SensorsTechForum - How to Technology and PC Security Forum

PC Security and Protection => Malware Removal Questions and Guides => Topic started by: mcinn on October 21, 2015, 02:44:21 pm

Title: My files are encrypted with the .ccc extension. Help!
Post by: mcinn on October 21, 2015, 02:44:21 pm
If your personal files are unreachable and they have the .ccc extension added to them, you may have been infected by a variant of the TeslaCrypt ransomware.

Files affected by this particular malicious threat typically have the .exx, .xyz, .zzz, .aaa, .abcor appended to the end of the file. Users may think they've been targeted by Cryptowall, because some TeslaCrypt versions may pretend to be Cryptowall 3.0.

As we have already pointed out in the comments section of the Restore Files Encrypted via RSA Encryption http://sensorstechforum.com/restore-files-encrypted-via-rsa-encryption-remove-cryptowall-and-other-ransomware-manually/, the Tesla decryptor tool can be tried. You can download it from here: http://talosintel.com/teslacrypt_tool/


How to use it: http://blogs.cisco.com/security/talos/teslacrypt

There are several cases of users reporting their files encrypted and having a .ccc extension. If you are one of them, don’t hesitate to comment here.

For more information about the TeslaCrypt ransomware, you can have a look at the following articles:

TeslaCrypt Removal http://sensorstechforum.com/remove-teslacrypt-and-restore-the-encrypted-files/

AlphaCrypt Removal http://sensorstechforum.com/remove-alpha-crypt-from-your-computer/
Title: Re: My files are encrypted with the .ccc extension. Help!
Post by: James on October 28, 2015, 08:06:06 am
I am not a tech guru, but can the encrypting/decrypting program named Control3 help for unlocking some files??  ???
It is hosted on its official site at diskcleaners.com.
Title: Re: My files are encrypted with the .ccc extension. Help!
Post by: Execute on October 28, 2015, 01:00:31 pm
I am not a tech guru, but can the encrypting/decrypting program named Control3 help for unlocking some files??  ???
It is hosted on its official site at diskcleaners.com.

Well, that program uses its own algorithm, so it can decrypt files that itself encrypted. Mainly with the .scrp extension. That being said, I doubt that it will help in decrypting any files with the above-mentioned extensions, unfortunately.
Thanks for the idea, though! It's good to think of new ways to try and help with such a pressing issue as decryption!
Title: Re: My files are encrypted with the .ccc extension. Help!
Post by: mcerdem on January 19, 2016, 10:13:13 pm
If there is anyone infected by teslacrypt and have encrypted files (.vvv, .ecc, .ezz, .exx, .xyz, .zzz, .aaa, .abc, .ccc) , i can help, please send couple of encrypted files to my email address (mcerdem82@yahoo.com)
Title: Re: My files are encrypted with the .ccc extension. Help!
Post by: GabrielRoss on April 26, 2016, 03:23:16 pm
Dear mcinn, I am infected with virus that blocks my files with ccc extension. Am I infected with this teslacrypt or ccc file extension virus? I followed a .ccc file extension ransomware removal guide but it failed to recover my files.. Why?
Title: Re: My files are encrypted with the .ccc extension. Help!
Post by: mcinn on April 26, 2016, 04:45:21 pm
Dear mcinn, I am infected with virus that blocks my files with ccc extension. Am I infected with this teslacrypt or ccc file extension virus? I followed a .ccc file extension ransomware removal guide[/url] but it failed to recover my files.. Why?

Hi Gabriel,

Have you tried using such software: http://sensorstechforum.com/stellar-phoenix-windows-data-recovery-software-review/ to restore some of your files?
Title: Re: My files are encrypted with the .ccc extension. Help!
Post by: GabrielRoss on April 28, 2016, 03:57:55 pm
Hello again. No I haven't, going to try it right now. Thanks!
Title: Re: My files are encrypted with the .ccc extension. Help!
Post by: mcerdem on April 28, 2016, 05:58:19 pm
@GabrielRoss

i can help you, please upload one encryped file and txt file (ransomnote) and share them here.
Title: Re: My files are encrypted with the .ccc extension. Help!
Post by: Execute on May 27, 2016, 11:43:11 am
Hello again. No I haven't, going to try it right now. Thanks!

Now there is a solution!

This is the MASTER decryption key: 440241DD80FCC5664E86198DB716E08CE627D8D40C7EA360EA855C7EA360AE885C727A49EE

You can decrypt files encrypted by any variant/version of TeslaCrypt (.ccc, .vvv, .ecc, .ezz, .exx, .xyz, .zzz, .aaa, .abc, .xxx, .ttt, .micro, .mp3 or with no extension).

In the article "The End of TeslaCrypt" (http://sensorstechforum.com/teslacrypt-master-decryption-key-available/) you can find more information about how to decrypt your files and about what tools you can use to do it!

If you still need help or have any questions, feel free to ask them!