Solved cryptolocker infection

[Durden]

Greetings .. after two months abroad , I returned home to be greeted with a crypto infection in my father in law's pc .. the bad thing is that he says the it's been almost two months .. I checked when the "how_recover+oti" files were created and it says 3/12/2015 .. not sure if that's right .. but using
ShadowExplorer i could not find a version that far away , and system restore can only take me back to ~23/12/2015..
is there a way to recover/decrypt the files ?

 

[TwinHeadedEagle]

Hello,

Can you give me more info about this infection? Pictures would be great.

You can also peak inside this file:

C:\ProgramData\how_recover+oti.txt

 

[Durden]

thank you in advance

 

[TwinHeadedEagle]

Can you open that file and then paste its content quote tag here?

 

[TwinHeadedEagle]

Also, what is the extension of encrypted files?

 

[Durden]

++++++==============================================================================================================+++++++======-
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: RSA (cryptosystem) - Wikipedia, the free encyclopedia

What does this mean ?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them,
it is the same thing as losing them forever, but with our help, you can restore them.

How did this happen ?
Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.
All your files were encrypted with the public key, which has been transferred to your computer via the Internet.
++++++==============================================================================================================+++++++======
Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.

What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BTC NOW, and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://alcov44uvcwkrend.paybtc798.com/9E5651CBDA886311
2. http://alcov44uvcwkrend.btcpay435.com/9E5651CBDA886311
3. https://alcov44uvcwkrend.onion.to/9E5651CBDA886311

If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser and wait for initialization.
3. Type in the address bar: alcov44uvcwkrend.onion/9E5651CBDA886311
4. Follow the instructions on the site.

IMPORTANT INFORMATION:
Your personal pages:
http://alcov44uvcwkrend.paybtc798.com/9E5651CBDA886311
http://alcov44uvcwkrend.btcpay435.com/9E5651CBDA886311
https://alcov44uvcwkrend.onion.to/9E5651CBDA886311 
Your personal page (using TOR-Browser): alcov44uvcwkrend.onion/9E5651CBDA886311
Your personal identification number (if you open the site (or TOR-Browser's) directly): 9E5651CBDA886311
++++++==============================================================================================================+++++++======

 

[Durden]

files extension is *.vvv

 

[TwinHeadedEagle]

Luckily for you this is outdated TeslaCrypt infection (not Cryptolocker) and your files can be saved.

Can you zip one infected file and then upload it here:

Zippyshare.com - Free File Hosting

 

[Durden]

sorry the pc Froze dunno why, here's the file
removed

 

[TwinHeadedEagle]

Okay, I'll take a look at the file and will let you know what to do later.

 

[TwinHeadedEagle]

Okay, here is a decrypted file for you

Chapter 1.docx

 

[Durden]

:O ^_^ .. thank you .. but how can i proceed from here ... most of the files are encrypted

 

[TwinHeadedEagle]

Download TeslaDecoder from this link:

http://download.bleepingcomputer.com/BloodDolly/TeslaDecoder.zip

• Unpack archive and start TeslaDecoder.exe
• Click on Set key and under Extension: choose third one that starts with .xyz
• Into Key (hex) field copy your private key below and then click Set key again.

0FED42572D32CEDAE8B9CB308890874629001BBC5AA8966F05AED7A332E8FB19

• Click Decrypt All and choose No to keep original files in case something goes wrong. You can later easily delete encrypted ones if everything works well.

 

[Durden]

thank you so much man you've saved the day ^_^ .. decryption started if anything goes wrong I'll post here again
thank you so much

 

[TwinHeadedEagle]

Okay, let me know when you finish.

 

[Durden]

Okay, let me know when you finish.

ok , it finished and it decrypted everything .. thank u so much .. but one thing I keep seeing , whenever i open an excel file , the file contents do open corectly and is fine , but the strange thing is that whenever i close it, i find out that there is another tab in excel with the contents of the "how_recover" text I qouted above

 

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

 

[TwinHeadedEagle]

Do not paste reports, only upload them. Thanks.

 

[Durden]

Do not paste reports, only upload them. Thanks.

oops sorry bro .. here

 

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.