Avatar of MichaelBalack
MichaelBalackFlag for Singapore asked on

All files become MP3 format (Ransomware teslacryrt 3.0)

Hi All,

I'm getting desktop and server having issue on all the files in PC and server become MP3 Format.

Windows server 2008 R2 and Windows XP service pack 3.

Please help or advise.

Thanks
Windows Server 2008

Avatar of undefined
Last Comment
btan

8/22/2022 - Mon
Qlemo

Stop all activity immediately, and disconnect from network! Restore the PC and the touched server files from a backup. There is no means to get the encrypted data back directly - even paying the ransom is no guarantee.
btan

Indeed quickly isolate your machine unconnect the network as ransomware also encrypt mapped drive files and can go into extend of doing it even if unmapped to network drive. Isolate those usb stick or ext storage media used with this machine.

Do not pay the ransomware and avoid getting the decrypting tool as it may also be laden with malware unless you get from trusted website like those of AV minimally. Scan it before usage and no point bruteforcing to get back files and the inly means is retrieve from your backup...hopefully it is still exists..

Do see the guidance from below which covers most of the mentioned already.
http://www.bleepingcomputer.com/virus-removal/teslacrypt-alphacrypt-ransomware-information

Suggest that you also scan the machine using malwarebytes anti malware. Change your online and internal account password esp including those shared account and those using the same password.

Check out cryptoprevent and malwarebytes anti ransomware tool to prevent recurrences. Also I suggest removal of all admin rights from user account and enforce application whitelisting using those tools otherwise use applocker.

Here us another compilation of removal toolkit
https://bitbucket.org/jadacyrus/ransomwareremovalkit/src
ASKER
MichaelBalack

Hi Btan,

Thanks for your suggestions. I am trying your method, and will get back to you about the outcome.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
ASKER
MichaelBalack

Hi Btan,

Those affected folder/file can't be decrypted. Even using malwarebyte, spybot, and other utilities do not help.
ASKER CERTIFIED SOLUTION
btan

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
ASKER
MichaelBalack

Thanks for Expert - Btan, for his valuable time and knowledge. The damage was done, we will pay more attentions to the path that he mentioned for any suspicious trails of "happening".
btan

Thanks glad to have helped
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.