Infected with IT.Books Ransomware? Need to decrypt your files?
What is IT.Books Ransomware
IT.Books is another cryptovirus extorting money from users. Like similar viruses, IT.Books encrypts user files in various formats, such as office documents, archives, photos, video, audio, and more. It uses the AES encryption algorithm, so it is impossible to recover the files by yourself. Moreover, IT.Books removes system restore points to eliminate the possibility of returning to an early date. After encryption, the virus changes the extension of the victim files to .fucked and creates a special file READ__IT.txt that acts as a note containing information about encryption and possible redemption. Here’s what it looks like:
Files has been encrypted with strong KEY
Send payment to our bitcoin address
you can visit google or localbitcoin to buy bitcoin.
BTC Address: 13vs2K5TiDAn6eLSevnds8esWZfeUhov2d
After payment click contact us you will recieve Decryption KEY in less than 1 hour.
In some cases, the virus uses the lock screen as a note:
I want to play a game with you. Let me explain the rules:
Your personal files are being deleted. Your photos, videos, documents, etc...
But, don't worry! It will only happen if you don't comply.
However I've already encrypted your personal files, so you cannot access them.
***
Also, the virus changes the desktop wallpaper to this:
YOUR COMPUTER HAS BEEN LOCKED!
Your documents, photos, databases and other important files have been locked with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt ypur files until you pay and obtain the private key.
Follow the instruction to get the Decryption key!
The notes do not contain information about the amount of the ransom, however, judging by the feedback from users, it can reach thousands of dollars. We do not recommend that you pay them, as this is a waste of money. Try to delete IT.Books and decrypt files using our recommendations below.
Update: Use following service to identify the version and type of ransomware you were attacked by: ID Ransomware. If you want to decrypt your files, please follow our instruction below or, if you have any difficulties, please contact us: submit@securitystronghold.com. We really can help to decrypt your files.
How IT.Books infected your PC
In most cases, IT.Books, like similar crypto viruses, comes through unprotected network settings. In some cases this comes as an attachment in the spam ezine. This happens because users neglect the issue of computer security and do not use paid versions of anti-virus software. You need to use proven antiviruses and utilities that can protect your computer. If IT.Books has already penetrated your PC and encrypted your files, then read our recommendations to get rid of this crypto virus and decrypt your files.
First of all, don’t panic. Follow these easy steps below.
1. Start your computer in Safe Mode with networking. To do that, restart your computer before your system starts hit F8 several times. This will stop system from loading and will show Advanced boot options screen. Choose Safe mode with networking option from the options list using up and down arrows on your keyboard and hit Enter.
2. Log in to the system infected with the IT.Books virus. Launch your Internet browser and download a reliable anti-malware program and start a full system scan. Once the scan is complete, review scan results and remove all entries detected.
Recommended Solution:
Norton is a powerful removal tool. It can remove all instances of newest viruses, similar to IT.Books – files, folders, registry keys.
*Trial version of Norton provides detection of computer viruses for FREE. To remove malware, you have to purchase the full version of Norton.
You may find more detailed information about antivirus products in our article – Top 5 Antivirus Software for Windows
Restore your files using shadow copies
- Download and run Stellar Data Recovery.
- Select type of files you want to restore and click Next.
- Select the drive and folder where your files are located and date that you want to restore them from and press Scan.
- Once the scanning process is done, click Recover to restore your files.
Step 2: Remove following files and folders of IT.Books:
Related connections or other entries:
BTC: 13vs2K5TiDAn6eLSevnds8esWZfeUhov2d
Related files:
READ__IT.txt
IT.Books.exe
How to decrypt files infected by IT.Books?
You can try to use manual methods to restore and decrypt your files.
Decrypt files manually
Restore the system using System Restore
Although latest versions of IT.Books remove system restore files, this method may help you partially restore your files. Give it a try and use standard System Restore to revive your data.
- Initiate the search for ‘system restore‘
- Click on the result
- Choose the date before the infection appearance
- Follow the on-screen instructions
Roll the files back to the previous version
Previous versions can be copies of files and folders created by Windows Backup (if it is active) or copies of files and folders created by System Restore. You can use this feature to restore files and folders that you accidentally modified or deleted, or that were damaged. This feature is available in Windows 7 and later versions.
- Right-click the file and choose Properties
- Open the Previous Version tab
- Select the latest version and click Copy
- Click Restore
Protect your computer from ransomware
Most modern antiviruses can protect your PC from ransomware and crypto-trojans, but thousands of people still get infected. There are several programs that use different approach t protect from ransomware and lockers. One of the best is HitmanPro.Alert with CryptoGuard. You may already know HitmanPro as famous cloud-based anti-malware scanner. Check out ultimate active protection software from SurfRight.
Written by Rami Douafi