VVV File Extension

A new version of TeslaCrypt ransomware has been released recently. It does not differ much from the previously published versions; however, there has still been one main difference noticed between new and old releases. As TeslaCrypt belongs to the category of ransomware, its entrance means that there is a security loop on the system. Users have to fully get rid of this program as soon as it is possible because it is known to be malicious software.

The first thing that specialists have observed after TeslaCrypt has emerged is that this threat is going to change file extensions of all the main files existing on PC to .VVV extensions. Therefore, it is often called the “.VVV extension ransomware.” The filename extension is defined as a suffix that is added to the name of each computer file. The extension itself is separated from the file name by a dot. Users whose computers get infected with TeslaCrypt ransomware usually notice the .VVV filename extension added, for example, invoice0044.doc.vvv, video.mp4.vvv, and picture.jpg.vvv. As can be seen, the threat will not delete the original extensions. Users tend to notice the changes very quickly, and they understand that the .VVV extension prevents them from accessing their main files. It has to be mentioned that this threat is capable of encrypting hundreds of files in different formats. Unfortunately, users cannot do much about that.

There are several other versions of TeslaCrypt ransomware. Each version uses different extensions. Therefore, there is no doubt that the system is infected with this threat if the .VVV, .ECC or .CCC file extensions are attached to the major files. The ability to change extensions according to the version of the ransomware is the distinctive feature of this threat. The threat itself not only encrypts the major files and blocks access to them, but can also add new files after it enters the system. Researchers who tested TeslaCrypt ransomware have noticed that it adds decrypt.exe, decrypt.html, and decrypt.txt files in almost every folder. In addition, adds a ransom note how_recover+abc.html and how_recover+abc.txt. TeslaCrypt ransomware wants to be sure that you know what you have to do next in order to unlock files and gain access to them again.

It has to be noted that the biggest group of people whose PCs get infected with TeslaCrypt ransomware are gamers because this infection is targeted at files that belong to different games primarily. If you have been playing a particular game for some time, you will have to start all over again if TeslaCrypt ransomware infects the system because the encrypting process will start immediately and it cannot be stopped. Even if you manage to decrypt your files, they will still not be completely the same. Actually, it does not really matter which version of TeslaCrypt ransomware enters because they all act in a very similar manner.

TeslaCrypt ransomware itself is a serious threat even though it does not make many modifications in the system registry. Its primary aim is to extort money from users and it has already been doing that for some time. The threat is not fully original too; according to the specialists, it is a copy of a well-known ransomware infection called CryptoLocker. Therefore, it is not strange at all that this threat calls itself CryptoLocker-v3. Moreover, many specialists have noticed that TeslaCrypt not only attaches the .VVV file extension to files, but also kills cmd.exe, msconfig, regedit, procexp, and taskmg utilities temporary. It is a user’s fault that TeslaCrypt manage to enter in most cases. Users tend to open infectious email attachments and spam emails. They also tend to click on bad links which are placed on suspicious websites. Finally, they do not usually have any security software installed.

How to decrypt files?

Let’s talk about the most important thing – the decryption of the files with the .VVV file extension attached. It has been observed that all the files can be renamed, i.e. the .VVV file extension can be deleted manually; however, it does not mean that your files will be decrypted. Actually, it is rather risky to do that if you are going to pay money for the decryption of your files because the decryption might not be successful. As the message informs, you will have to pay a particular sum, usually $500. Unfortunately, there is no other way to decrypt files for now; however, users who have a copy of their files on a USB flash drive or other backup are safe because all the files can be restored easily.

Is it necessary to remove TeslaCrypt ransomware?

TeslaCrypt ransomware only encrypts files and then immediately removes itself from the system, so many users do not even understand why their files have the .VVV file extension. As this threat disappears after it does its job, users do not need to delete it. Of course, it is still advisable to scan the system with an automatic scanner in order to erase the infections which might be responsible for the presence of TeslaCrypt or which have entered the system together with it.

Scan your system

1. Launch any of your browsers.
2. Enter http://www.pcthreat.com/download-sph in the URL bar.
3. Click OK.
4. Download the security tool and then install it on the system.
5. Perform the full system scan.