I got infected by the CTB Locker and probably I have removed the virus itself. But the files all got polluted. I tried to use shadow explorer but it shows all blank in CDEF any drives and got no dates listed. I have turned on all system restoration now but still showing nothing.

  • 1
    It sounds like you have exhausted all your options. This means you should use your backups to restore your files.
    – Ramhound
    Commented Apr 28, 2015 at 16:24

1 Answer 1


There is unfortunately no known solution available to repair or recover files affected by CTB Locker. Once the files are encrypted, they cannot be decrypted without the key. CTB Locker uses a varying algorithm to encrypt the files and thus cannot be decrypted using a fixed pattern or algorithm.

Some data may be recoverable using low level recovery techniques (data carving) directly from the infected hard drive/media.

The drawback of this method is that the files recovered falls outside of the normal data and naming structure and thus have no filenames, but are simply numbered in sequence as they are recovered by signature. This means that you will manually have to go through each file to verify the contents.

It is advisable not to work and save any new data to the affected drive in order to minimize further data loss.

All the best

  • Thanks man. I think I have at least removed the virus since for the past weeks it didn't show up. Luckily my files are not very expensive ones. Commented Jun 12, 2015 at 14:23
  • Oh one more thing. I have been regularly creating system restore point. Is it useful when the computer got hit by the ransomware? I remembered that when I first got the CTB, I tried 2 system restore point created long before by the system itself, maybe update or something. But didn't work. What's weird is that after a few try of this I can find no more system restore point anymore, thus I cannot further try it out. Commented Jun 12, 2015 at 14:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .