Main variables are size of ransom and cryptographic algorithm ( symmetric or asymmetric) that ransomware uses to lock data. In most cases, victims are provided with a ransom message containing instructions about how to purchase these tools/keys. Generally, software of this type encrypts data and keeps it inaccessible until victims decrypt it with the correct decryption tool or key. Screenshot of a message encouraging users to pay a ransom to decrypt their compromised data: Note that files will remain encrypted even after uninstallation of Tongda2000, however, this will prevent if from causing further encryption and data loss. In such cases, restoring files from a backup is the only way to avoided being scammed. There are no other tools capable of recovering files encrypted by Tongda2000. Most ransomware-type programs encrypt files with a strong encryption algorithm, and therefore it is impossible to decrypt files without specific tools held only by the cyber criminals who designed the ransomware. In summary, victims who trust cyber criminals tend to be scammed. Cyber criminals often ignore victims even if all of their demands are met. There is a strong possibility, however, that they will not send no decryption tools/keys, even after payment. Tongda2000's developers will then supposedly provide a decryption tool and/or key. The 'readme_readme_readme.txt' ransom message states that victims must send 0.3 Bitcoin to the BTC wallet address provided, and then send a screenshot of the transaction to the and email addresses.

It creates at least one text file named ' readme_readme_readme.txt', which contains instructions about how to pay the ransom and contact Tongda2000's developers. For example, it renames a file named ' 1.jpg' to ' 1.jpg1', and so on. Tongda2000 renames all files by appending ' 1' to their extensions.

Discovered by Jirehlov, Tongda2000 is one of many ransomware-type programs designed to encrypt files, change filenames and create/display ransom messages.

17349 update download