Infected with Unlock92 Ransomware? Need to decrypt your files?
What is Unlock92 Ransomware
Unlock92 Ransomware is dangerous crypto-virus that uses RSA-2048 asymmetric algorithm to encrypt user personal files. Considering the fact, that it uses Russian language in description it mostly targets Eastern European users. However, virus is distributed via public networks and international spam bots and any user can become a victim. Unlock92 Ransomware underwent several major updates and changes. It used to append following extensions to encrypted files:
.kukaracha, .block, .blocked, .CRRRT, .CCCRRRPPP, .crptd, .cr020801, .i25fx10
But the most recent version adds random 7-digit extension and uses unlckr@protonmail.com e-mail for communication. Here is the contents of ransom-demanding note:
Ваши файлы зашифрованы с использованием криптостойкого алгоритма RSA-2048. Если хотите их вернуть отправьте один из зашифрованных файлов и файл yourkey.ttp на e-mail: unlckr@protonmail.com
Если вы не получили ответа в течение суток или письмо возвращается с ошибкой то скачайте с сайта www.torproject.com браузер TOR и с его помощью зайдите на сайт http://n3r2kuzhw2h7x6j5.onion - там будет указан действующий почтовый ящик.
Попытки самостоятельного восстановления файлов могут безвозвратно их испортить!
Previous versions of Unlock92 Ransomware also used following images to modify users desktop: ORID.jpg, qqq.jpg, !—-README—-!.jpg and following ransom note files: keycode.tta, !_ИНСТРУКЦИЯ_!.txt, !!!!!!!!Как восстановить файлы!!!!!!!.txt. Those e-mails are also related to Unlock 92 Ransomware: decrypt.guarantee@aol.com, unlock92@india.com. Currently, this ransomware can be removed using Removal Tool provided below, and most of the files can be decrypted using decryption tool featured in this article. Please, follow this step-by-step instructions to remove Unlock92 ransomware and decrypt .kukaracha, .block, .blocked, .CRRRT, .CCCRRRPPP, .crptd, .cr020801, .i25fx10 files.
Update: Use following service to identify the version and type of ransomware you were attacked by: ID Ransomware. Also check following website for possible decryptor: Emsisoft Decryptors.
How Unlock92 Ransomware infected your PC
Unlock92 Ransomware usually infects your PC through infected email attachments (be careful, as cyber criminals usually mask their spam malicious emails with attachments into Ebay email or any other popular trusted website), fake software updaters and trojans – that’s why good anti-viruses is vitally important to avoid ransomware threat. You can also get this ransomware on file sharing networks, including torrent files. Ransom is asked to be paid in BitCoins, that also makes the task difficult for the police, as user in this network are often anonymous. Encryption starts in the background. Way to protect your computer from such threats is to use antiviruses with crypto-protection like HitmanPro.Alert with CryptoGuard.
First of all don’t panic. Follow these easy steps below.
1. Start your computer in Safe Mode with networking. To do that, restart your computer, before your system starts hit F8 several times. This will stop system from loading and will show Advanced boot options screen. Choose Safe mode with networking option from the options list using up and down arrows on your keyboard and hit Enter.
2. Log in to the system infected with the Unlock92 Ransomware virus. Launch your Internet browser and download a reliable anti-malware program and start a full system scan. Once the scan is complete, review scan results and remove all entries detected.
Recommended Solution:
Norton is a powerful removal tool. It can remove all instances of newest viruses, similar to Unlock92 Ransomware – files, folders, registry keys.
*Trial version of Norton provides detection of computer viruses for FREE. To remove malware, you have to purchase the full version of Norton.
Step 2: Remove following files and folders of Unlock92 Ransomware:
Remove following registry entries:
no information
Remove following files:
BTTP.exe
карта партнера.doc.exe
BCART.exe
pdf.exe
KSATAT.exe
LAMAR.exe
MKEMBE.exe
notrad.exe
ktw.sas
How to decrypt files infected by Unlock92 Ransomware (.block, .blocked, .CRRRT, .CCCRRRPPP files)?
Use automated decryption tools
There is ransomware decryptor from Michael Gillespie that can decrypt .block, .blocked, .CRRRT, .CCCRRRPPP files. It is free and may help you restore .block, .blocked, .CRRRT, .CCCRRRPPP files encrypted by Unlock92 Ransomware virus. Download it here:
You can also try to use manual methods to restore and decrypt .block, .blocked, .CRRRT, .CCCRRRPPP files.
Decrypt .block, .blocked, .CRRRT, .CCCRRRPPP files manually
Restore the system using System Restore
Although, latest versions of Unlock92 Ransomware remove system restore files, this method may help you partially restore your files. Give it a try and use standard System Restore to revive your data.
- Initiate the search for ‘system restore‘
- Click on the result
- Choose the date before the infection appearance
- Follow the on-screen instructions
Roll the files back to the previous version
Previous versions can be copies of files and folders created by Windows Backup (if it is active) or copies of files and folders created by System Restore. You can use this feature to restore files and folders that you accidentally modified or deleted, or that were damaged (in our case – Unlock92 Ransomware by Unlock92 Ransomware). This feature is available in Windows 7 and later versions.
- Right-click the file and choose Properties
- Open the Previous Version tab
- Select the latest version and click Copy
- Click Restore
Restore .block, .blocked, .CRRRT, .CCCRRRPPP files using shadow copies
- Download and run Shadow Explorer.
- Select the drive and folder where your files are located and date that you want to restore them from.
- Right-click on folder you want to restore and select Export.
- Once the scanning process is done, click Recover to restore your files.
Protect your computer from ransomware
Most modern antiviruses can protect your PC from ransomware and crypto-trojans, but thousands of people still get infected. There are several programs that use different approach t protect from ransomware and lockers. One of the best is HitmanPro.Alert with CryptoGuard. You may already know HitmanPro as famous cloud-based anti-malware scanner. Check out ultimate active protection software from SurfRight.
Information provided by: Alexey Abalmasov