Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Files encrypted and renamed to .ecc

  • This topic is locked This topic is locked
1 reply to this topic

#1 adblr


  • Members
  • 2 posts
  • Local time:03:36 PM

Posted 26 March 2015 - 09:51 AM

My computer got infected with some malware that disabled the antivirus and added a .ecc extension to office, pdf, text and image files.

There was no ransom message, just some pornographic images at startup. There was a "syshost.exe" service installed and a program with a random name was running. I cleaned the malware and the antivirus works now, but these files no longer open.

For some files I have the unmodified original. I tried using Panda Ransomware Decrypt to extract the key and restore the files, but it failed.

Is it possible to use files that have the original and encrypted versions to extract information that can decrypt the rest of the files?

Edited by hamluis, 26 March 2015 - 02:47 PM.

BC AdBot (Login to Remove)


#2 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,932 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:06 AM

Posted 26 March 2015 - 05:56 PM

You are dealing with TeslaCrypt Ransomware. Unlike other ransomware that typically target images, documents, videos, and applications databases, TeslaCrypt also targets over 40 different video game related files. Any files that are encrypted will have the .ecc extension added to the end of the filename.

There is an ongoing discussion in this topic: New TeslaCrypt Ransomware sets its scope on video gamers

Rather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions, comments or requests for assistance in that topic discussion.

The BC Staff
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users