How to remove Paradise Ransomware and decrypt .paradise files

November 16, 2017 Aleksei Abalmasov 0

Paradise Ransomware is crypto-virus distributed as RaaS (Ransomware-as-Service). That means it is simplified ransomware development kit, that allows potential hackers and malware distributors to substitute their e-mails and BitCoin wallets and receive ransom payments from infected users. Virus appends .paradise file extension and modifies filename with affiliate identification number and e-mail, so the final pattern looks like this: id-affiliate-id-[affiliate-e-mail].paradise. Malware uses RSA-1024 cryptography. Ransomware creates 3 text files: Files.txt, Failed.txt, and #DECRYPT MY FILES#.txt. First two are the lists of successfully encrypted files and files, that failed to be encrypted.

How to remove CryptoMix Ransomware and decrypt .xzzx files

November 16, 2017 Aleksei Abalmasov 0

CryptoMix Ransomware is famous family of ransom-demanding encryption viruses. Recently it came up with updated version that modifies your files with random set of 32 letters and digits and .xzzx file extension. So it makes your files look like this: 1V3DJHJ6M78BL3535RTY987XZFDGP876.XZZX. This new version uses complex double encryption with RSA-1024 ans AES algorithms. After encryption finishes CryptoMix Ransomware creates _HELP_INSTRUCTION.TXT file that contains contact e-mails and ransom-demanding message. Malefactors use following e-mails: xzzx@tuta.io, xzzx1@protonmail.com, xzzx10@yandex.com, and xzzx101@yandex.com.

How to remove Unlock92 Ransomware and decrypt .block, .blocked, .CRRRT, .CCCRRRPPP files

November 13, 2017 Aleksei Abalmasov 0

Unlock92 Ransomware is dangerous crypto-virus that uses RSA-2048 asymmetric algorithm to encrypt user personal files. Considering the fact, that it uses Russian language in description it mostly targets Eastern European users. However, virus is distributed via public networks and international spam bots and any user can become a victim. Unlock92 Ransomware underwent several major updates and changes.

How to remove YYTO Ransomware and decrypt .yyto, .b007, .juuj and .m5m5 files

November 9, 2017 Aleksei Abalmasov 0

YYTO Ransomware is new crypto-virus, that encrypt sensitive files on users computers using AES-256 cryptography. Latest version of this ransomware adds .colecyrus@mail.com.b007 suffix to the end of encrypted files. After successful encryption YYTO Ransomware places text files with instructions to pay the ransom on the desktop and in folders with affected files. Instruction files filenames are: help_to_decrypt.txt, read_to_txt_file.yyt, help.txt, encrypt.txt or Readme.txt, depending on the version of ransomware in your case. Ransom amount is between $500 and $1500.