In surprising end to TeslaCrypt, the developers shut down their ransomware and released the master decryption key. Over the past few weeks, an analyst for ESET had noticed that the developers of TeslaCrypt have been slowly closing their doors, while their previous distributors have been switching over to distributing the CryptXXX ransomware.
When the ESET researcher realized what was happening, he took a shot in the dark and used the support chat on the Tesla payment site to ask if they would release the master TeslaCrypt decryption key. To his surprise and pleasure, they agreed to do so and posted it on their now defunct payment site.
Now that the decryption key has been made publicly available, this allowed TeslaCrypt expert BloodDolly to update TeslaDecoder to version 1.0 so that it can decrypt version 3.0 and version 4.0 of TeslaCrypt encrypted files. This means that anyone who has TeslasCrypt encrypted files with the .xxx, .ttt, .micro, .mp3, or encrypted files without an extension can now decrypt their files for free!
How to use TeslaDecoder to decrypt Teslacrypt Encrypted Files
With the release of the master decryption key for TeslaCrypt, victims can now download TeslaDecoder to decrypt files encrypted by TeslaCrypt. Simply use the download link below and save TeslaDecoder to your desktop.
TelaDecoder is downloaded as a zip file, so you need to extract it and then double-click on the TeslaDecoder.exe file. This will launch TeslaDecoder as shown below.
Now click on the Set Key button and select the extension used for your encrypted files.
If your encrypted files have the same name as the original files, select the
Once you have selected your encrypted file extension, click on the Set Key button as shown in the image below.
You will now be at the main screen with the correct decryption key loaded into the decryptor as shown below.
Now that the correct decryption key is loaded into the decryptor, you can either decrypt a certain folder or have it scan your entire drive. To decrypt only a specified folder, click on the Decrypt folder button. To decrypt the whole computer, click on the Decrypt all button. When you click on this button, TeslaDecoder will ask if you want to overwrite your files with the unencrypted version. To be safe, I always suggest that you do not do this in case something fails with the decryption.
When TeslaDecoder is done decrypting your files, it will show a summary in the main window.
All of your files should now be decrypted and if you did not choose to overwrite your files, there will be backups of the encrypted files with the .TeslaBackup extension added to them.
A big thanks to ESET and especially BloodDolly who has monitored every version of TeslaCrypt that was released. He has done a tremendous amount for the fight against ransomware and for helping TeslaCrypt victims all over the world!
Comments
Cuko - 7 years ago
So, still no hope for the .vvv file extension? :(
Lawrence Abrams - 7 years ago
This will work on VVV. We already had a solution on VVV, but this one is easier.
Googulator - 7 years ago
Are you sure this will work for .vvv files? IIRC a different master key was in use back then (the 3rd Tesla key, while 3.0 and 4.0 use the 4th one)
Lawrence Abrams - 7 years ago
Ahh my bad, but we can still decrypt by the old factoring method.
vilhavekktesla - 7 years ago
Cuko, just send me a pm, and I can guide you with your issue.
Regards
vilhavekktesla - 7 years ago
Congrats to you all. This is fantastic news to anyone. To BC, Bloodolly, Eset, and all others thanks alot for you continous effort in the fight to help as many victims as possible. Now it appears the Only Teslaversion that cannot easily be decrypted is the .ccc version under certain circumstances. The forum is still available to all that need help decrypt and recover their version of Teslaencrypted files. There will now be several 1000000 happy Teslavictims, finally they can have their data back, and be lucky Tesla hit and not one of the other Ransomwares where many are not dedcryptable, unless you have the correct key.
So I repeat myself once again. Make sure you at all time heve healthy and valid backups of anything you do not want to loose, wether it be to ransomwares or a hard disk crash.
For all that paid to get the key, it's a sad experience, for anyone that wondered if they want to pay, this is a very happy day. Now all your data may be recovered, if you made the backups after the attack. Do celebrate this with making a backup of your recovered files.
Regards
BloodDolly - 7 years ago
I think you mean old .ecc from pre-ECDH version of TeslaCrypt not .ccc..
vilhavekktesla - 7 years ago
Yes I do. I don't like to have typos to essential info, so I will change it. and add your info. Too bad I cannot change and fix the typo anymore.
Anyway:
For some files of type .ecc there might be issues decrypting the files. This does not mean any victims of .ecc should give up. Do contact BC and ask for help, so you can have advices. Hopefully you had a good backup so all involved files and registry keys can be checked. Never give up until it is to late, and not even then. Maybe there is a solution, which has not been found yet so keep the backups forever.
Regards
jwhitted24 - 7 years ago
I cannot thank everyone enough. One customer of ours has all his holiday pictures and videos from back to 2008 encrypted. We saved the drive just incase this was decrypted.
Time to get his data back!
wat679 - 7 years ago
Amazing victory for everyone!!! I had my infected PC shelved and just waiting for this day - I knew it would come but I didn't imagine it to be in this manner of surrender... just wow! Keep up the good fight everyone on the defense and research side! What a good day for me and its going to be a good weekend as well :)
Thank you ESET and BloodDolly for persevering, without your determination this would not have been possible! Thank you Bleepingcomputer team for your support and delivering the good news!
Vinaka!!
Amigo-A - 7 years ago
Great news! Thank you!
al1963 - 7 years ago
Excellent! it works! I join in the congratulations BleepingComputer.com entire team and, of course, BloodDolly!
learnerskp - 7 years ago
#Good news for world wide Tesla victims, they can have their data back. A special thanks to BleepingComputer.com entire research team and, Lawrence Abrams,BloodDolly,
Mchrom - 7 years ago
I just want to express my gratitude for this awesome site.
I'm decrypting files as we speak and it works (.mp3 Files).
Many thanks to everyone involved. Keep up the good work!
Slowie - 7 years ago
THANK YOU! I am deeply gratetful to all of you and your work here! I'm sure you saved lots od people and among them there is also me. This is a happy day - beacuse of you!
Cheers!
Wallak - 7 years ago
Thank you guys, BC, BloodDolly, ESET and all the people behind the scene. Big thanks to all, this is a great victory and a fresh hope to all the victims. These are the reasons why websites like BC must continue on the top of the FREE SPEECH.
Best Regards.
DodoIso - 7 years ago
Such an ending is kind of anti-climatic, but I won't complain. A special THANK YOU to BloodDolly and Bleeping Computer.
:-Dodo
vilhavekktesla - 7 years ago
This is how all good movies end... With a bit of surprise :)
tpapple - 7 years ago
Great JOB.
suzubird - 7 years ago
Congratulation :)
You deserve it and more than really
Plz accept from deep my appreciate
TheJokerz - 7 years ago
Yay thank you everyone that has helped with this!!
Socket89 - 7 years ago
This can work with .encrypted files ? thanks !
Lawrence Abrams - 7 years ago
No, unfortunately not.
Leplant - 7 years ago
Great job ! Many thanks to all of you
Pouquiwak - 7 years ago
Hi Guys and Girls, Thank you for your great job, i just made an attempt to decrypt some files which crypted with TeslaCrypt4.0 with no extension. And it works like a charm.
Kindest Regards Pouquiwak
vilhavekktesla - 7 years ago
Emptied and moved
vilhavekktesla - 7 years ago
Emptied and moved too. Need to check why reply did not work the first time.
nowaka - 7 years ago
Will this work with .crypt extension files? Chances of that in the future?
Demonslay335 - 7 years ago
TeslaCrypt NEVER used he extension ".crypt". You are dealing with a completely different ransomware. Chances are, you were infected by CryptXXX; please refer to the following article for possible decryption: https://www.bleepingcomputer.com/news/security/kaspersky-releases-updated-decryptor-for-cryptxxx-2-0/
ivosavo - 7 years ago
Many thanks to all who spent their time to find a solution!! Great Job.
Yesterday I recovered a pc with "scrambled" files with .micro extension. The tool worked like a charm.
Still looking for a solution for Crypt0L0cker, though. I have a friend with .encrypted files
can someone address me somewhere to try to find a solution for this?
Thanks again
Ivano
Angoid - 7 years ago
Do you mean the original CryptoLocker? That's been dead a long time now.
But take a look here:
https://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information
That may give you some inspiration in terms of researching it further.
ivosavo - 7 years ago
Thanks for the answer, not the original, indeed the one with "zeros" instead of "O"s that should be a variant of torrentlocker and renames files with .encrypted extension
Thanks
Angoid - 7 years ago
Hate to be the bearer of bad news, but looks like it's not possible still :(
https://www.bleepingcomputer.com/forums/t/574608/crypt0l0cker-support-topic/page-20#entry3981890
mefisto660 - 7 years ago
Hello
I thank also, still have a problem.
My hard drive was on 04/23/2015 all encrypted doc, zip and jpg data
* .ecc With the constriction.
The new program, it can not decrypt anyway.
Have been many attempts.
Does anyone have a different key, or can help me differently.
thank you in advance
Demonslay335 - 7 years ago
You will need the contents of either %APPDATA%\key.dat, My Documents\recovery_file.txt, or My Documents\recovery_key.txt; it's a simple text file with three lines of random characters. You can refer to the readme that comes with TeslaDecoder for more information on this (look for mentions of ".ecc"). The .ecc variant did not store the needed information in the encrypted files, and can only be decrypted by factoring the numbers located in the recovery file. Once you have found the file, you can post in this topic for help with deriving a key: https://www.bleepingcomputer.com/forums/t/601379/teslacrypt-vvv-ccc-etc-files-decryption-support-requests/
mefisto660 - 7 years ago
Thank you for your quick response,
the memoir how that is I've often looked at, but I understand how not any. with English I'll also deal only with translators.
a file name "Help_Restore_Files" is in each directory
there is a 1to1 Guide
luigiu - 7 years ago
Hi folks, I already tried with file *.jpg.micro, set master key and after decrypt folder but it doesnt' work. Any suggest? and how about *.crypt files?
Rowanflame - 7 years ago
So I've un-encrypted the files (from .ttt) but now everything is corrupt and won't open...... any ideas?
I'm getting a "PADDING error with verified key WARNING"
kabom - 7 years ago
I cant find recovery key in appData or myDocuments.. all my files are .mp3 extension and Bloody don't recovering them :/ Any suggestions?
behrtec - 7 years ago
Hello. I have a .crypt file extension on all my files. They were encrypted on 5.16.16. The kaspersky rannohdecryptor 1.9.1.1 (released today) calls it a cryptxxx v3 and doesn't support decryption. The key difference between this and other crypt files, is that size of the encrypted file size is increased slightly.
Any thoughts?
bisman - 7 years ago
behrtec same here. hi everybody. i also have .crypt file extension on all my files. i used kaspersky rannohdecrypter. i also used tesladecoder but nothing happenned. i have 2TB of data of previous ten years . including my personnel home pictures of my family. please anybody help. i m totally frustrated by this virus. Even .txt .MP3 .DOC .JPG .AVI .MP4 . files are infected. SO PLEASE PLEASE HELP. please reply to my email: nanman786@gmail.com
bisman - 7 years ago
please do HELP
bisman - 7 years ago
EVERY folder consists of two files !Recovery_59EDE08C4CB5.txt and !Recovery_59EDE08C4CB5.html
Nomad71 - 7 years ago
Hi,
As many other user before I've an affected system as well. I followed the welcome guideline with the TeslaDecoder but it seems to be that only proposed file extention will be supported (e.g. ttt, mp3). In my case all files were encrypted with extention .cerber and the decoder is unable to find / process these kind of files.
Does anyone have expierences with these special files?
Thanks a lot.
toilatoi - 7 years ago
Hello friends
I got an error file document encryption.
Used tesladecoder decoding failed
File notice of .vvv
This is version 2.2.0 tesla
hope you guide me decrypt data recovery
help me
compcrewnpt - 7 years ago
I am helping someone who also has the .crypt extension. They paid the ransom before the deadline but the site never showed me the link to download the decrypter. Totally left us high and dry!
mingeonkim - 7 years ago
Thank you very much
.micro file decryption problem has been fixed. But that requires a bit Coin
.html and .jpg files are not deleted. How can I delete these files?
Henni73 - 7 years ago
In the description of the TESLADECODER you can read that .micro-encryptet files also can be decrypted with this tool and that a problem with decryption of .micro-files is fixed.
Is it right? An can I decrypt such files with this tool and without any problems now?
Need a fast answer!!! Thanx so much for developing this tool!
Van_Helden - 7 years ago
hello, I'm also having the same problem since May 19. My mp3 files and some pictures were under the name of crypt. I have used Kaspersky RannohDecryptor and did not. In addition to paying the ransom will be a possibility to recover the files? Thank you very much
compcrewnpt - 7 years ago
@Van_Helden; Did the thieves provide you with a link to the decrypter software?
Van_Helden - 7 years ago
"@Van_Helden; Did the thieves provide you with a link to the decrypter software?"
yes, they provided even with an identification number. I am directed to a page where after asking for $ 500.
compcrewnpt - 7 years ago
Thank you for taking the time to reply. It makes me even more curious as to why one was not provided for us.
Edi_WoW - 7 years ago
Hello, I'm also having a problem in .crypt extension RSA-4096. Is there a update on decrypting this ransomware?
opencage - 7 years ago
Hi, thanks for your efforts. I've tried this software on file.crpyt, but i can't decrypt any of them. In the logs of the tesladecoder folder i read "0 files decrypted, 0 file skipped 0 warning. Thanks in advance for your support
jasoncobb - 7 years ago
any word on getting an updated Decryptor for CryptXXX v3?
Lawrence Abrams - 7 years ago
Nothing yet.
JJ1969 - 7 years ago
Your factoring method works like a charm to recover .vvv files. Thanks a lot guys!!!
I managed to recover all the files in my laptop.
desperate79 - 7 years ago
what about a fundraising (even just 2-3 $ per person) to thank BloodDolly for her great work? I don't know how to organise it (to avoid improper uses by somebody else), but I think it would be a good idea to share our appreciation to BloodDolly... giving a beer!
jonsmith1940 - 7 years ago
The "universal" key doesn't work for the .exx extension. Any suggestions? Thanks.
vilhavekktesla - 7 years ago
Yes jonsmith1940. Read the info above about the .ecc version and proceed the same way.
You need to find the initial keys that can be factored. Also ask for help in the forum if you need any. Post one in the forum is always a good starting point.
Regards
Tonpri - 7 years ago
Good morning everyone! can anybody help me? I'm in the same situation ... but my files were encrypted como.R5A ... and so far have not seen anyone with this same extent ! hug to all and wait for urgent help !
maxxxit - 7 years ago
Im in a very bad situation.... all my drives were infected... also the pen drive.... all files are crypted whit .crypt extension - RSA4096 system. Can i hope to decrypt my files? Please help me... every way. How can i contact the hackers to pay? The servers (the tor url) they indicated on the request of money don't run and the pc has to be disconnected from internet in order to avoid other workers infection.
Thanks so much.
bradyswan - 7 years ago
Hi Guys! My company's computers got the TeslaCrypt last year. Every files have got a .vvv extension but this new solution don't solve our problem. The TeslaDecoder is not working for me. What can I do? Is this my fault?
Thank you!
Lawrence Abrams - 7 years ago
For VVV variants, you can download TeslaDecoder from here and read the instructions inside it:
http://download.bleepingcomputer.com/BloodDolly/TeslaDecoder.zip
The instructions explain how to get the decryption key from inside an encrypted file. If you need some help with this process, you can ask for help here:
https://www.bleepingcomputer.com/forums/t/601379/teslacrypt-vvv-ccc-etc-files-decryption-support-requests/
XVWiLLiaMVX - 7 years ago
I have a message to ESET and BloodDolly, many thanks to you, thank you for taking the trouble to help us, we thank very sweetly, for doing it so neatly, BEST DAY IN MY LIFE :)
JANQUI - 7 years ago
the extention of my files are .CRYPT
and I could not save them, could help me , thanks
https://drive.google.com/file/d/0B25Xn0vezHV8Mzd5Z1VUUnNueE0/view?usp=sharing
https://drive.google.com/file/d/0B25Xn0vezHV8Mmp1NmZoQmdIaE0/view?usp=sharing
https://drive.google.com/file/d/0B25Xn0vezHV8Z0tkZkZRYU92REE/view?usp=sharing
DRC_VietNam - 7 years ago
bro i decrypt it any question sent to my mail punpyxury@gmail.com
here files decrypts:
https://drive.google.com/file/d/0B-tNtO2H-yL0ekljaERGRnlXRjQ/view?usp=sharing
https://drive.google.com/file/d/0B-tNtO2H-yL0SEZiZmgyMGtBc3M/view?usp=sharing
https://drive.google.com/file/d/0B-tNtO2H-yL0b01ZbXJHcU9tak0/view?usp=sharing
maxxxit - 7 years ago
hi. News about decripting file with. .crypt extension? I need help!!!! Thanks.
bqaccomatto - 7 years ago
It doesn't work with my .vvv encrypted files.....
maxxxit - 7 years ago
does TeslaDecoder work whit .crypt encrypted files?
Anakucing31 - 7 years ago
Why all my files is skipped and into a teslabackup files...? How to get back my files? Plz... Help
ivosavo - 7 years ago
Not sure if it'is the same situation, but I found out (while trying to recover files on external hard drive) that it skipped "read-only" files. Select them all, remove read-only attribute (left click->properties), apply to all, wait until it's done and re-apply Tesladecoder. In my case, it was due to that.
Anakucing31 - 7 years ago
Thank you
Anakucing31 - 7 years ago
No is't not work. I've done it but it still does not work. How to get back my files... Wich are already skipped?
Anakucing31 - 7 years ago
How to get back my files... Wich are already skipped? My file is overwrite by teslabackup. Plz, help... Sorry bad language
Jonathan66 - 7 years ago
Thanks so much, is fantastic. I recovered the life files of two customers. They are crying for joy.
firas-b - 7 years ago
hello,
does it work in files .abc and is there any another solution for this case tank you
galerius - 7 years ago
It happened to me too...only, my files show an extension "crypz", and the tool didn't restore anything.
Could someone give me an advice, please ?
I'm really troubled :(
willy1217 - 7 years ago
Disaster to me as well. Most of my files were encrypted with an extension .DA507. Tried many method to recover, but in vain.
Could someone have some advice for me. Many thanks.
Look forward to hearing the good news.
Marylain - 7 years ago
Hello.
I need your assistance: I think I have TeslaCrypt 4.0 on my PC (the extension of my files is set as original). I tried to launch this tool and here what I get:
TeslaDecoder - 1.0.1
Custom priviledges: 1
Admininsrator's rights: 1
Debug mode: 0
Key version: TeslaCrypt 4.0 (as original)
Decryption started.
-------------------
Decryption finished. (0 files decrypted, 0 files skipped, 0 warnings)
Basically it doesn't decrypt anything.
Suggestions?
ItzGiraffe - 7 years ago
Same issue as you. I've followed the directions perfectly, and I'm not able to decrypt any of my files.
TeslaCrypt didn't change my file extension so I selected the "original" key in the decoder, when I try browse a folder or file to decode I'm unable to find anything, only .txt files. I'm unable to change to search for other types of documents. When I let the decoder scan through the entire computer it still fails to decrypt anything since it is just looking for .txt files and not .pdf, .docx, .pdf, etc etc...
Please help, I've been trying to decrypt this for the whole day, and haven't been able to resolve this whatsoever.
Lawrence Abrams - 7 years ago
Are you 100% sure you had teslacrypt? What was the name of your ransom note file? You can upload it to sendspace so we can take a look.
Marylain - 7 years ago
You are right. I have CryptXXX latest version. :(
rayoder - 7 years ago
I'm able to decrypt my files which is great, but the files still open 5 other files at the same time with the ransom message. Is there a way to keep that from happening? Doing a simple save as doesn't seem to help...
cjayanth - 7 years ago
still no hope for the .vvv file extension?
fenix71 - 7 years ago
hi ¡¡¡
my files doesn´t show an extension, but received the this
OT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA4096
More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA4096 Key , both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
Cacciavite_Ste - 7 years ago
Thank you!!!!
Just finished giving my mother in law back thousands of pictures...
I'm her hero, and you are mine!
Stefano
arhaan19 - 7 years ago
thank you soooo muchhhh.....you are awesome....hats off ....
dreamaholic1356 - 7 years ago
I just encrypt on 9/8/2016. and alll my artwork are encrypted..... I still can't decrypt, all files are in same files but all changed into README file name....anyone can help??? crying,thanks in advance
mcerdem - 7 years ago
@dreamaholic1356 what is extensions of your encrypted files ?
dreamaholic1356 - 7 years ago
anyone can help??
Jhonny547 - 7 years ago
Anyone else please help me to recover all my files extension turn to ".zepto", how to decrypt all of this
maxxxit - 7 years ago
Anyone can help me? my file werw encripted and turn to .crypt exstension. Can i decript them? Please help me... I need the file so much!!!!
DRC_VietNam - 7 years ago
yes
ErnstAlbinson - 7 years ago
Hi,
Huge thanks for this. All my old files and pics are back!!!
Super thanks.
vigneshruban - 7 years ago
hi,
friend i need help my computer affected by virus,
img.jpg.azzjcvk
file.doc.azzjcvk
all pdf,excel,words,jpg all file change into .azzjcvk
i want decrypt to orginal file please me friends
Van_Helden - 7 years ago
Hello everyone,
Anything new to decrypt files in "crypt"? I've tried more than once with Kaspersky and so far nothing. Someone can help me? greetings
MarkPogi24 - 7 years ago
this not work on me, .zzzzz files how can i recover it. No previous Version on my files. Thanks :(
muuel09 - 7 years ago
hello,
please recover my file .OSIRIS file
sakib - 7 years ago
Cerber Ransomware!!!!!
please I need help, my file extension now shows .ada8
is there anyway i could decrypt my file?
sakimpheng - 7 years ago
Hello all, I got virus that hide all my files. Virus name are: "!HELP_SOS.hta" "_HELP_HELP_HELP_Y4P5_.hta", "_HELP_HELP_HELP_ZK0G_.hta" and many other ".a4cb" files. Please everybody help me.
Ady1988 - 6 years ago
Hi friends, Help me,
before 3 month my computer affected by Ransomware virus and my all images and video are affected. i already formatted my computer and take back up off these images. And i go through TeslaDecoder process. but my not use so please help me sir
mcerdem - 6 years ago
@Ady1988, please share (you can upload to www.sendspace.com) some encrypted files in order to we can check.
sauryadav - 6 years ago
i have no clue what virus hit my laptop but it was a ransomware and my file extensions have become totally different from what all i can see in the help section all over the internet.
I have very important data on my system please help me if someone can.
for example a file which earlier had some known extension now looks like "AFA4C3DD7CB15261FC0FDE821C01945B.0475E"
every file has different extension, all with the combination of 5 characters with numbers and alphabets.
No tool is working on it. neither the one given above.
Thank you in advance
tomo215 - 5 years ago
Hi everyone,
Desperate for help with my encrypted .ccc files which are all my personal photos and documents, I have kept these for a long time hoping a decryption will become available, I thought I was in luck with this tool, I've followed the instructions but unsuccessful as it 'skips' the infected files, any help or advised would be greatly appreciated.
Thanks
mcerdem - 5 years ago
@tomo215, please upload an encrypted file and share download link in here
tomo215 - 5 years ago
@mcerdem Thanks for your reply,
Where do I upload the encrypted file to?
mcerdem - 5 years ago
You can use www.sendspace.com or www.wetransfer.com
tomo215 - 5 years ago
Https://www.sendspace.com/file/pq5tzs
Hope this is what you need
mcerdem - 5 years ago
@tomo215, please use below PrivateFileKey, if any file skipped without decryption, let me know. however i have uploaded your decrypted file to below link.
93B1277FF26F86D5FA78E04F67140145578CEA679369C0303A230FA565F2EC1B
Decrypted File:
https://www.sendspace.com/file/gpj701
tomo215 - 5 years ago
@mcerdem thank you so much, now got all my photos back can’t express enough gratitude
badowsdl - 5 years ago
mcerdem, I am in the same 'boat' as tomo215 with a friends computer having many of his files encrypted with .ecc extensions. I was able to copy the "RECOVERY_KEY.TXT" file. The existing key only 'skips the encrypted files so I believe you can help by manipulating the RECOVERY_KEY.TXT file. True?
badowsdl - 5 years ago
I failed to include the links to the files.
https://www.sendspace.com/file/2m1fhj
https://www.sendspace.com/file/atksuc
Thanks again
badowsdl - 5 years ago
I am having a problem attempting to load an encrypted file into the Tesla viewer and I am hoping I can get some help from this group. I have copied a file from the affected computer to my 'working' computer, file name is C-124_ROLLOUT_PORT_SIDE_PSH_OUT-md.jpg.ecc
Using Tesla viewer and clicking the Browse button, the .ecc file does not appear in the selection box.
Browsing for the Tesla's recover file I do find the RECOVERY_KEY.TXT file and can enter it into Tesla viewer.
Everything I read says the .ecc is a result of Tesla encryption so the image file should be valid, correct?
mcerdem - 5 years ago
@badowsdl, your PrivateKeyBC is 4BC441D4B6DE0388A02D439538CCC237EDFC3D92B77B0261C2FD64E0408CE4F7
aztxt - 5 years ago
hello there, my .aaa encryoted files are not getting decrypted using the keys listed in the article or the comments, is there a list of other keys that i could try ? Many thanks and fingers crossed.
Kemaloff - 5 years ago
Hello all,
2016 I was infected with Teslacrypt. My files are with extension .ecc.
Unfortunately i do not have key.dat, storage.bin, RECOVERY_FILE.TXT
I understood for the master key, but no success to decrypt files.
Do I have any option?
vishnu7703 - 4 years ago
my whole files of my PC has been infected with ".BTC " . is there any decrypt tool available ? if yes then please let me know ASAP
Thanks a lot
unknownuser2060 - 4 years ago
for BTC there are only paid services.
vishnu7703 - 4 years ago
how much ?
vishnu7703 - 4 years ago
how much should i pay for BTC infected file for revocer ?
mc6956708 - 4 years ago
I just wanted to give my thanks for everyone that helped with decrypting TeslaCrypt. We gave up trying and put the PC away for a few years. This week we urgently needed some files off it and were thrilled to see there was now a solution. We successful decrypted all the files. Thank You so much!
Lawrence Abrams - 4 years ago
That's the news we like to hear!
gyan1306 - 4 years ago
@mcerdem, somebody please help me!
I've been trying to decrypt my personal files. I've shared the link below.
https://www.sendspace.com/file/pzq53k
jtaats - 4 years ago
Hello Lawrence, and the Bleeping Computer Community, I was infected with the .RAPID ransonware two years ago. I archived all my encrypted files onto an external hard drive and have been patiently waiting for a decryptor tool to surface on Bleeping Computer (or anywhere on the web) with the hopes that one day I may decrypt my files. Any information regarding the .RAPID decryption will be greatly appreciated. Thanks in advance, JT
Dr-Scott - 4 years ago
I want to thank the BLEEP out of Lawrence, BloodDolly and everyone here! I was hit with Teslacrypt 4.0 (.mp3 ransomware) a couple months before they "shut down" and released their master key. Today I finally decided to give the TeslaDecoder software and RansomNoteCleaner a try. Both worked absolutely perfect and faster than I anticipated!! I ran them on a WD 2TB external hard drive that was 3/4 full. It decrypted 34,503 files, skipped 10,530 healthy files and got 0 warnings! I then ran the RansomNoteCleaner and it found 27,763 ransom notes and successfully deleted them all! I'm so happy and it was so simple!! Really, thanks to this website and these two programs, I am happy that I shelfed 1.5TB of data for a few years because now I have it all back!!! THANKS again and this software works even if you're not a computer genius!
swiftaki - 4 years ago
Hello all
thanks for this thread!
I need some help with my encrypted .ccc and files which are all jpegs, photos etc, I have I've had this harddrive sitting here since 2015 hoping a decryption tool will become available
so I've followed the instructions here but it is unsuccessful.
it is skipping the infected files
any help would be amazing !!
cheers
mcerdem8282 - 4 years ago
@swiftaki, please upload 1-2 encrypted files and share here download link.
swiftaki - 4 years ago
Wow. thanks for the quick response!
I hope something works, thankyou so much!
files are here
https://mega.nz/#F!LtM3QIwL
pass:
lQzHy6ic629qxF870Uw4yw
cheers
mcerdem8282 - 4 years ago
your PrivateKeyBC: E34DF21D0C080E2043933E657952799D64AB999DA5DAA5ED786EBBE5055591DC
swiftaki - 4 years ago
first folder decrypted
IT WORKS !!!
so far so good
thankyou so much for the help ! your a true legend !!!
also thanks blooddolly for the decrypter software !