I am helping a friend which is an accountant and got all of her books locked due to this. Here are some details:


BTC address of the attacker: 
1MBwkTssJkqRvXmAFcSEZ3xTD39A9rkyYA
Email:
helptoyou1@india.com
File name example:
V1rf3n+NT9R1ZM7SmU0.helptoyou1@india.com.8464DBdhFhbd4.lock
Filename of ransom notice: How to restore files.hta




Neither globe nor globe2 could help ("error: reference files missing" after dragging and dropping both an encrypted and non encrypted file to it at once).

Also this thread at Bleeping Compuer did not help much.

My friend paid 1 BTC to the scammers, after which they sent no key and asked for more money (obviously). Unfortunately, I am not much of a cryptographer, so I am seeking your help to decrypt the files.

Edit:
This is what Recuva says (unable to recover since file x was overwritten by file y.lock)


UPDATE: No solution was found, the person had to format her computer and lose all the data.

I don't think you will see those files again, unless you have a back up.

You can view the transaction history of the Bitcoin address you were asked to pay to here. As you can see, there are 303 transactions in total and many of them are for 1 BTC.

That implies that the same Bitcoin address have been given to multiple victims. This in turn means that it is impossible for the perpetrators to know who has paid, and what encryption key should be sent. (Hence the odd request for a screenshot, I presume.)

So either they are incompetent in their handling of the ransom, or much more likely, they are not restoring any files, instead just milking victims on more and more money. And if they are not restoring any files, why even bother to encrypt them when you can just overwrite them with random garbage?

So those files are probably gone, no matter if you pay or not.

Edit: There are some good points in comments. Potentially the screenshots could be used as proof of payments, although a flawed one. And even if payment does not lead to decryption the files might still be encrypted.

But even with this taken into account, unless a remedy for this specific version of ransomeware pops up, you are very unlikely to be able to restore your files. Nkals answer has a great link to a repository of such remedies.

Edit 2: This Troy Hunt blogpost follows a similar line of reasoning about extortion and Bitcoins.

Edit 3: The recent WannaCry outbreak has made me reconsider this answer. Apparently WannaCry uses three hardcoded bitcoin wallets, but people still seem to have gotten their files decrytpted. So I think the base assumption of this answer is wrong.
