Do you know what .xtbl extension is?
.xtbl extension is a filename extension used to mark encrypted files. Specialists say that it should be used by the ransomware infection that is known to be the new variant of Scarab Ransomware. Can you find this extension at the end of all files that can no longer be opened? If so, it means that your files have already been encrypted. Ransomware infections lock files on affected computers to help cyber criminals obtain money easier, and the .xtbl extension ransomware is no exception. It does not even try to hide this: “You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.” The ransom note dropped by this infection will tell you that you need to pay money to get the decryption key that can unlock files, but you should not do this. There are no guarantees that you will get the promised tool after you send the required money. In addition, nobody knows whether it will work in a proper way. All users who encounter malicious software should go to delete it from their systems right away. Your files will not be unlocked even if you delete the ransomware infection fully from your computer, but it does not mean that it can stay. If you do nothing about its presence, you might find even more files encrypted one day.
The .xtbl extension ransomware is a nasty threat because it locks files immediately after it successfully infiltrates users’ computers. As you already know, it adds the .xtbl extension to all those files. This is not the only symptom showing that the entrance of this ransomware infection was successful. If you can locate a new file IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT on your computer, it means that it has already done its job, i.e. encrypted your files and dropped a ransom note. Users are told that files have been encrypted on their PCs due to “a security problem,” but you can be 100% sure that the ransomware infection is the one responsible for encrypting your data. You need to pay for the decryption key to be able to unlock your files. The ransom has to be sent in Bitcoin, and its size depends on how fast users contact the author of the .xtbl extension ransomware. Users are instructed to send the “personal identifier” to joxe1@cock.li to get further information. They can even send cyber criminals 2 files to get them decrypted for free. You can send those files, but you should definitely not pay for the decryption tool that supposedly can unlock the remaining files. First, we are sure it will be quite expensive. Second, there are no guarantees that you will get it. Third, if all the victims send money, cyber criminals will never stop developing new infections.
It is hard to talk about the distribution of newly-detected infections, but our malware researchers believe that the .xtbl extension ransomware should not differ much from similar threats, i.e. it should be spread as an email attachment primarily. As has been observed by specialists, spam emails usually contain malicious attachments, so it would be best to stay away from them all no matter that they look harmless. You should also not click on any suspicious links because you might initiate the installation of malware. Finally, users who do not want to encounter any other infection ever again should also install a security application. It must be 100% reliable so that it could prevent all kinds of untrustworthy applications/malware from entering their computers.
No matter you decide to purchase the decryption key or not, you need to delete the ransomware infection from your computer in any event. The chances are high that you will only need to remove the ransom note dropped because the .xtbl extension ransomware deletes itself after encrypting users’ personal files. Of course, it is still advisable to check the %APPDATA% directory. If you can locate suspicious files there, remove them all mercilessly.
Delete the .xtbl extension ransomware
- Press Win+E to open Explorer.
- Access %APPDATA% (enter it in the URL bar and press Enter).
- Delete suspicious files.
- Remove the ransom note IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT from all affected directories.
- Empty Recycle bin.
In non-techie terms:
If your all files have received the .xtbl extension, it means that they have been encrypted by the ransomware infection that is the newest Scarab Ransomware variant. Like similar crypto-threats, it has been designed to obtain money from users. Do not purchase the decryption key from crooks because there are no guarantees that you will get it from them. In fact, it might even turn out that it is useless.