Family photos encrypted by ransomware - Help needed ASAP!

in Techie Stuff
9 replies 595 views

Hi there,

Is anyone able to help me please? I have just looked at my external Terramaster drive for photos of my Mom but all files on there have a new extension (.LOCK3D) and every folder also contains a 'readme.txt' file which states that all my files have been locked and I am to follow their instructions to send money. I am really distraught because I wanted some photos of my Mom to put into her coffin as she sadly passed away from cancer 2 weeks ago, and her funeral is next week! I cannot believe the year I've had... my best friend passed away from Covid in January and after winning a court case to get back £5500 from an airline company who refused my refund, they never paid me and it cannot be enforced because they have stopped operating in the UK and now I get this!! The ransom instructions demand I buy Bitcoins to the value of £2000 and send it to another Bitcoin address. If I don't do this in 4 days the payment increases to £4000!! I really cannot afford to send anything as although I work full-time, I have two very young children to provide for. I have tried to find information online about this but google comes up with nothing other than to try well known antivirus companies that also deal with 'ransomware.' I have had no luck with them either. Can anyone out there PLEASE help me? I am a total wreck atm.

Thank you in advance.


  • Neil_JonesNeil_Jones Forumite
    8.1K Posts
    Part of the Furniture 1,000 Posts Name Dropper
    Might not be a lot you can do unless you have another backup that wasn't connected to the computer at the time.

    This is how ransomware works, your key files are encrypted in some extremely secure fashion that in some cases dependent on the variant you have picked up is almost unbreakable. might be of interest.  It won't help you with your files on its own but it'll hopefully tell you what it is you've picked up and whether there is an easy way out.  No guarantees.

    Don't pay anybody anything especially in Bitcoins - it doesn't guarantee anything.
  • facadefacade Forumite
    6.2K Posts
    Part of the Furniture 1,000 Posts Name Dropper
    Avast have free tools that can work with some ransomware, once you know what it is.

    I guess you don't leave the original photos on the camera, I just buy a new card when one fills up.
    If they were taken with a 'phone, some phones automatically back up all photos to "The Cloud"

    I want to go back to The Olden Days, when every single thing that I can think of was better.....

    (except air quality and Medical Science ;))
  • edited 22 December 2022 at 5:46PM
    Olinda99Olinda99 Forumite
    823 Posts
    500 Posts Name Dropper
    edited 22 December 2022 at 5:46PM
    Just to say - if you do have a backup somewhere don't even consider plugging it into that computer
  • Keep_pedallingKeep_pedalling Forumite
    13.4K Posts
    Eighth Anniversary 10,000 Posts Name Dropper Photogenic
    It may be possible to recover some of the files but the first thing you need to do is clear you PC of the virus.
  • tallmansixtallmansix Forumite
    1.8K Posts
    1,000 Posts Fourth Anniversary Name Dropper Photogenic
    Have you got snapshots enabled? If so you may have previous copies of the unencrypted files available? But before you restore from snapshot - be very carefully because they will be instantly encrypted again if you don't remove the malware first.

    I think some of the answers above are thinking you have ransonware on your PC, but it is almost certainly running on the Terramaster NAS under the TOS system (would be useful if you mentioned the device model) and therefore most of the above methods aren't of much use.

    I'm guessing you don't have any of this data backed up elsewhere as the simplest thing to do is factory reset the Terramaster, and upgrade to latest TOS version.

    The malware is still on your device so it is important to disconnect it from the internet as soon as possible to prevent it spreading any further. Probably best to power it off for now and await a possible solution in the future if you don't want to wipe it.

    There is currently no fix for this, there is a lot of chatter on the Terramaster forums but so far nobody has come up with a decryption method.

    YNAB enthusiast and extreme coupon-er.
    Discounts, coupons and cashback:
    2019 = £1,443.52
    2020 = £1,191,76
  • GDB2222GDB2222 Forumite
    23.1K Posts
    Part of the Furniture 10,000 Posts Name Dropper
    So sorry that mum died. 

    Please do not send any money to these villains. Just leave the NAS powered off, in the hope you can get it decrypted one day. 
    No reliance should be placed on the above! Absolutely none, do you hear?
  • halfamohalfamo Forumite
    79 Posts
    Third Anniversary 10 Posts Name Dropper Photogenic
    There is a youtube user named DiskTuna who works with corrupt files. I had some which a friend of hubs had sent me to play with and he tried to help with decrypting one for me. It was too far gone unfortunately as it was a disk error not a ransomware thing.
    However he is quite knowledgeable about the software  that is out there and could possibly suggest ways to get them back.
    He does reply to questions.
    He has his own software too which he shows himself using but he doesn't hard sell .

    Its me Culpepper LOL couldn't sign in with the old ID so time for a fresh start....
  • J_BJ_B Forumite
    6.1K Posts
    Part of the Furniture 1,000 Posts Name Dropper Photogenic
    Not sure if these folks could help?

  • Olinda99Olinda99 Forumite
    823 Posts
    500 Posts Name Dropper
    I think it is true to say that the disk itself isn't faulty, it is just that everything on it is encrypted.

    Without the decryption key it will remain encrypted.
Sign In or Register to comment.
Latest MSE News and Guides

Did you know there's an MSE app?

It's free & available on iOS & Android


Regifting: good idea or not?

Add your two cents to the discussion

MSE Forum

Energy Price Guarantee calculator

How much you'll likely pay from April

MSE Tools