How to recover
Decrypt Files Encrypted by GlobeImposter Ransomware
from Windows

Where can I download and how should I properly use GlobeImposter decrypter? I’ve just read the news that some new ransomware versions emerged and the next day I receive a letter from [email protected] email saying that I must open the attached file. And, unfortunately, I did… How do I decrypt my files now?

GlobeImposter is a relatively old but thriving cyber infection. This parasite has recently launched a new malspam campaign which is infecting more computers than ever before. Malware experts believe that the recent upsurge of new Fake Globe virus version is fuelled with the help of Necurs botnet.

Currently, fake emails arrive from the following addresses: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], and [email protected].

These emails feature subject names such as Payment 0451, Receipt 78522 or Payment Receipt#03836. Inside the email, there is an attached Zip file which contains vbs file -- a file that executes most of the malicious ransomware functionalities.

If you have accidentally downloaded such file, it must be removed from the PC immediately. You must NOT interact with it in any other way. Otherwise, you may face some serious consequences and potentially lose your files permanently.

In case it is already too late and you have already opened the malicious file, there are a few things you can do to recover your files.

Decrypt GlobeImposter using Emsisoft decryptor

Since GlobeImposter has been out there for a while now, it is no wonder that malware specialists have already managed to come up with a decryption tool that could recover encrypted files partially or entirely.

We cannot guarantee that the tool will help decrypt files encrypted by the latest ransomware versions, but it is worth giving it a try.

To be able to use the decrypter properly, you must have an encrypted and non-encrypted version of at least one file. You will have to submit both of the files for the decrypter to be able to extract the private data decryption key.

After the key is extracted, you will be able to continue the decryption process with the rest of the documents on your hard drive.

Download the GlobeImposter decrypter here.

Recover files using alternative methods

In case the decryptor does not work, and you do not have backup copies to restore your files from, you may be able to recover your files with the help of the techniques listed below. Please keep in mind that before trying any of these recovery methods, you must remove the malware from your PC. We recommend using software such as [rev id=”Reimage”] for this purpose.

1. Data Recovery Pro

Data Recovery Pro tool is a software that you can safely use to recover some of the ransomware-affected files. You can accomplish that in a few simple steps:

1. First, you will have to download [rev id="Data Recovery Pro"]. Once you do that, run the program and install it
2. Once installed, launch the application
3. Scan the selected partitions for encrypted files
4. Follow the directions on the screen to restore your data

2. ShadowExplorer

ShadowExplorer data recovery is primarily based on finding and restoring information from Volume Shadow Copies. Of course, this tool will only be useful and functional if these copies of the encrypted files have not been destroyed by ransomware. If they are not, you just might succeed to get back access to your personal data. Here is what you should do:

1. Obtain ShadowExplorer software from the official source
2. Run the software installer and follow the setup steps
3. Run the program once it is installed and select the files or folders you want to restore and press Export.
4. Select where you want these files to be placed and continue the operation.

3. Windows Previous Versions feature

If you have been careful and created a system restore point before ransomware hit your PC, you should be able to use Windows Previous Versions feature. Here are the core steps you will have to take:

1. Locate the files you want to recover on your PC
2. Right-click on them and in the drop-down menu, locate Previous versions option
3. Here, you will be prompted to choose a version to which you want your selected file to be restored
4. Once you select that, just click the Recover button and you’re done