Member Avatar for dbtoo

Help held to $700.00 ransom for file recovery.

  • 2 Contributors
  • 1 Reply
  • 282 Views
  • 2 Hours Discussion Span
  • Latest Post Latest Post by rubberman

Dani AI

Generated

This thread’s symptoms (files renamed with a trailing .vvv and ransom notes in each folder) match a TeslaCrypt-era infection rather than a generic PNG/graphics issue. Historical analysis and community write‑ups show .vvv was used by TeslaCrypt and that a universal master key / public decryptors were published after the group shut down in 2016. (Microsoft Q&A, BleepingComputer writeup on the master key and TeslaDecoder). (learn.microsoft.com)

Before doing anything that modifies disks: isolate the PC (unplug network/Wi‑Fi), preserve the ransom note files and a handful of encrypted samples, and do not empty trash or run routine "repair" tools. Upload one encrypted file plus the ransom note to an identification service such as ID Ransomware and check the No More Ransom repository for an available decryptor — that will tell you whether a known free solution exists. Also report the event to law enforcement/IC3; agencies caution against paying because payment doesn’t guarantee recovery and fuels further crime. (ID Ransomware, NoMoreRansom, FBI/IC3 guidance). (id-ransomware.malwarehunterteam.com)

If you need forensic evidence or want to attempt recovery yourself, make a forensically sound copy first: use a hardware write‑blocker or a trusted imaging tool, produce verified hashes of originals and images, capture volatile memory if possible, and keep a chain‑of‑custody log. Work only on copies when trying removal or decryption so originals remain intact for later analysis or legal/insurance needs. NIST and digital‑forensics practitioners outline these procedures and why they matter. (NIST SP 800‑86 guidance, FTK/forensics references). (csrc.nist.gov)

If identification confirms TeslaCrypt, community tools (TeslaDecoder / vendor decryptors published in 2016) successfully recovered many .vvv cases; run any decryptor against images or copies only, and follow vendor instructions. If no public decryptor exists for your variant, recovery options are limited to clean backups or professional DFIR help — budget your next step accordingly (restore from verified backups, or engage a reputable forensic/incident‑response firm). (TeslaCrypt decryptor reporting). (bleepingcomputer.com)

Notes: this expands on ’s imaging recommendation by stressing forensics best practices (write‑blockers, hashing, memory capture, chain of custody). Preserve evidence first; identification and a correct decryptor (when available) are what allow recovery without paying attackers.

Member Avatar for rubberman

It depends upon how current the malware is and what type it is. Some have well-known keys, or discoverable keys. You need to do some web searching to see what's what. In the future, you will want to a disc image backup to an external drive that is only attached to the system when you do the backup. Also, keep backups of your new or changed files between the image backups. That way, you can recover your system and most of your data if you get hit by this cruft again. What I do, even for Windows systems, is to boot from a Linux live DVD, mount the external drive, that you have installed a linux file system on, and then use the Linux 'dd' command to copy the ENTIRE drive (including partition table and all partitions and file systems) to the backup disc. That can be easily compressed to save storage space. Here is an example of how to do it:

mkdir /mnt/backup
mount /dev/sdxN /mnt/backup
# The x is the drive number, and N is the partition, such as /dev/sdb1
dd if=/dev/sda bs=1M | gzip -c >/mnt/backup/system.date.gz
# Where date is the current date and /dev/sda is the system drive.

You would do this as the root user.
FWIW, this has saved my bacon and that of my clients numerous times in the past. It works with Linux drives as well as Windows ones.

To restore your drive image you would do this after booting the live DVD, becoming root, and mounting the linux partition again as above:

gunzip -c /mnt/backup/system.date.gz | dd of=/dev/sda bs=1M
Edited by rubberman
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.