TeslaCrypt is a ransomware Trojan that once installed encrypts all the files on the infected machine and demands ransom in order to decrypt them. For the encryption process, TeslaCrypt uses the AES algorithm and creates a ‘HELP_ TO_DECRYPT_YOUR_FILES.txt.” file on the desktop of the compromised PC. The infection is typically spread via attachments to spam email messages or through corrupted websites.
TeslaCrypt – Infiltration Method
As a typical ransomware infection, TeslaCrypt is usually distributed through attachments to spam email messages. The threat can end up in your computer when you visit corrupted web pages or through drive-by downloads. Experts warn that malicious emails often claim to be sent from legitimate institutions, like banks, insurance companies, etc. Do not download attachments on emails you are not expecting and always keep your AV tools updated.
How Is TeslaCrypt Different Than Other Ransomware?
What makes TeslaCrypt different than other ransomware infections like CryptoWall 3.0 or CTB-Locker where the victims are asked to pay the fee in Bitcoins is the fact that TeslaCrypt also accepts payment in PayPal My Cash Cards which can be purchased in big store chains in the US. The required sum is $500 in Bitcoins or $1000 in PayPal My Cash Cards. Experts believe that the higher PayPal fee is due to the risk of illegal gains confiscation by PayPal.
How Does TeslaCrypt Affect Your PC?
Upon infiltration, TeslaCrypt ransomware scans the affected machine for files with the following extension: rar, .m4a, wb2, xf, .dwg, docm, .docx, rtf, .wpd, .dxg, .7z, .doc, .odb and others. TeslaCrypt also affects files related to popular computer games like Call of Duty, StarCraft, Dragon Age and many others. The threat encrypts the files and displays a ransom message on your desktop, demanding Bitcoin or PayPal payment in exchange for the private key needed for the decryption process. The victim is asked to pay the fee in three days. As a guarantee, the user gets to decrypt one file for free. This technique has been used by the creators of the infamous CryproWall 3.0 ransomware infection.
Here is what the TeslaCrypt ransom note looks like:
Experts recommend against paying the fee because you can never be sure that you will have your data unlock once you pay the ransom. The way to prepare for a situation like this one is to perform regular backups of your important files and update your anti-malware program on a regular basis.
Remove TeslaCrypt and Restore the Encrypted Files
Stage One: Remove TeslaCrypt
1. First and most important – download and install a legitimate and trustworthy anti-malware scanner, which will help you run a full system scan and eliminate all threats. 
Spy Hunter FREE scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the malware tool. Find Out More About SpyHunter Anti-Malware Tool
2. Run a second scan to make sure that there are no malicious software programs running on your PC. For that purpose, it’s recommended to download ESET Online Scanner.
Your PC should be clean now.
Stage Two: Restore the Encrypted Files
Option 1: Best case scenario – You have backed up your data on a regular basis, and now you can use the most recent backup to restore your files.
Option 2: Try to decrypt your files with the help of Kaspersky’s RectorDecryptor.exe and RakhniDecryptor.exe. They might help you in the process but keep in mind that they were not specially designed to encrypt information that was decrypted by this particular ransomware.
Option 3: Shadow Volume Copies
1. Install the Shadow Explorer, which is available with Windows Vista, Windows 7, Windows 8 and Windows XP Service Pack 2.
2. From Shadow Explorer’s drop down menu choose a drive and the latest date you would like to restore information from.
3. Right-click on a random encrypted file or folder then select “Export”. Select a location to restore the content of the selected file or folder.
Remove TeslaCrypt Automatically with Spy Hunter Malware – Removal Tool.
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter
