Worse customer support ever

General Topics
1

I’m curious to know how others are getting on with support tickets raised. I cannot get an answer to my queries - including a simple request for information on their complaints procedure. I am trying to use the AES_NI decrypt tool but it fails to initialise so just need to know whether this tool works or not. If it does I clearly need help. Its a shame they do not do online chat. I have tried calling but there is only so much ‘music on hold’ a guy can take.

Anyway, I’m interested to know if they actually have a support team or not. So how are others getting on ???

2

Are you not getting any reply? it usually takes 5+ business days (not weekends)
When did you send it?

Ticket system work according to first in / first out, if you create a new ticket you are put back in line

3

You need to have patience.
avast answers all tickets.
Current handling time is 10-15 business days.

Without more information help is not possible.
Why are you trying to use that tool ?
If you believe you are infected with the AES_NI, why do you think so ?
What exactly is not working ?
etc.

https://www.nomoreransom.org/

4

Hi Eddy, thanks for the response. To be fair, 10-15 business days is unacceptable in this day and age. Its just not reasonable to expect customers to wait that long. I did try the website you listed but I get an error because they are using the old TLS settings so I can’t connect. One of my older PCs was hacked and all the files were encrypted by AES_NI. Avast claim to have a tool to decrypt. When I try to run it, I’ve tried from several PCs, I just get an error saying it cannot initialise. I just need some help from support on this…and as I said, 10-15 days is simply not acceptable. I wonder how many people would buy their product knowing this was their response time?

5

Have you identified the ransomware correct?

ID Ransomware https://id-ransomware.malwarehunterteam.com/

6

Noransomeware is using the latest TLS version.
https://www.ssllabs.com/ssltest/analyze.html?d=www.nomoreransom.org&s=54.192.119.194&latest

Give the Rakhni Decryptor (Kaspersky) a try.

7

Hi Pondus - thanks for the link but yes I’ve tried there. The files have all been renamed to *.AES_NI and there are text files declaring who they are, what they have done and how they want paid.

Hi Eddy - that’s strange. I just get an error about the TLS when trying to access the site. It must be something at my end. I’ve tried decryptors from Avast, Eset, Kaspersky and a few others. None of them really even start. I’m beginning its just one big con to reel you in…and then when they don’t work and you need support you need to buy their product. Unfortunately I choose to buy Avast…boy was that a mistake. I also created a ticket asking for details of their complaints procedure as well contact details - they just closed it. That tells me all I need to know about how Avast treat customers. I’ll be posting comments about them in every public media format I can - if it saves one person from buying their product then I’ll accept that as job done.

8

All Ransomware Decryption Tools from Avast are free…!!
→ https://www.avast.com/ransomware-decryption-tools

9

Get the decryptor from Kaspersky.
Disable the avast shields en run it.
I’ve tested it and it is working.

10

Hi Eddy, I tried the decryptor from Kaspersky. It runs but just says it ‘cannot find password’ on the encrypted files. Thanks though !

11

Hello, m.gray,

the problem you are describing may indicate that the session key file is missing in your PC.
Normally, AES_NI ransomware creates a session RSA key in the C:\ProgramData folder. The name of the file is like this:

JOHN-PC#9C43A95AC27D3A131D3E8A95F2163088-SPECIAL NEW-201752671610-234.key.aes_ni
Please, take a look if you can find such file there.

If yes, please, send it to decryptors-at-avast-dot-com.
If not, try to search your PC for all *.key.aes_ni files.

12

Hi DecryptorGuy. Unfortunately there is no *.key.aes_ni file :frowning:

13

In that case, your files cannot be decrypted. This is how the ransomware works:

  1. Create a session RSA key
  2. Encrypt this one with master RSA key and store it into ProgramData
  3. Use the session RSA key to encrypt a per-file decryption key.

It is essential for the decryptor to find the encrypted session RSA key. Without it, the files cannot be decrypted.

14

Thanks DecryptorGuy. I’ve searched everywhere on the network for the key but its not there. Absolutely gutted but I guess that’s life. Thanks again for your help.

15

I hope from now on you create a image of drive and backups of data frequently.
You might want to keep a copy of the applications you download/install as well.

16

Hi Eddy, I’m sure the lesson has been learned. Its not actually my stuff - its a friends business. I’m actually paranoid about this kind of thing so I use Ubuntu for my browsing and my data is all online with O365 (backed up to external USB devices that are only switched on to do the backup). This should be a lesson to all though. IT systems need to be upgrade. Security needs to be taken seriously. And ofcourse the old cliché…its not the cost to do them, its the potential cost when you do not. Thanks again for your feedback!