T800 ransomware (virus) - Free Instructions

T800 virus Removal Guide

What is T800 ransomware?

T800 ransomware is a file-encrypting malware that asks $250 for a decryption key

T800 ransomwareT800 ransomware is a malicious program designed to lock all personal files and then demand ransom for their return

T800 is a new ransomware strain that has been spotted in the wild in the second half of February 2022. Just as any other malware of this type, it enters a Windows machine after users are tricked into installing it – spam emails, phishing messages, fake links, repacked installers, software cracks, and similar are commonly used. Cybercriminals can sometimes use more advanced distribution techniques such as exploit kits, RDP attacks, or targeted phishing emails, although it is less rare when it comes to attacks against regular uses.

The main goal of T800 ransomware is to make users pay money in the form of a cryptocurrency known as Bitcoin. In order to achieve that, cybercriminals deploy malicious code on the vulnerable Windows machine, which automatically infects its various components. This allows the virus to begin the encryption process, which is performed with the help of a combination of AES and RSA ciphers. Combining two encryption methods is common, as it ensures the integrity of the process, making the recovery of files almost impossible.

As a result of this process, all non-system files are then appended with a .t800 extension, which also makes them lose their original icon. For example, a DOC file would no longer show the distinctive icon of MS Word or a similar associated program. No matter which application is used to open these files, it would not work.

It is important to note that the data is not corrupted (even though it might look that way initially) but rather locked behind a complex password. This password, known as a decryption key, is stored on remote servers controlled by hackers, and they are obviously not willing to give it away for free.

After the data locking process, the malware then finishes its malicious deed by dropping a ransom note on users' desktops and other places, which reveals that a payment of $250 is required in order to receive a decryption key from cybercriminals. We strongly recommend avoiding any contact with cybercrooks, as there is no guarantee that they will keep their promises.

The ransom note

It has been established by security researchers that the T800 virus steps from BigLock ransomware, otherwise known as Corona-lock. It was initially released at the begging of the pandemic back in May 2020 and since then amassed several versions that use extensions .t1000, .pandemic, and a few others. The strain itself is not very prevalent, although that does not matter much for the affected victims.

T800 ransomware virusT800 ransomware can be stopped by a powerful security tool before it encrypts data

A ransom note is the first means of communication between the attackers and victims, so crooks usually make it quite informative. There are cases when ransom notes are simply missing, which commonly happens due to bugs in the code or when malware is not fully developed. In this case, the note is fleshed out well and explains everything users need to know in order to allegedly retrieve their locked files:

########################################################
############### You became victim of the .T800 Ransomware-Virus ###############
########################################################
## Special ID:
########################################################
## The harddisks of your computer have been encrypted with an military grade
## encryption algorithm TermCryptS3v2+RSA2048.
## There is no way to restore your data without a special key.
########################################################
########################################################
## To decrypt the files, you need to pay 250 USD in bitcoins to the BTC wallet below,
## then after 1 confirmation of the bitcoin network, you can get the decryptor
## by writing to the following contact contacts!
## –
## BTC Wallet –
## –
## Exchangers for exchanging for cryptocurrency: >>> https://www.bestchange.net <<< ## – ## If you want to decrypt your files, you have to get RSA private key. ## After the successful payment and decrypting your files, we will give ## you FULL instructions HOW to IMPROVE your security system. ## – ## ## TELEGRAM us: >> @t1000rn << ## Jabber: >> t1000rn@404.city FULL ONLINE << ## – >>> Do not pay data recovery companies to get the key, they will email me! <<< ################## We ready to answer all your questions! ##################### ———————————————— ################# HOW to understand that we are NOT scammers? ################# ######### You can ask SUPPORT for the TEST-decryption for ONE file! ########### ########################### LIST OF ENCRYPTED FILES ########################### ————————————————

As it is common, cybercriminals even offer a free test decryption service, which would allow users to recover one file for free – this is done as alleged proof that the decryptor works. However, it is not recommended to contact the attackers due to the risk of losing money along with files, as some victims don't receive the promised decryption key even after they pay the full demanded sum.

Name T800 ransomware
File extension .t800 appended to each of the personal files on the system
Related files !!!HOW_TO_DECRYPT!!!.txt
Contact Cybercriminals provide several communication methods: Telegram (@t1000rn), Jabber (t1000rn@404.city) or specially crafted Tor page (kwk62hefhey3zh4ki332d7uluww5oilm4c6t5tnhb4g5hrf7a2szvlqd.onion/chat)
File Recovery The only secure way to restore files is by using data backups. If such is not available or were encrypted as well, options for recovery are very limited – we provide all possible solutions below
Ransom payment $250 to be transferred to Bitcoin wallet 38wDGRKde7UijxBrup9BNnEUopKexyRpZz
ransomware removal Disconnect the computer from the network and internet and then perform a full system scan with SpyHunter 5Combo Cleaner security software
System fix Malware can seriously tamper with Windows systems, causing errors, crashes, lag, and other stability issues after it is terminated. To remediate the OS and avoid its reinstallation, we recommend scanning it with the FortectIntego repair tool

Removal and remediation

1. Disconnect from the network

The Internet connection can be used for malware to communicate with remote servers, which could grant remote access to attacks in some cases.

Therefore, before you proceed with anything else, you should disconnect your PC from the network and the internet. This is easy to do by simply plugging the ethernet cable out of the machine or disconnecting the WiFi. If you have a network that you use, you can instead disconnect it the following way:

  • Type in Control Panel in Windows search and press Enter
  • Go to Network and InternetNetwork and internet
  • Click Network and Sharing CenterNetwork and internet 2
  • On the left, pick Change adapter settingsNetwork and internet 3
  • Right-click on your connection (for example, Ethernet), and select DisableNetwork and internet 4
  • Confirm with Yes.

2. Remove malware

Once the affected computer is disconnected from the network, it is safe to begin the T800 ransomware removal process. It is known that some of the ransomware-type viruses self-delete once they finish the encryption process, but it might not be the case with this version.

Even after destructing itself, malware can still leave some modules programmed to perform other malicious actions in the background, such as personal data theft or installation of additional payloads after the network connection is reimbursed. Likewise, ransomware is commonly spread along with other malware, thus there could be several infections present on the system.

The only way to find out whether or not this is true is by scanning the system with SpyHunter 5Combo Cleaner, Malwarebytes, or another reliable anti-malware solution. Security software can quickly and easily find all the malicious files and remove them promptly, preventing any damage that could potentially occur in the future if the infection is not contained properly.

3. Repair system damage

Malware can cause tremendous damage to Windows systems to the point where a full reinstallation could be required. For example, an infection can alter the Windows registry[1] database, damage vital bootup and other sections, delete or corrupt DLL files, etc. Antivirus software can't repair damaged files, and a specialized app should be used instead.

  • Download FortectIntego
  • Click on the ReimageRepair.exe
    Reimage download
  • If User Account Control (UAC) shows up, select Yes
  • Press Install and wait till the program finishes the installation processReimage installation
  • The analysis of your machine will begin immediatelyReimage scan
  • Once complete, check the results – they will be listed in the Summary
  • You can now click on each of the issues and fix them manually
  • If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.Reimage results

4. Alternative file recovery options

While the FBI,[2] security researchers, and our team here at 2-spyware highly recommend avoiding paying ransoms or even contacting cybercriminals, the choice is always in the hands of the victim. Keep in mind, however, that by paying the ransom, you only encourage the attackers to create more malware and infect more people – it's simply proof that the illegal and malicious business is lucrative.

The only way to fully prevent the devastating consequences of a ransomware attack is by keeping secure data backups – it can be done via reliable services such as Google Drive or OneDrive. If you need help with this process, you can find detailed instructions at the very bottom of this post.

As for now, you should concentrate on attempting to recover the t800 files. The first method we recommend is trying to use recovery software. It does not work for all ransomware victims, but some people manage to recover at least a portion of their lost files using this option.

Try recovery software

  1. Download Data Recovery Pro.
  2. Double-click the installer to launch it.
    T800 ransomware
  3. Follow on-screen instructions to install the software.Install program
  4. As soon as you press Finish, you can use the app.
  5. Select Everything or pick individual folders where you want the files to be recovered from.Select what to recover
  6. Press Next.
  7. At the bottom, enable Deep scan and pick which Disks you want to be scanned.Select Deep scan
  8. Press Scan and wait till it is complete.Scan
  9. You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
  10. Press Recover to retrieve your files.Recover files

Search for a decryptor

Luckily, some ransomware is far from perfect and has bugs[3] within their encryption process, which allows security experts to create a working decryption tool, providing it for victims for free. Alternatively, law enforcement has previously seized the servers of malware authors, which allowed them to release keys to the public. Thus, use the following links to find a decryption tool, although you should keep in mind that it might take time before a working one is available, if at all.

No More Ransom Project

Offer
do it now!
Download
Fortect Happiness
Guarantee
Download
Intego Happiness
Guarantee
Compatible with Microsoft Windows Compatible with macOS
What to do if failed?
If you failed to fix virus damage using Fortect Intego, submit a question to our support team and provide as much details as possible.
Fortect Intego has a free limited scanner. Fortect Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Fortect, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

Getting rid of T800 virus. Follow these steps

Create data backups to avoid file loss in the future

One of the many countermeasures for home users against ransomware is data backups. Even if your Windows get corrupted, you can reinstall everything from scratch and retrieve files from backups with minimal losses overall. Most importantly, you would not have to pay cybercriminals and risk your money as well.

Therefore, if you have already dealt with a ransomware attack, we strongly advise you to prepare backups for future use. There are two options available to you:

  • Backup on a physical external drive, such as a USB flash drive or external HDD.
  • Use cloud storage services.

The first method is not that convenient, however, as backups need to constantly be updated manually – although it is very reliable. Therefore, we highly advise choosing cloud storage instead – it is easy to set up and efficient to sustain. The problem with it is that storage space is limited unless you want to pay for the subscription.

Using Microsoft OneDrive

OneDrive is a built-in tool that comes with every modern Windows version. By default, you get 5 GB of storage that you can use for free. You can increase that storage space, but for a price. Here's how to setup backups for OneDrive:

  1. Click on the OneDrive icon within your system tray.
  2. Select Help & Settings > Settings.
    Go to OneDrive settings
  3. If you don't see your email under the Account tab, you should click Add an account and proceed with the on-screen instructions to set yourself up.
    Add OneDrive account
  4. Once done, move to the Backup tab and click Manage backup.
    Manage backup
  5. Select Desktop, Documents, and Pictures, or a combination of whichever folders you want to backup.
  6. Press Start backup.
    Pick which folders to sync

After this, all the files that are imported into the above-mentioned folders will be automatically backed for you. If you want to add other folders or files, you have to do that manually. For that, open File Explorer by pressing Win + E on your keyboard, and then click on the OneDrive icon. You should drag and drop folders you want to backup (or you can use Copy/Paste as well).

Using Google Drive

Google Drive is another great solution for free backups. The good news is that you get as much as 15GB for free by choosing this storage. There are also paid versions available, with significantly more storage to choose from.

You can access Google Drive via the web browser or use a desktop app you can download on the official website. If you want your files to be synced automatically, you will have to download the app, however.

  1. Download the Google Drive app installer and click on it.
    Install Google Drive app
  2. Wait a few seconds for it to be installed. Complete installation
  3. Now click the arrow within your system tray – you should see Google Drive icon there, click it once.
    Google Drive Sign in
  4. Click Get Started. Backup and sync
  5. Enter all the required information – your email/phone, and password. Enter email/phone
  6. Now pick what you want to sync and backup. You can click on Choose Folder to add additional folders to the list.
  7. Once done, pick Next. Choose what to sync
  8. Now you can select to sync items to be visible on your computer.
  9. Finally, press Start and wait till the sync is complete. Your files are now being backed up.

Report the incident to your local authorities

Ransomware is a huge business that is highly illegal, and authorities are very involved in catching malware operators. To have increased chances of identifying the culprits, the agencies need information. Therefore, by reporting the crime, you could help with stopping the cybercriminal activities and catching the threat actors. Make sure you include all the possible details, including how did you notice the attack, when it happened, etc. Additionally, providing documents such as ransom notes, examples of encrypted files, or malware executables would also be beneficial.

Law enforcement agencies typically deal with online fraud and cybercrime, although it depends on where you live. Here is the list of local authority groups that handle incidents like ransomware attacks, sorted by country:

Internet Crime Complaint Center IC3

If your country is not listed above, you should contact the local police department or communications center.

How to prevent from getting ransomware

Protect your privacy – employ a VPN

There are several ways how to make your online time more private – you can access an incognito tab. However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of Private Internet Access VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise. Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and Private Internet Access VPN will let you browse the Internet without a feeling of being spied or targeted by criminals. 

No backups? No problem. Use a data recovery tool

If you wonder how data loss can occur, you should not look any further for answers – human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence. In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.

If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. Data Recovery Pro is one of the leading file recovery solutions you can find on the market – it is likely to restore even lost emails or data located on an external device.

About the author
Alice Woods
Alice Woods - Likes to teach users about virus prevention

If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Alice Woods
About the company Esolutions

References