Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need help getting my files back, ending with .ECC


  • This topic is locked This topic is locked
3 replies to this topic

#1 janey6152

janey6152

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:05 PM

Posted 05 June 2017 - 03:09 PM

Hi guys.

 Back in 2013  i believe,  I was hit with CryptoLocker... I tired the Tesla decoder.and nothing . SO i put my HD away til now. Figuring Hmmm Maybe i can finally decrypt my files.

 

I was told by others on you- tube to get Tor and try to sign on using some server but its not working..

 

Open http://34r6hq26q2h4jkzj.42k2bu15.com or http://34r6hq26q2h4jkzj.79fhdm16.com,
https://34r6hq26q2h4jkzj.s5.tor-gateways.de/ in your browser.
They are public gates to the secret server.
Copy and paste the following Bitcoin address in the input form on server. Avoid missprints.
1KjjG3BDJJdeZdCcCwHn4QusokLNYTAusu
Follow the instructions on the server.

 

 

 

 Even on My Win 7 HD my Key.dat is key.dat.ecc

 

 But i found  another key.dat  and tried using it with the steps i had to follow with   TELSADECODER. and got a private key . and still couldn't get my files decrypted.

 

 Can someone Please help me..

 

 Thank you so much

 

 Janet :)



BC AdBot (Login to Remove)

 


#2 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,511 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:05 PM

Posted 05 June 2017 - 03:13 PM

If your files have .ecc, it is not CryptoLocker.

 

For the first variant of TeslaCrypt with .ecc, we can only decrypt yoru data if you have the key.dat, and/or the text document that it leaves with more information; RECOVERY_FILES.TXT would have been left in the My Documents of the infected computer.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#3 BloodDolly

BloodDolly

  • Security Colleague
  • 473 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Slovakia
  • Local time:01:05 AM

Posted 05 June 2017 - 03:22 PM


 Even on My Win 7 HD my Key.dat is key.dat.ecc

 

 But i found  another key.dat  and tried using it with the steps i had to follow with   TELSADECODER. and got a private key . and still couldn't get my files decrypted.

 

Try to decrypt key.dat.ecc with the key you got from key.dat you found. Then load decrypted key.dat into TeslaDecoder and you will see if there is still a a valid private key in that key.dat file and try that key.



#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,474 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:05 PM

Posted 05 June 2017 - 05:01 PM

Support for TeslaCrypt 2.x (and older versions) is provided in this topic where victims can post comments, ask questions and seek further assistance..
Support for decryption requests is provided here:Rather than have everyone with individual topics, it would be best (and more manageable for staff) if you posted any more questions, comments or requests for assistance in one of the above support topic discussions, particularly the last if dealing with one of the newer variants...it includes experiences by experts, a variety of IT consultants, end users and company reps who have been affected by ransomware infections. To avoid unnecessary confusion, this topic is closed.

Thanks
The BC Staff
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users