Link to home
Start Free TrialLog in
Avatar of MichaelBalack
MichaelBalackFlag for Singapore

asked on

All files become MP3 format (Ransomware teslacryrt 3.0)

Hi All,

I'm getting desktop and server having issue on all the files in PC and server become MP3 Format.

Windows server 2008 R2 and Windows XP service pack 3.

Please help or advise.

Thanks
Avatar of Qlemo
Qlemo
Flag of Germany image

Stop all activity immediately, and disconnect from network! Restore the PC and the touched server files from a backup. There is no means to get the encrypted data back directly - even paying the ransom is no guarantee.
Avatar of btan
btan

Indeed quickly isolate your machine unconnect the network as ransomware also encrypt mapped drive files and can go into extend of doing it even if unmapped to network drive. Isolate those usb stick or ext storage media used with this machine.

Do not pay the ransomware and avoid getting the decrypting tool as it may also be laden with malware unless you get from trusted website like those of AV minimally. Scan it before usage and no point bruteforcing to get back files and the inly means is retrieve from your backup...hopefully it is still exists..

Do see the guidance from below which covers most of the mentioned already.
http://www.bleepingcomputer.com/virus-removal/teslacrypt-alphacrypt-ransomware-information

Suggest that you also scan the machine using malwarebytes anti malware. Change your online and internal account password esp including those shared account and those using the same password.

Check out cryptoprevent and malwarebytes anti ransomware tool to prevent recurrences. Also I suggest removal of all admin rights from user account and enforce application whitelisting using those tools otherwise use applocker.

Here us another compilation of removal toolkit
https://bitbucket.org/jadacyrus/ransomwareremovalkit/src
Avatar of MichaelBalack

ASKER

Hi Btan,

Thanks for your suggestions. I am trying your method, and will get back to you about the outcome.
Hi Btan,

Those affected folder/file can't be decrypted. Even using malwarebyte, spybot, and other utilities do not help.
ASKER CERTIFIED SOLUTION
Avatar of btan
btan

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thanks for Expert - Btan, for his valuable time and knowledge. The damage was done, we will pay more attentions to the path that he mentioned for any suspicious trails of "happening".
Thanks glad to have helped