Ransomware Hunter
Posted 19 February 2016 - 02:52 PM
That video has been posted before. I have been in contact with the company behind that software, and they confirmed it has to be installed before infection. It also appears to only grab the PrivateKeyFile, so it has to re-do its process anytime the computer is restarted while the infection is still running.
ID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]
RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]
CryptoSearch - Find Files Encrypted by Ransomware [Support Topic]
If I have helped you and you wish to support my ransomware fighting, you may support me here.
Posted 19 February 2016 - 05:28 PM
Yes, that happened because his yafu.ini tune was set like a Xeon running in a Linux 64 environment, totally incompatible with his hardware & system.The whole thing was rectified 11hs. ago. Thx Demonslay!
************************************************************************************************************************
Please, start TODAY a BACK UP DISCIPLINE, & try to spread the idea to everyone you know. This way you, & your beloved ones, will keep safe the whole data, & the crypto-criminal activity will turn senseless soon.
Posted 19 February 2016 - 06:42 PM
There is no way of decrypting TeslaCrypt 3.0 .xxx, .ttt, .micro, or .mp3 variants at this time since they use a different protection/key exchange algorithm, a different method of key storage and the key for them cannot be recovered. Support for TeslaCrypt 3.0 is provided in this topic if you have further questions but there is no solution to fix your files.I'm afected with tesla virus. Please help me to decrypt my fyles. There is one of my afected file. .micro
quietman7 is wrong. You can decrypt your files : https://www.sendspace.com/file/nmlg6v
Ransomware Hunter
Posted 19 February 2016 - 06:54 PM
quietman7 is wrong. You can decrypt your files : https://www.sendspace.com/file/nmlg6v
What are you insinuating by sending a Word document about a Shakespeare production? From your previous posts, you were hit by the .vvv variant, which is decryptable. Those with the .xxx, .ttt, .micro, or .mp3 are not decryptable without paying the ransom. I'm unsure the status of your factoring since it is not on factordb.com, but I can only assume you got the factors from VirusD then?
ID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]
RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]
CryptoSearch - Find Files Encrypted by Ransomware [Support Topic]
If I have helped you and you wish to support my ransomware fighting, you may support me here.
Posted 19 February 2016 - 07:01 PM
quietman7 is wrong. You can decrypt your files : https://www.sendspace.com/file/nmlg6v
What are you insinuating by sending a Word document about a Shakespeare production? From your previous posts, you were hit by the .vvv variant, which is decryptable. Those with the .xxx, .ttt, .micro, or .mp3 are not decryptable without paying the ransom. I'm unsure the status of your factoring since it is not on factordb.com, but I can only assume you got the factors from VirusD then?
@Demonslay335 : look at post 1971
Bleepin' Gumshoe
Posted 19 February 2016 - 07:29 PM
- Added support for TeslaCrypt 3.0.0 encrypted files (.xxx, .ttt, .micro).
...
I am still working on the solution how to recover one of the keys listed above, but currently there is no solution.
@All
The current state of decryption of TeslaCrypt 3 (.xxx, .ttt, .micro) is still the same, we can't recover any of the 7 private keys right now....
.
.
Microsoft MVP Alumni 2023, Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023
Microsoft MVP Consumer Security 2007-2015 
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief
If I have been helpful & you'd like to consider a donation, click 
Bleepin' Gumshoe
Posted 19 February 2016 - 07:39 PM
.
.
Microsoft MVP Alumni 2023, Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023
Microsoft MVP Consumer Security 2007-2015
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief
If I have been helpful & you'd like to consider a donation, click
Bleepin' Gumshoe
Posted 19 February 2016 - 07:41 PM
.
.
Microsoft MVP Alumni 2023, Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023
Microsoft MVP Consumer Security 2007-2015
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief
If I have been helpful & you'd like to consider a donation, click
Posted 20 February 2016 - 03:05 AM
I really would like to understand what's going on.
Yes, i know, it's far away from me all that could happen behind a private chat between members/masters/guests..., it's ok, but why to expose that chat here?
I would like to know if we can start to help the victims of TC3.0....or, what's going on?
************************************************************************************************************************
Please, start TODAY a BACK UP DISCIPLINE, & try to spread the idea to everyone you know. This way you, & your beloved ones, will keep safe the whole data, & the crypto-criminal activity will turn senseless soon.
Posted 20 February 2016 - 03:18 AM
I really would like to understand what's going on.
Yes, i know, it's far away from me all that could happen behind a private chat between members/masters/guests..., it's ok, but why to expose that chat here?
I would like to know if we can start to help the victims of TC3.0....or, what's going on?
yeah,exactly 
Posted 20 February 2016 - 04:22 AM
@HLR7594:
Demonslay335 didn't want to infect you, he just used wrong site for file sharing.
I reuploaded that package to sendspace. Here is the link https://www.sendspace.com/file/b67cig
Posted 20 February 2016 - 06:31 AM
Hi all!
Is it now possible to decrypt v3 .micro, .mp3?
Another thing: I have got one computer with .mp3 infection. I took away network connection. I found exe virus. If I run it, it encrypts all my new files...so...where does it stores the private key, if it does not have internet connection?
Is it possible to get it out the RAM when the virus is running?
Edited by viljemt, 20 February 2016 - 06:31 AM.
0 members, 5 guests, 0 anonymous users
Back to top
