Wipe Out PSCrypt Ransomware (Crypto-Malware/Ransomware)

May 14th 2018 - by Fix My PC FREE in: Blog PC Protection News Virus Removal | 0 Comment

ATTENTION, PLEASE!

Malware may reinstall itself multiple times if you don't delete its core files. This may require tracking down dozens of files in different locations.

We recommend downloading Restoro to eradicate Malware for you (it should cut down the time to about 15 minutes).

>> Download Restoro <<

 

What is PSCrypt ransomware? And how does it implement its attack?

PSCrypt ransomware is a file-encrypting virus that was first discovered last year, 2017, which targeted individual users as well as organizations in Ukraine. This crypto-malware is based on the GlobeImposter ransomware. Once it is able to infect a system, a malicious file named “xls.scr” which displays a power or energy icon is dropped into the system responsible for loading PSCrypt on the infected machine. PSCrypt ransomware has the same functionalities as GlobeImposter and will exclude system folders from being encrypted. It encrypts files with specific file extensions such as .$er, .4db, .4dd, .4d, .4mp, .abs, .accdb, .accdc. And as usual, just like GlobeImposter, it uses a temporary batch file to clear the Volume Shadow Copies of the files as well as the Event Logs. One of the noticeable changes in this new variant is its ransom note called “Ваші файли тимчасово зашифрувати! Не хвилюйтесь!” – its content is quite lengthy and is as follows:

“ВАШ ЛИЧНЫЙ ИДЕНТИФИКАТОР

 ВАШІ ФАЙЛИ ТИМЧАСОВО НЕДОСТУПНІ.

ВАШІ ДАНІ БУЛИ ЗАШІВРОВАННИ!

Для відновлення даних потрібно дешифратор.

Щоб отримати дешифратор, ви повинні, оплатити послуги розшифровки:

Оплата відбувається за коштами біткойн на кошелек № 1EoWxYTt7xCskTxjm47E2XNxgkZv1anDP9

Вартість послуги складає 150$

Оплату можна провести в терміналі IBox. або виберіть один з обмінних сайтів на сторінці – https://www.bestchange.ru/privat24-uah-to-bitcoin.html (приклад обмін Приват24 на BTC) також можете скористатися послугами https://e-btc.com.ua

Додаткова інформація:

Програма можемо дешифрувати один файл як доказ того, що у неї є декодер. Для цього необхідно надіслати зашифрований файл – вагою не більше 2 mb, и ваш уникальный идентификационный код, на пошту: systems32x@gmail.com

Более детальная инструкция по оплате: https://btcu.biz/main/how_to/buy

Увага!

Всі файли розшифровуються тільки після 100% оплати

Ви дійсно отримуєте дешифратор після оплати

Не намагайтеся видалити програму або запустити антивірусні інструменти це може ускладнити вам роботу

Спроби самодешіфрованія файлів приведуть до втрати ваших даних

Декодери інших користувачів не сумісні з вашими даними, оскільки унікальний ключ шифрування кожного користувача.

За запитом користувачів, надаємо контакти клієнтів, які вже користувалися послугами нашого сервісу.

ОБОВ’ЯЗКОВО ЗАПИШІТЬ РЕЗЕРВНІ КОНТАКТИ ДЛЯ ЗВ’ЯЗКУ:

systems32x@gmail.com – основний

systems32x@yahoo.com – резервний

Додаткові контакти:

systems32x@tutanota.com – (якщо відповіді не прийшло після 24-х годин)

help32xme@usa.com – (якщо відповіді не прийшло після 24-х годин)

Additional.mail@mail.com – (якщо відповіді не прийшло після 24-х годин)

З повагою

Unlock files LLC

33530 1st Way South Ste. 102

Federal Way, WA 98003

United States”

Its English version, however, is rather short and to the point. It states:

“ALL DATA IS ENCRYPTED!

For decoding, write to the addresses:

systems32x@gmail.com – Basic

systems32x@yahoo.com – backup

Additional Contacts:

systems32x@tutanota.com – (if the answer did not arrive after 24 hours)

help32xme@usa.com – (if the answer did not arrive after 24 hours)

Additional.mail@mail.com – (if the response did not arrive after 24 hours)”

As usual, when dealing with file-encrypting malware, paying the ransom is definitely not recommended. So the best way to deal with it is by wiping it out of your computer and use whatever backup copies you have until a free decryptor is available.

How does PSCrypt ransomware proliferate?

Just like other variants of GlobeImposter ransomware, creators of PSCrypt uses spam emails in proliferating this file-encrypting virus. More often than not, crooks tend to disguise the email as something urgent to lure users into opening them and downloading the corrupted attachment used to launch PSCrypt into the targeted system.

For the removal of PSCrypt ransomware, follow the given steps below.

Step 1: Tap Ctrl + Shift + Esc keys to launch the Task Manager.

Step 2: Go to Processes and look for the malicious process of PSCrypt ransomware then right click on it and select End Process or End Task.

Step 3: Close the Task Manager and open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.

Step 4: Look for dubious programs that might be related to PSCrypt ransomware and then Uninstall it/them.

Step 5: Tap Win + E to launch File Explorer.

Step 6: From there, navigate to the following directories listed below and look for the malicious components of PSCrypt ransomware like a file named “Ваші файли тимчасово зашифрувати! Не хвилюйтесь!” and an html file named “Paxynok.html” and remove them all.

  • %TEMP%
  • %APPDATA%
  • %DESKTOP%
  • %USERPROFILE%\Downloads
  • C:\ProgramData\local\

Step 7: Close the File Explorer.

Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use Restoro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.

Step 8: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 9: Navigate to the listed paths below and look for the registry keys and sub-keys created by PSCrypt ransomware.

  • HKEY_CURRENT_USER\Control Panel\Desktop\
  • HKEY_USERS\.DEFAULT\Control Panel\Desktop\
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Step 10: Delete the registry keys and sub-keys created by PSCrypt ransomware.

Step 11: Close the Registry Editor.

Step 12: Empty your Recycle Bin.

Complete the removal process of PSCrypt ransomware by using a trusted and reliable program like Restoro. Refer to the following guidelines on how to use it.

Perform a full system scan using asr. To do so, follow these steps:

  1. Turn on your computer. If it’s already on, you have to reboot
  2. After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

  1. To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
  2. Windows will now load the SafeMode with Networking.
  3. Press and hold both R key and Windows key.

  1. If done correctly, the Windows Run Box will show up.
  2. Type in the URL address, https://www.fixmypcfree.com/download.php?asr in the Run dialog box and then tap Enter or click OK.
  3. After that, it will download the program. Wait for the download to finish and then open the launcher to install the program.
  4. Once the installation process is completed, run asr to perform a full system scan.

  1. After the scan is completed click the “Fix, Clean & Optimize Nowbutton.

No Comment

Leave a Reply

Name Required

Website