Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

TeslaCrypt (.VVV, .CCC, .EXX, .EZZ, .ECC, etc) Decryption Support Requests


  • Please log in to reply
5509 replies to this topic

#31 behrangasadian

behrangasadian

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 06 January 2016 - 03:46 AM

Hi all,

First off have to say amazing work and support by everybody here!

I also have the new variant (.vvv extensio )on one of our machines and could use a little help. I have loaded one of the encrypted files into TeslaViewer and put the appropriate information into TeslaRefactor, but it keeps telling me that the private key is not found. Either I am missing something, or not putting in the correct information. A little guidance would be appreciated.

Thanks in Advance. 
  •  


BC AdBot (Login to Remove)

 


m

#32 TheFab

TheFab

  • Members
  • 108 posts
  • OFFLINE
  •  
  • Local time:12:39 PM

Posted 06 January 2016 - 04:14 AM

Hello guys, can you help me Decrypt my files

https://drive.google.com/file/d/0ByqS9XwwNrz1UWFJZkVHaUlvVXc/view?usp=sharing

 

Thank You in Advance

 

I've sent you a PM.



#33 TheFab

TheFab

  • Members
  • 108 posts
  • OFFLINE
  •  
  • Local time:12:39 PM

Posted 06 January 2016 - 04:22 AM

 

Hi all,

First off have to say amazing work and support by everybody here!

I also have the new variant (.vvv extensio )on one of our machines and could use a little help. I have loaded one of the encrypted files into TeslaViewer and put the appropriate information into TeslaRefactor, but it keeps telling me that the private key is not found. Either I am missing something, or not putting in the correct information. A little guidance would be appreciated.

Thanks in Advance. 

 

Hi. Did you put the factors, in separate lines, of either the SharedSecret1*PrivateKeyBC (recommended) or the SharedSecret2*PrivateKeyFile?

 

PM me if you need help finding the factors.



#34 juanb

juanb

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:39 PM

Posted 06 January 2016 - 04:23 AM

 
Hello friends, I have all my files with the virus, and nowwith the extension .vvv are
Anyone can help, please?

 



#35 TouMoua

TouMoua

  • Members
  • 6 posts
  • OFFLINE
  •  

Posted 06 January 2016 - 04:40 AM

 

Hello guys, can you help me Decrypt my files

https://drive.google.com/file/d/0ByqS9XwwNrz1UWFJZkVHaUlvVXc/view?usp=sharing

 

Thank You in Advance

 

I've sent you a PM.

 

Thank you @TheFab



#36 jagster99

jagster99

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:39 AM

Posted 06 January 2016 - 05:35 AM

HI my sons computer was infected with the virus with the vvv files but was formatted but kept his infected files on another drive  can anyone help tks in advance



#37 juanb

juanb

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:39 PM

Posted 06 January 2016 - 05:47 AM

hello,
how can I use the information obtained from teslaviewer to obtain the decryption key of all files? 

Thank you

================

= PrivateKeyBC =
================
 
SharedSecret1*PrivateKeyBC
hex 0C6ED5DF224D3AA9519944E25C046D373946FB7D632965C50D04CCE9A30A7092B1F32C3FEC7254E742A0DDC10F25F28504990067F7779F7D3F3C1703364911A8
dec 651166476418509535700103754150738585552764760755895201662828806738272782042385048035576628208920290406159953719767869884520221520988104025198550378418600
 
 
 
PrivateKeyBC = 
PublicKeyBC = 04A4AEBC87EE9CF1343B1C104C3BA32582BE03E0AA3D2C04B06E3E209DE9370518C315343007CCEA11A40697CFB40B9EED93BB283C9BB6CA865741D14E7F920AE5
 
 
 
 
==================
= PrivateKeyFile =
==================
 
SharedSecret2*PrivateKeyFile
hex 1F6C0E1AE3A0773035FCEEC348C026826E9B0AE64B3EC254E942546C01E4E7C19A5C9A426DDD5C6E073AFEB2C4766EDFC8F5C962D5EB226A79193FB90470F0B3
dec 1645708400407808572109704279136996443691221015426112630937527757645752181744642629676783844480466481838779955537663070725941745985836890328736569995882675
 
 
 
PrivateKeyFile = 
PublicKeyFile = 04B3C92AFE38F882F0789159EDA64FD1758EF781D179B4717A7031572DF1D214E835DE62D45EECA58B2345F97C53575145627A570426730C5C76388A9B55C8EC18
 
 
 
 

 



#38 ilvio

ilvio

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:39 PM

Posted 06 January 2016 - 06:39 AM

Hi. I'm from Italy. Same problem of other people. Wife's netbook infected by TeslaDecrypt with vvv extension.

Can I send to somebody a file to understand there is a chanche to decrypt it.

Thanks in advance,



#39 TheFab

TheFab

  • Members
  • 108 posts
  • OFFLINE
  •  
  • Local time:12:39 PM

Posted 06 January 2016 - 07:15 AM

Hello friends, I have all my files with the virus, and nowwith the extension .vvv are

Anyone can help, please?

 

I've sent you a PM.



#40 ilvio

ilvio

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:39 PM

Posted 06 January 2016 - 07:17 AM

Hi, I'm back. Reading the topic I tried with TeslaDecoder - no results,

Trying to load data from windows registry...
ERROR - Registry entry not found or incorrect.

Trying to load data file from disk...
ERROR - Data file not found

 

Loading file manually - no results

Loading data file from >> C:\Users\Mara\Desktop\Tapping\Activating Creativity.pdf.vvv
ERROR - Incorrect file size. Selected file is too big.

 

Then, TeslaViewer give me similare results  @juanb. The same question: how to use them to decrpyt vvv. files?

 

Thanks another time in advance for any help



#41 Lukaedi

Lukaedi

  • Members
  • 1 posts
  • OFFLINE
  •  

Posted 06 January 2016 - 08:01 AM

VVV: another victim (with RSA-2048).... what can i do? Thanks....



#42 hpoyarzunm

hpoyarzunm

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:07:39 AM

Posted 06 January 2016 - 08:13 AM

hi dear virusd,

 

apparently changed the forum, I send the files back, thanks

 

https://drive.google.com/file/d/0B32fJ0BwusQ3ZlJ5WWdpNVpsNDQ/view?usp=sharing



#43 juanb

juanb

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:39 PM

Posted 06 January 2016 - 09:03 AM

Dear TheFab, 

Thank you so much, you did a great job!

Thank you again, hugs from Spain   :busy:

... and happy new year!! 

:heart:



#44 hpoyarzunm

hpoyarzunm

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:07:39 AM

Posted 06 January 2016 - 09:29 AM

Hello friends, I have all my files with the virus, and nowwith the extension .vvv are Anyone can help, please? https://drive.google.com/file/d/0B32fJ0BwusQ3ZlJ5WWdpNVpsNDQ/view?usp=sharing

#45 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,244 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:05:39 AM

Posted 06 January 2016 - 09:33 AM

VVV: another victim (with RSA-2048).... what can i do? Thanks....

 

I will send you a PM.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users