Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

TeslaCrypt (.VVV, .CCC, .EXX, .EZZ, .ECC, etc) Decryption Support Requests


  • Please log in to reply
5805 replies to this topic

#3241 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:30 AM

Posted 29 April 2016 - 05:44 PM

 

Afraid that is just the ransom note. You're looking for a file with nothing but three lines of random letters and numbers.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


BC AdBot (Login to Remove)

 


#3242 jpbrusa75

jpbrusa75

  • Members
  • 10 posts
  • OFFLINE
  •  

Posted 29 April 2016 - 05:52 PM

i dont have more txt. i put the ecc files in the external disk a lot of months ago...i think that i can rescue the files...



#3243 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:30 AM

Posted 29 April 2016 - 06:13 PM

i dont have more txt. i put the ecc files in the external disk a lot of months ago...i think that i can rescue the files...

 

When you backed up the encrypted files, did you backup the whole My Documents? It would be in there somewhere. If you backed up the whole profile (e.g. C:\Users\username), then the key.dat file would be under AppData (C:\Users\username\AppData).


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#3244 vinceyw

vinceyw

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:30 PM

Posted 30 April 2016 - 12:19 AM

HELP! im encrypted by ecovector3@aol.com, how can i decrypt it



#3245 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,932 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:30 AM

Posted 30 April 2016 - 05:52 AM

HELP! im encrypted by ecovector3@aol.com, how can i decrypt it

You already asked this question here which is the proper discussion thread for the infection (Troldesh/Shade) you are dealing with.

This topic is only for TeslaCrypt Support.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3246 Michael_PL

Michael_PL

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Poland
  • Local time:12:30 PM

Posted 30 April 2016 - 07:30 AM

 

Hi All!

Can You help me?

 

https://www.sendspace.com/file/mvmjad

 

I've got .aaa files.

Please wait about 30 hours.

 

@mike 1

Thank You!

 

I got my key and recovered my files.



#3247 artista

artista

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:30 AM

Posted 30 April 2016 - 10:24 PM

I am not sure if I have a computer infected with a varient of Teslacrypt but it is some form of Ransomware. All of the videos and images are missing and there are many files that spam me with white text on a black screen. The message tells me how my data has been encrypted and how I need to connect to some Tor site and pay them for the key. There are a lot of files names +REcovER+bkqrv+.png and +REcovER+plkvw+.txt.  Can someone please let me know what I am dealing with and if there is a way to decrypt the data?

 

Thanks

 



#3248 al1963

al1963

  • Members
  • 893 posts
  • OFFLINE
  •  
  • Local time:04:30 PM

Posted 30 April 2016 - 10:42 PM

@artista,

 

upload your encrypted file to the service and verify

that the file decryption is possible at this point or not

 

https://id-ransomware.malwarehunterteam.com/



#3249 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,932 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:30 AM

Posted 01 May 2016 - 05:51 AM


I am not sure if I have a computer infected with a varient of Teslacrypt... There are a lot of files names +REcovER+bkqrv+.png and +REcovER+plkvw+.txt...

TeslaCrypt 4.0 will leave files (ransom notes) with names like RECOVER+[random].TXT, RECOVER[5-random].TXT, recover_file.txt, _rEcOvEr_[5-random].txt, +-HELP-RECOVER-+[5-random]-+.txt, +REcovER+[5-random].txt, -!RecOveR!-[5-random]++.txt, {RecOveR}-[5-random]__.txt, -!recover!-!file!-.txt.

 

Support for TeslaCrypt 3.0/4.0 is provided in this topic where you can ask questions and seek further assistance but there is no solution to fix your encrypted files yet.


.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3250 pitersoncosta

pitersoncosta

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:08:30 AM

Posted 02 May 2016 - 07:22 AM

one can find the key for me, my computer is damaged and can not do the process.
 
thank you friends
 
 


#3251 mike 1

mike 1

  • Members
  • 207 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Russia, Moscow
  • Local time:02:30 PM

Posted 02 May 2016 - 07:36 AM

 

one can find the key for me, my computer is damaged and can not do the process.
 
thank you friends
 
 

 

Please wait for a few minutes.

 

Privatekey: 3C400CBA6B4BB00420532E74F0A7F720FD100622D0D1BD83845EE90CB8939D92


Edited by mike 1, 02 May 2016 - 07:44 AM.

Мы разные, но идея одна! 


#3252 periergos

periergos

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:01:30 PM

Posted 02 May 2016 - 11:06 AM

Hello to all.

 

I have a .ccc encryption.

Got  this as a work.txt but Yafu keeps crashing on my pc.

Any help please?

 

 

Thanks in advance!!!

 

 

 

 

================
= PrivateKeyBC =
================
 
SharedSecret1*PrivateKeyBC
hex 08E40C4AF445C907AD7980421A9F3220AB4DB184CB838794DECA33C1A80B27018EEF2E1EC330655B3F1C73930B13E2AEC16C7C1CEB7DA64E1064E4A8B8C6585A
dec 465649637972906221016511337171991398929743303094660977374006440220845932712375025263192492283715142180345785557427417739361326255006317083815265303943258
 
 
 
PrivateKeyBC = 
PublicKeyBC = 044274D44313454738C0C2EED498F7F74A4B6C7CA3851E08AB07178E73233830EA2571BC3A40A15B880A4B713C70A453C110A82DB9D7FDA3D0B8A2D8D3309751C8
 
 
 
 
==================
= PrivateKeyFile =
==================
 
SharedSecret2*PrivateKeyFile
hex 7BFD2EBD2E3234F843EEE3221571C660986170A92B03DCDBD1C2E0CC6DFDA7FBC67BCF8669A239E1657C47FA73177186880D14EE9C98CF4EB75B7441A2CBDDDF
dec 6493830557611700228245244257417296983048166032943808794997184605546629322112597658631566344963372520512173664023825263711589004105238096784875208498208223
 
 
 
PrivateKeyFile = 
PublicKeyFile = 0456B17F0B63B689E5809A7AAB8DC5C2BE5916692C9AEBC5BBEA6AF3713F7624B806653F8A93D854BEF405BB849C0F3FAEE13C0C28FAE0797B418C51AFF73C62FF


#3253 thyrex

thyrex

  • Members
  • 597 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Belarus
  • Local time:01:30 PM

Posted 02 May 2016 - 12:47 PM

I took your case. Wait please.


Microsoft MVP 2012-2016 Consumer Security

Microsoft Reconnect 2016


#3254 elyogui

elyogui

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:02:30 AM

Posted 02 May 2016 - 01:37 PM

Good morning , why my message is to see if there solution for the variant encrypts files with the extension. crypt .

I have files that are encrypted , if need them to support me.

Thank you very much for your help



#3255 GDM93Si

GDM93Si

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:06:30 AM

Posted 02 May 2016 - 02:02 PM

please can anyone help me?  

 

1MtDu6dwfZR8vERKBo5Bh2Nn9xLpqCjtHy
04F6F0BD3481093DD3BBB5ED0865BB600CACDB0AB25E3D9FF086B4AB641785711CB81416FAEEB020ABC0F4EF021938532432EEC94C6EBA00264E62362E546C6226AEDA69060F6951EB54BB8A5AFE83B24C044A8DBE4B7663BCA0DF665E054F667F
CA31758A9C18CEE0
84
 
thank you in advance,





3 user(s) are reading this topic

0 members, 3 guests, 0 anonymous users