Warning: DO NOT PAY RANSOM TO CENTURION_LEGION@AOL.COM

[bcometa]

Ransomware Warning: DO NOT PAY RANSOM TO CENTURION_LEGION@AOL.COM! You will pay, they will NOT give you key. Lost $1000 to these crooks. First time now that we paid ransom and never got the key to decrypt.

https://www.reddit.com/r/Ransomware/com ... ionaolcom/

[lcoughey]

If they weren't crooks, they wouldn't have encrypted the drive in the first place. That said, thanks for the warning.

[bcometa]

Finally... after several more emails, they sent us the key this morning. It worked. All data decrypted.

[data-medics]

Yes, you can add bitcoinrush@aol.com to that list of people not to pay too. The get paid ~$1,000 (2.3 BTC) and provide one key/decoder program. However it only decrypts 1/2 of data and some critical things are missed. After emailing again, they say to run the "scan for keys" feature on their junk program, and surprise!!!! There's three more keys. Email them back and they say it's 1BTC per extra key. In the end client paid them about $3K in BTC and only because it was a huge amount of data for a law firm which they discovered too late the Barracuda backup appliance had stopped running backups six months ago. And even after that there was a certain amount of data which never decrypted. They just finally had enough they could work with it.

Talk about the dirtbags of the dirtbags.

[bcometa]

The one I had actually had 5 different keys! Not sure if it was encrypted a few times or if these viruses just use multiple keys now.