Below is a list of different types of ransomware infections we have been successful in helping our clients recover from (not limited to the list below).

If you are infected with ransomware we strongly recommend submitting a quote request and disconnect the internet from your site. Please do not turn it off as it’s likely your system will not boot up again due to changes to windows system files.

PHOBOS is a ransomware family amending files with various extension such as ACTOR, ACTIN, ADAGE, ADAME, FRENDI, PHOBOS, PHONEIX, MAMBA, WALLET, EKING, EIGHT, DLL, COM, DEVOS, BARAK, BANJO, ETC.
Few new extension are released on weekly basis but the decryption recovery process remains the same
Phobos will amed a file from 1.JPG to 1.jpg.ID-63857777.2140[job2019@tutanota.com].phobos
Phobos is very similar to the Dharma ransomware

Each ID will be a unique infection. Please advise when submitting the ticket if you have multiple IDs.

Please visit our PHOBOS RANSOMWARE for more up to date information

DHARMA  was released in December 2016 approximately and seems to be very profitable for the hackers and continues development until now. We have been successful with 100% guarantee in all Dharma Ransomware variants such as (but not limited to) Harma, Dharma, Wallet, Roger, 1024, BOT, LAO, Lotus, Crypt, Blm, Glb, Arena

Each ID will be a unique infection. Please advise when submitting the ticket if you have multiple IDs.

Please visit our DHARMA RANSOMWARE for more up to date information

No_More_Ransom is part of the RAPID Ransomware

Please visit our NO_MORE_RANSOM for more up to date information

MR DEC – is part of the Sherminator ransomware family. We are 100% successful in all Mr Dec cases and the average recovery is 48-36 hours

Mr Dec renames all encrypted files by adding a string of random characters to the filenames. For example, “1.jpg” might become “1.jpg.[ID]JrCHOfl83prTYZtyK[ID]“.

It creates the “Decoder.hta” file, which, if executed, locks the screen and displays a ransom message.

GlobeImposter – An active type of ransomware with a successful recovery in 98% of cases

GlobeImposter renames your files with a generic extension/variant and drops ransom-demanding messages – “how_to_back_files.html” – are dropped into compromised folders.

ZEPPELIN appends filenames with a randomized extension, using the hexadecimal numeral system (e.g. “.126-D7C-E67“). For example, “1.jpg” might appear as something similar to “1.jpg.126-D7C-E67“, and so on for all affected files. Additionally, it adds filemarkers (“ZEPPELIN“) to the encrypted files. After this process is finished, a text file called “!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT” is stored on the desktop.

We are 99% successful in recovery from Zeppelin and average recovery is 48-36 hours.

Sodinokibi/Revil – also referred to as REvil, infamy has long been covered by this publication. Revil started in May 2000 and is responsible to some of the highest ransomware demands and ransomware reinfections. In some cases, they steal your data

We are successful in returning 95% of clients infected with Sodiokkibi and the average recovery time is 48 hours

Maze – renames all encrypted files by adding a random extension to the filenames. For example, “1.jpg” might become “1.jpg.ILnnD“, and so on. Maze also changes the desktop wallpaper and creates the “DECRYPT-FILES.html” file, a ransom message with instructions about how to decrypt files.

We are successful in returning 95% of clients infected with Sodiokkibi and the average recovery time is 48 hours

MAKOP – renames all encrypted files with .makop or .fair extension.

For example, a file named “1.jpg” would appear as something like “1.jpg.[EF7BE7BC].[makop@airmail.cc].makop“, and so on. After this process is finished, a text file named “readme-warning.txt” is created on the desktop.

We are successful in helping our clients recover their data in 48 hours in 95% of cases.

MedusaLocker

We are successful in helping our clients recover their data in 24 – 36 hours in 95% of cases.

Avaddon 

Avaddon is an active ransomware attack and very similar to Revil Ransomare.
The ransom message within the HTML file states that Avaddon encrypts documents, photos, databases and other important files and that it is impossible to decrypt them without software called “Avaddon General Decryptor”. Victims can apparently purchase this decryption tool by following the instructions provided on a Tor website, which contains information such as the cost of the aforementioned decryption tool, how much time victims have to purchase it until the cost is doubled, and various other details

Avaddon drops this file in every folder that contains encrypted files”[random_numbers]-readme.html” file

We have been successful in helping our clients recover from Avaddon ransomware and we offer a no data no charge policy for your peace of mind.

eCh0raix / QNAPCrypt –

Infects mainly vulnerable QNAP NAS drive

The eCh0raix ransomware gang has targeted mainly vulnerable QNAP NAS devices. Recently detected activity suggests that this preferred target has not changed. QNAP NAS are network-attached storage (NAS) systems that can be simply defined as hard drives that constantly connect to the Internet. They are often used as backup hubs by businesses to store vital data essential to business operations. This makes the device built by QNAP a target for ransomware gangs due to the data held on the device.

We are successful in 100% of all eCh0raix / QNAPCrypt cases. Recovery in 48 hours

Snatch

Zeppelin

ZEPPELIN is a malicious program and a variant of Buran ransomware.

During the encryption process, ZEPPELIN appends filenames with a randomized extension, using the hexadecimal numeral system (e.g. “.126-D7C-E67“). For example, “1.jpg” might appear as something similar to “1.jpg.126-D7C-E67“, and so on for all affected files. Additionally, it adds filmmakers (“ZEPPELIN“) to the encrypted files. After this process is finished, a text file called “!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT” is stored on the desktop.

We are successful in recovering most cases of Zeppelin ransomware with a no data no charge gurantee.

If your ransomware infection is not listed above, please submit a ticket and we will be able to assist you

** This page is currently being updated **

RANSOMWARE RECOVERY PROCEDURES

Fast Data Recovery is the largest ransomware recovery company based in Sydney, Australia. We support clients nationally and internationally with a 24/7 ransomware recovery team.

Our company has the resources, knowledge, and experience for complete ransomware data recovery, ransomware removal, and further ransomware prevention.

We understand the value of data and work extremely hard to recover your business data as fast as possible.

Most recoveries are completed in 24-48 hours.

Please visit How it works? for more information about the process of analysing your ransomware variant to enable us in providing a quote for the cost of recovery

We have a high rate of recovering data from (but not limited to), Dharma, PHOBOS, Zepplin, Matrix, Globimposter, Stop/DJVU, Revil, Avaddon, Makop, Snatch, Lockbit, Netwalker, QNAP, etc… ransomware attacks and we operate on a no data = no charge policy for peace of mind.

For urgent cases, select the Priority Evaluation option (for 4-24 hours response time).

• 100% Guaranteed Recovery from most types of ransomware
• Technicians are available 24/7 to start your recovery immediately
• Priority Data Recovery Service (48 hours recovery time in 90% of cases)
• Australian based with 24/7 Worldwide support
• Free Evaluation or 4-24 hours Priority Evaluation for more urgent cases (most evaluation are completed in 4-8 hours)
• No Obligation Fixed Quotes
• No Data No Charge
• All recoveries are done remotely (no need to send us your data!)
• Ransomware Specialists
• Advanced Ransomware Prevention and Security Audit to eliminate the risk of ransomware
• Established company with over 10 years of data recovery experience
• 1000+s of happy clients
• All International clients are welcome

COMPANY DETAILS

Fast Data Recovery is a registered company based in Sydney, Australia. It is part of  the PC Link Professionals Pty Ltd group, which specialises in IT Support, Security and Data Recovery (established in 2008). Due to the exponential growth of demand for ransomware recovery, Fast Data Recovery was established by the PC Link Professionals group in December 2018.

Please visit the Australian Business Register for more information about the establishment of our business:

PC Link Professionals Pty Ltd – https://abr.business.gov.au/ABN/View?abn=20132031826

Fast Data Recovery Pty Ltd – https://abr.business.gov.au/ABN/View?abn=78630597778

CUSTOMER TESTIMONIALS and REVIEWS

We pride ourselves on the quality of work we provide. Customer service is our number one priority and we strive to exceed your expectations. Please read for yourself what other customers are saying about our services:

Google Reviews: https://goo.gl/S7KM9Y
Independent Reviews: https://trustspot.io/store/Fast-Data-Recovery
Clients Written Testimonials: https://fastdatarecovery.com.au/clients-written-testimonials/

Knowledge is power! – It is essential to understand the facts behind ransomware to better protect yourself

Ransomware occurs on a system due to weak security of some sort. If you are reading this you are properly a victim!

Here is some information you need to understand and take seriously

How is your system been comprised and infected with ransomware?

1. Cybercriminals will run a BOT (A bot is a form of an automated scan searching the interned for valurnerable network systems and attempt to comprise its security)
2. Once your system vulnerability has been identified, Hackers will buy the comprised list through underground websites
3. The ransomware hackers will use the details to comprise and infect your system with ransomware
4. Most often the BOT list is sold to multiple hackers

Have you removed the infected system from your network?

1. This is a common mistake!! – isolating the infected system from your network is 50% of the solution.
2. Hackers use group policy to distribute ransomware across your network and it remains undetected by most antivirus/malware software.
3. Ransomware time-bomb, backdoor and keyloogers often implemented on your network to allow hackers to gain access to your network especially if you pay the ransom.

Please be warned, once you have been infected, its emanate that you are very likely to get another attack.

We recommend a full security check on your network to identify the penetration point(s) and make sure adequate security is implemented prior to your data recovery

We offer ransomware prevention and ransomware recovery serivces parallel to ensure your files are recovered on ransomware risk free system without delaying the recovery of your files (our recovery and prevention team work parallel to ensure the prevention and recovery are done simultaneously)

Ask us about our Ransomware Prevention and Security Audit

Get A Quote NowGet A Quote Now

We do not recommend paying hackers. It’s a small chance of getting your files back.

Hackers in some instances may release personal information about your company to the public if you contact them and do not meet their ransom demands. Its strongly recommended not to communicate with them. (using an alternate email does not keep your identity safe as each infection has a unique code to identify you)

Scenarios from customer’s feedback who paid the ransom without engaging a ransomware recovery company to recover without paying the ransom or at least negotiate in case we are unable to recover in a timely manner.
1. The hackers may ask you for extra money after you make the first payment (The trend)
2. The hacker’s email usually gets closed down by the email provider (Once the email is reported to the domain webmaster their email will be shut down. Usually thousands of victims are infected at the same time so the likely-hood of this happening is very high)
3. They send you a sample file, take your money and simply stop responding
4. They may recover all/some of your files

In the event where we are unable to recover from your type of ransomware or able to recover in a timely manner, we can use our resources and experience to obtain the decryption at still offer a No Data No Charge for peace of mind

For a risk-free recovery, Submit an online case or talk to our ransomware specialist to assist with PHOBOS Ransomware recovery

Get A Quote NowGet A Quote Now

Once you realize your system has been infected by PHOBOS Ransomware, remove your infected system from the network (do not shut down as you can cause further damage). Do not make any attempts to remove the ransomware yourself by running an antivirus program as this may also cause further damage to your files.

At this point, you should call in our Ransomware expert to access the situation and provide you with the best way forward.

CONTACT US

Fast Data Recovery supports clients worldwide.

We are available 24/7 for all your enquiries.

You can contact us via email, our online chat, or if you prefer to talk to a ransomware recovery engineer, feel free to call us on one of the numbers below:

1300 500 400 (Australia)