Remove TeslaCrypt 4.0 and Restore the Encrypted Files - How to, Technology and PC Security Forum |

Remove TeslaCrypt 4.0 and Restore the Encrypted Files

shutterstock_278999798The fourth “installment” of TeslaCrypt is here to terrorize you and make your day a lot worse. The crypto-malware now uses significantly stronger encryption. Not only this, but TeslaCrypt 4 also has fixed bugs and is now able to encrypt files larger than 4 GB of memory without damaging them, unlike the 3rd version. The only two viable ways out for the user are if he pays the ransom or has a backup, preferably cloud backup. And it is strongly advisable not to pay the ransom money since it is no guarantee you will get the files back. Otherwise, experts strongly advise users use other alternative tools in case they are out of options.

NameTeslaCrypt 4.0
Short DescriptionThis malware encrypts the files on the infiltrated device without any extensions, rendering them corrupt. It asks the user to pay a relatively big amount of ransom money in BitCoin to decrypt the data.
SymptomsThe user may witness several files beginning with the name “RECOVERY” on his desktop which are the ransom notes.
Distribution MethodVia Angler Exploit Kit embedded in malicious web links that may be distributed via email or other spam.
Detection ToolDownload Malware Removal Tool, to See If Your System Has Been Affected by TeslaCrypt 4.0
User Experience Join our forum to discuss TeslaCrypt 4.0.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

TeslaCrypt 4.0 – Distribution

TeslaCrypt is believed to use Angler type of exploit kit attacks to conduct its infections successfully. They are usually caused via malicious web links downloaded from several hosts. These are the domains that are believed to be the C&C (Command and Control centers of TeslaCrypt 4.0)

  • http://esbook(.)com/phsys.php
  • http://ebookstoreforyou(.)com/phsys.php
  • http://shampooherbal(.)com/phsys.php
  • http://commonsenseprotection(.)com/phsys.php
  • http://exaltation(.)info/plugins/phsys.php
  • http://hmgame(.)net/phsys.php

Web links associated with these very domain names are strongly believed to be widespread either via online referral spam on different websites or via spam emails. Once a user has clicked on the link, the exploit is activated without any hint of this occurrence. What is worse is that Virus Total scans indicate that the exploit kit based drive-by downloads result in very effective infiltration in systems, because they are well-obfuscated from antivirus software.

TeslaCrypt 4.0 In Detail

Once executed on your computer, TeslaCrypt 4.0 creates several different objects:

Files in %UserProfile%\
Desktop\RECOVER{randomly generated numbers and letters}.html
Desktop\RECOVER{randomly generated numbers and letters}.png
Desktop\RECOVER{randomly generated numbers and letters}.txt
Documents\{randomly generated numbers and letters}.exe
Registry value, created in HKCU\Software\Microsoft\Windows\CurrentVersion\Run\:
_{randomly generated name} C:\Windows\SYSTEM32\CMD.EXE /C START %UserProfile%\Documents\{randomly generated name}.exe

After creating the abovementioned files, the ransomware then may execute a reset of the computer of the user and activate the randomly named exe to scan for and may encrypt files with the following file extensions, similar to the 3.0 version of TeslaCrypt:

→ .ltx .bsa .apk .re4 .sav .lbf .slm .bik .epk .rgss3a .pak .big .unity3d .wotreplay .xxx .desc .py .m3u .flv .js .css .rb .png .jpeg .txt .p7c .p7b .p12 .pfx .pem .crt .cer .der .x3f sum .ibank .t13 .t12 .qdf .gdb .tax .pkpass .bc6 .bc7 .bkp .vtf .dazip .fpk .mlx .kf .iwd .vpk .tor .psk .rim .w3x .fsh .ntl .arch00 .lvl .snx .cfr .ff .vpp_pc .lrf .m2 .mcmeta .vfs0 .mpqge .kdb .db0 .DayZProfile .rofl .hkx .bar .upk .das .iwi .litemod .asset .forge .srw .pef .ptx .r3d .rw2 .rwl .raw .raf .orf .nrw .mrwref .mef .erf .kdc .dcr .cr2 .crw .bay .sr2 .srf .arw .3fr .dng .jpe .jpg .cdr .indd .ai .eps .pdf .pdd .psd .dbfv .mdf .wb2 .rtf .wpd .dxg .xf .dwg .pst .accdb .mdb .pptm .pptx .ppt .xlk .xlsb .xlsm .xlsx .xls .wps .docm .docx .doc .odb .odc .odm .odp .ods .odt . qic .bkf .sidn .sidd .mddata .itl .itdb .icxs .hvpl .hplg .hkdb .mdbackup .syncdb .gho .cas .svg .map .wmo .itm .sb .fos .mcgame .vdf .ztmp .sis .sid .ncf .menu .layout .dmp .blob .esm .001 7z .rar .m4a .wma .avi .wmv .csv .d3dbsp .sc2save .sie
Extensions source: Symantec

This particular version of TeslaCrypt then encrypts the files by possibly using an RSA-4096 encryption algorithm – one of the strongest in the world. It would take a lot of years to discover a password. The only hope for the user is to wait for a bug in the ransomware that will help discover the decryption keys.

After encrypting the files, the ransomware has been reported by one of our forum users to display the following ransom message:

What’s the matter with your files?
Your data was secured using a strong encryption with RSA4096.
Use the link down below to find additional information on the encryption keys using RSA4096:
What exactly that means?
It means that on a structural level your files have been transformed. You won’t be able to use, read, see or work with them anymore.
In other words they are useless, however, there is a possibility to restore them with our help
What exactly happened to your files?
*** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private.
*** All your data and files were encrypted by the means of the public key, which you received over the web.
*** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers.
What should you do next?
There are several options for you to consider:
1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or
2. You can start getting BitCoins right now and get access to your data quite fast.
In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data.
In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below:
http:// h5nuwefkuh134ljngkasdbasfg(.)corolbugan(.)com/17E035F219B34F9
http:// p54dhkus4tlkfashdb6vjetgsdfg(.)greetingshere(.)at/17E035F219B34F9
http:// f4dsbjhb45wfiuqeib4fkqeg(.)meccaledgy(.)at/17E035F219B34F9
If you can’t access your personal homepage or the addresses are not working, complete the following steps:
1 Download TOR Browser – http:// www(.)torproject(.)org/projects/torbrowser(.)html(.)en
2 Install TOR Browser
3 Open TOR Browser
4 Insert the following link in the address bar: k7tlx3ghr3m4n2tu(.)onion/17E035F219B34F9
5 Follow the steps on your screen
Your personal homepages:
http:// h5nuwefkuh134ljngkasdbasfg(.)corolbugan(.)com/17E031234F9
http:// p54dhkus4tlkfashdb6vjetgsdfg(.)greetingshere(.)at/17E092134F9
http:// f4dsbjhb45wfiuqeib4fkqeg(.)meccaledgy(.)at/17E09213F9
Your personal page Tor-Browser k7tlx3ghr3m4n2tu(.)onion/17E09B34F9
Your personal identification ID: 1812EN2DF9″

Remove TeslaCrypt 4.0 and Restore the Data

For the removal of TeslaCrypt, it is strongly advisable to follow the methodologically arranged steps in the removal instructions below. They include scanning your computer for TeslaCrypt 4 and the exploit kit which is used to infect your computer. After removal, we strongly advise you to use cloud backup or external drive to protect your data in the future.

If you wish to restore your files, and you do not have backup or Volume Shadow Copies set up on your computer, we advise using the alternative methods illustrated in Step “4. Restore Files Encrypted by TeslaCrypt 4.0”. They are not 100% effective, and there is no guarantee that you will restore your files in good condition, but some of our forum users claim they managed to restore some of their data, and they claim it was intact. If you use data recovery software method, we advise you NOT to reinstall Windows or format your hard/solid drive because it may wipe every chance of file restoration by clearing the sectors of the drive.

1. Boot Your PC In Safe Mode to isolate and remove TeslaCrypt 4.0
2. Remove TeslaCrypt 4.0 with SpyHunter Anti-Malware Tool
3. Back up your data to secure it against infections and file encryption by TeslaCrypt 4.0 in the future
4. Restore files encrypted by TeslaCrypt 4.0
Optional: Using Alternative Anti-Malware Tools
NOTE! Substantial notification about the TeslaCrypt 4.0 threat: Manual removal of TeslaCrypt 4.0 requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share