Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Possible Ransomware attack, not fully infected...

  • Please log in to reply
1 reply to this topic

#1 gonzo67


  • Members
  • 2 posts
  • Local time:05:18 PM

Posted 14 November 2015 - 07:41 PM

I was doing a torrent search on demonoid.ph, and while browsing around, I got a quick popup (was too fast to read) and then all my desktop icons went away, and something was installing. I tried to quickly his CTRL/ALT/DEL and stop the install of what ever it was, but it did not let me, so I slapped the reset button quickly, and reset my system.I think this may have helped me, but only a little. I do believe I am still infected, but for now, I have access to my system. I now get the User Account Control popup, saying:


Do you want to allow the following program to make changes to this computer?


Program Name:  Command Line Interface for Microsoft Volume Shadow Copy Service.


Verified Publisher: Microsoft Windows


Program Location: C:\windows\SysWOW64\vssadmin.exe  delete shadows /all  /Quiet


Now, when this pops up, I hit the No button, and it goes away, and I can open another program, but this window will pop up again but now stays minimized to the task bar until I click on it and bring it to the front again. Once it's on top, I can't access anything else until I hit no.


Every folder I open has 2 new files in it.


an HTML file named :  _how_recover_hal


and a text file named:  _how_recover_hal


the text in the text file is copied and pasted here:


What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)

What does this mean ?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them,
it is the same thing as losing them forever, but with our help, you can restore them.

How did this happen ?
Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.
All your files were encrypted with the public key, which has been transferred to your computer via the Internet.
Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.

What do I do ?
Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.
If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://ym7wmciue9n.bg3hd7smh73.com/77264DF14A75AD91
2. http://psbc532jm8c.hsh73cu37n1.net/77264DF14A75AD91
3. https://3st7uyjfocyourll.onion.to/77264DF14A75AD91
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser and wait for initialization.
3. Type in the address bar: 3st7uyjfocyourll.onion/77264DF14A75AD91
4. Follow the instructions on the site.

Your personal pages:
Your personal page (using TOR-Browser): 3st7uyjfocyourll.onion/77264DF14A75AD91
Your personal identification number (if you open the site (or TOR-Browser's) directly): 77264DF14A75AD91



Right now, I have a little digital messenger in my system trying to deliver this thing. I'm hoping someone might know a way to kill the messenger before he actually delivers it. I know I'm most likely infected already, but as long as I have access to things, maybe this info will help.


Note: about my schedual, I work 3rd shift and it's just after 7:30 PM as I post this, I leave for work in about 2 and a half hours. And some nights, my start time for work changes. while dealing with this issue, I will stay at my system until I have to leave for work, so I will respond to any activity immediately, up until I have to leave for work. And I also know that anyone who may be helping me here has their own schedual, and I don't expect them to stay at their computer 24 hours a day just on my account. Any help at all will be appreciated.  Thanks in advance :)



BC AdBot (Login to Remove)


#2 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,751 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:18 PM

Posted 15 November 2015 - 07:11 AM

Are there any file extensions appended to your files...such as .ecc, .ezz, .exx, .zzz, .xyz, .aaa, .abc, .ccc, .CTBL, .CTB2, .XTBL, .encrypted, .vault, .HA3, .toxcrypt or 6-7 length extension consisting of random characters?

You are most likely dealing with a newer variant of TeslaCrypt/Alpha Crypt.

Any files that are encrypted with the newer variant of TeslaCrypt will have the .exx, .xyz, .zzz, .aaa, .abc or .ccc extension appended to the end of the filename. The .aaa/.abc/.ccc variant drops files (ransom notes) with names like Recovery_File_*****.html, Recovery_File_*****.txt, restore_files_*****.html, restore_files_*****.txt, recover_file_*****.txt, recover_file_*****.html, HOWTO_RESTORE_FILES_*****.txt, HOWTO_RESTORE_FILES_*****.html, howto_recover_file_*****.txt, howto_recover_file_*****.html (where ***** are random characters) and pretends to be CryptoWall 3.0.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users