February 15th - no reply and have not been able to resolve it.

Here is my screenshot, seems the same as Hotbits. my ID was !1492AEB6801B

thanks

Sean

Attached File(s)
Attached File  decrypt_error_.PNG ( 25,3K ) Number of downloads: 11
 
Go to the top of the page
 
+Quote Post
epierson_cec
post 16.03.2017 18:33
Post #5


Newbie
*

Group: Members
Posts: 1
Joined: 16.03.2017




I've had the same issue for at least 2 weeks now.

10:32:20.0287 0x3998 Initialize success
10:32:43.0830 0x3100 CryptXXX: ransom notes path: C:\Users\***\Desktop\***\!C78CA9520AF2.txt
10:32:43.0830 0x3100 CryptXXX: user ID: C78CA9520AF2
10:32:44.0136 0x3100 CryptXXX: cannot receive keys for ID: C78CA9520AF2, please check your internet connection
10:32:46.0857 0x3100 Can't init decryptor

This post has been edited by epierson_cec: 16.03.2017 18:34
Attached File(s)
Attached File  rannoh1.jpg ( 49,37K ) Number of downloads: 10
 
Go to the top of the page
 
+Quote Post
vevi
post 5.04.2017 22:13
Post #6


Newbie
*

Group: Members
Posts: 2
Joined: 5.04.2017
From: amsterdam




Hi,
I also have the same problem and here is attached my report.
Having the "cannot receive keys" statement makes me think that maybe Rannohdecryptor is connecting to a database with keys or similar and in case of success it decrypts the files. If that is so does that mean that we are unlucky and our ID's are not there? And could we hope for a solution for that issue?
Attached File(s)
Attached File  report.JPG ( 103,79K ) Number of downloads: 8
 
Go to the top of the page
 
+Quote Post
Dmitry Eremeev
post 6.04.2017 02:04
Post #7


Technical Support Specialist
**************

Group: KL Russia
Posts: 11025
Joined: 30.07.2014
From: Moscow




QUOTE(vevi @ 5.04.2017 21:13) *
Hi,
I also have the same problem and here is attached my report.
Having the "cannot receive keys" statement makes me think that maybe Rannohdecryptor is connecting to a database with keys or similar and in case of success it decrypts the files. If that is so does that mean that we are unlucky and our ID's are not there? And could we hope for a solution for that issue?


Hello,

please attach a recorded video where the problem is reproduced.
Thank you.


--------------------
In english: GSI report | AVZ report | KSC10 Traces | KES10 Traces | KSC9 Traces | KES8 Traces(RUS) | klnagchk log(RUS)

На русском: Отчет GSI | Лог AVZ | Трассировки KSC10 | Трассировки KES10 | Трассировки KSC9 |Трассировки KES8 | Отчет утилиты klnagchk

Подписаться на новости о корпоративных продуктах

Пожалуйста, оцените оказанную помощь, используя опцию "Rating" в названии топика!

Please evaluate support help by using "Rating" option!


Go to the top of the page
 
+Quote Post
vevi
post 6.04.2017 10:38
Post #8


Newbie
*

Group: Members
Posts: 2
Joined: 5.04.2017
From: amsterdam




QUOTE(Dmitry Eremeev @ 6.04.2017 02:04) *
Hello,

please attach a recorded video where the problem is reproduced.
Thank you.


I am not sure I fully understand you. What exactly I should record on the video? What I do is just to select a *.crypt file, the ransome note and run Rannohdecryptor. No matter what type of file I have picked up for decryption (jpg, doc, txt) I always get the same message:
"CryptXXX: cannot receive keys for ID: 9AC1FE5C1AAF, please check your internet connection"
My internet connection is ok.

Thanks
Go to the top of the page
 
+Quote Post
Sean L
post 20.04.2017 20:57
Post #9


Newbie
*

Group: Members
Posts: 3
Joined: 15.02.2017




I concur, No need to video this problem it is as simple as it has been described here. It happened to me after an initial successful decryption - do your servers block or inadvertently lock out subsequent attempts to decrypt the same ID number?

I can only suggest to the Kasperky lab people to do that. Decrypt part of a computers data then try to do more on a second attempt. That is where it stopped for me.

Any others on this board have the same conditions make it give the error?

We would love to see a fix for this

Thanks
Go to the top of the page
 
+Quote Post
Dmitry Eremeev
post 20.04.2017 21:04
Post #10


Technical Support Specialist
**************

Group: KL Russia
Posts: 11025
Joined: 30.07.2014
From: Moscow




QUOTE(Sean L @ 20.04.2017 19:57) *
I concur, No need to video this problem it is as simple as it has been described here. It happened to me after an initial successful decryption - do your servers block or inadvertently lock out subsequent attempts to decrypt the same ID number?

I can only suggest to the Kasperky lab people to do that. Decrypt part of a computers data then try to do more on a second attempt. That is where it stopped for me.

Any others on this board have the same conditions make it give the error?

We would love to see a fix for this

Thanks


Hello,

the situation is not fully clear.
How KART is related with the issue ?
Thank you.


--------------------
In english: GSI report | AVZ report | KSC10 Traces | KES10 Traces | KSC9 Traces | KES8 Traces(RUS) | klnagchk log(RUS)

На русском: Отчет GSI | Лог AVZ | Трассировки KSC10 | Трассировки KES10 | Трассировки KSC9 |Трассировки KES8 | Отчет утилиты klnagchk

Подписаться на новости о корпоративных продуктах

Пожалуйста, оцените оказанную помощь, используя опцию "Rating" в названии топика!

Please evaluate support help by using "Rating" option!


Go to the top of the page
 
+Quote Post

Reply to this topicStart new topic

 



Lo-Fi Version Time is now: 25.04.2017 06:55