Category Ransomware

Articles about removing ransomware that blocks Windows or browsers and can encrypt your data and demand ransom.

How to remove CryptON Ransomware and decrypt _x3m, _locked, _r9oj, _crypt files

CryptON Ransomware is crypto-virus, that gave birth to large family of ransomware encryption viruses like Nemesis, X3M, Cry9, Cry128, Cry36. This particular ransomware appends _crypt extension to filenames and saves original extension. So after encryption user file sample.txt will become sample_crypt.txt. After successful encryption CryptOn Ransomware creates readme_encrypted.txt file. There are several decryption tools released from companies like Emsisoft, Avast, Eset and we will give you instructions to use them below. Learn how to remove CryptON ransomware and decrypt _crypt files using guide on this page.

How to remove Blind Ransomware and decrypt .blind and .kill files

Blind Ransomware is cryptoviral extortion, that uses RSA and AES algorithms to encrypt user data. This particular ransomware appends .blind and .kill suffixes to compromised files. It also adds developers e-mail to the filenames: blind@cock.li or kill@rape.lol. Usually, malware attacks files, that represent value for the user - documents, presentations, photos, video, music. After finishing encoding files, Blind Ransomware creates following file: How_Decrypt_Files.hta.

How to remove Paradise Ransomware and decrypt .paradise files

Paradise Ransomware is crypto-virus distributed as RaaS (Ransomware-as-Service). That means it is simplified ransomware development kit, that allows potential hackers and malware distributors to substitute their e-mails and BitCoin wallets and receive ransom payments from infected users. Virus appends .paradise file extension and modifies filename with affiliate identification number and e-mail, so the final pattern looks like this: id-affiliate-id-[affiliate-e-mail].paradise. Malware uses RSA-1024 cryptography. Ransomware creates 3 text files: Files.txt, Failed.txt, and #DECRYPT MY FILES#.txt. First two are the lists of successfully encrypted files and files, that failed to be encrypted.

How to remove Unlock92 Ransomware and decrypt .block, .blocked, .CRRRT, .CCCRRRPPP files

Unlock92 Ransomware is dangerous crypto-virus that uses RSA-2048 asymmetric algorithm to encrypt user personal files. Considering the fact, that it uses Russian language in description it mostly targets Eastern European users. However, virus is distributed via public networks and international spam bots and any user can become a victim. Unlock92 Ransomware underwent several major updates and changes.

How to remove YYTO Ransomware and decrypt .yyto, .b007, .juuj and .m5m5 files

YYTO Ransomware is new crypto-virus, that encrypt sensitive files on users computers using AES-256 cryptography. Latest version of this ransomware adds .colecyrus@mail.com.b007 suffix to the end of encrypted files. After successful encryption YYTO Ransomware places text files with instructions to pay the ransom on the desktop and in folders with affected files. Instruction files filenames are: help_to_decrypt.txt, read_to_txt_file.yyt, help.txt, encrypt.txt or Readme.txt, depending on the version of ransomware in your case. Ransom amount is between $500 and $1500.

How to remove TeslaCrypt 4.2 Ransomware and decypt .vvv and .exx files

If you are infected with ransomware and you see any of this extension added - that means your files are encrypted with TeslaCrypt 4.2 or earlier versions and your files can be decrypted. To effectively restore your files you need to remove any active process of this ransomware using special removal tools or trying standard antivirus software. After this you need to use special decoders to determine decryption key and get your files back. Follow instructions below to remove TeslaCrypt 4.2 Ransomware and decrypt .vvv or .exx files in Windows 10, Windows 8, Windows 7.

How to remove Arena Ransomware and decrypt .arena files

Arena Ransomware is successor of Dharma Ransomware from CrySis crypto-virus family. This malware uses asymmetric cryptography to encrypt users files, such as documents, photos, music, videos, games etc. This version appends .arena extension to affected files. After finishing encryption process various versions of Arena Ransomware can create different text or html files with instructions: FILES ENCRYPTED.txt, info.hta, Your personal data are encrypted!.txt, _HELP_INSTRUCTION.TXT. Ransomware can demand payment from 0.3 to 1 BitCoins (which is equivalent to $2000 - $6000) for decryption services, but usually malefactors don't send any keys.

How to remove Sage 2.2 Ransomware and decrypt .sage files

Sage 2.2 Ransomware is successor of Sage 2.0 Ransomware and Sage Ransomware based on CryLocker family. It was changed in terms of design of desktop background and payment pages. It also uses new filenames for instructions file and image file (!HELP_SOS.hta and !HELP_SOS.bmp). Virus still adds .sage file extension to encrypted files and uses Microsoft SAPI voice to read the message on your desktop aloud. This is done to create negative psychological effect. Latest version of this ransomware demands 0.17720 BTC or almost $1000 for decryption.

How to remove Bad Rabbit Ransomware and decrypt your files

Bad Rabbit is new wide-spread ransomware, that uses RSA-2048 and AES cryptography. It mostly targets enterprises in Eastern Europe. Security experts claim, that Bad Rabbit is related to previously distributed Petya и NotPetya viruses. Currently, several governmental institutions and banks were attacked by this virus in Russia, Ukraine, Turkey, Germany. Hackers demand ransom of 0.05 BTC (BitCoins), which is ~280$ and threaten to increase this amount if not paid within certain time gap. We strongly recommend not to send money, as in most cases malefactors do not send keys.