Security and Cryptography
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me

The Shed is going Social! Join us on FaceBook and Twitter and chime in on the conversation.

Go Back   Dev Shed ForumsSystem AdministrationSecurity and Cryptography

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old October 3rd, 2012, 01:25 PM
Sarah_Anderson Sarah_Anderson is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Oct 2012
Posts: 1 Sarah_Anderson User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 2 h 1 m 19 sec
Reputation Power: 0
Can you guys help to defeat malware?

Hi everyone.

There is a lot of "ransomware" malware going around lately that encrypts a user's files and then asks for money to decrypt them. The worst one is called Malware Protection and it encrypts the files to a .rar file with a 50 digit password.
Code:
Details about Malware Protection malware:

http://www.bleepingcomputer.com/forums/topic446111.html
Obviously a 50 digit password protected AES encrypted .rar file is virtually impossible to decrypt, so I will not ask for help about this particular malware here.

But there is another "ransomware" malware variant going around which seems to encrypt the user's files in a different way which is amenable to decryption. This variant is called the FBI Moneypak trojan and it does not convert the user's files to password protected .rar files. Instead it encrypts the files and adds a .block file extension to the end of the file. I think the encryption it uses is the Tiny Encryption Algorithm (TEA), and some people have had success in decrypting the files using various switches in a tool called te94decrypt.exe which is available from the Dr.Web antivirus website. However, the problem is knowing which switch to use.

I have uploaded a .rar file to RapidShare which contains a Microsoft Word .docx file with the .block file extension that has been encrypted by the FBI Moneypak trojan, and also a copy of the te94decrypt.exe tool from the Dr.Web antivirus website.

I am looking for a general method of decrypting these files which I can use to help other infected users. So if any of the experts here can help with decrypting these .block files, I will be extremely grateful.

Thanks everyone.

Code:
Link to the .rar file I uploaded to RapidShare:

https://rapidshare.com/files/1604106884/pleasehelp.rar
Please note: The pleasehelp.rar file does not contain any infected files. One of the files is an encrypted Microsoft Word document, and the other file is a legitimate decryption tool from the Dr.Web antivirus website.

Reply With Quote
  #2  
Old October 26th, 2012, 06:26 AM
massivegood massivegood is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Oct 2012
Posts: 1 massivegood User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 3 m 13 sec
Reputation Power: 0
.block malware encrypted files - Any help

it's been over 20 days since the previous post - anybody have any clues on decrypting these .block word docks, pdfs, jpgs, avis, etc?

Reply With Quote
Reply

Viewing: Dev Shed ForumsSystem AdministrationSecurity and Cryptography > Can you guys help to defeat malware?

Developer Shed Advertisers and Affiliates



Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 


Powered by: vBulletin Version 3.0.5
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.

© 2003-2013 by Developer Shed. All rights reserved. DS Cluster - Follow our Sitemap