Oldbat Ransomware Virus Removal (+File Decryption)

How to Remove Oldbat Ransomware?

If your files get encrypted all of a sudden, there’s no need to sugarcoat it. One particular type of infection works that way and it’s the most dreaded virus online. Have you heard of ransomware? You are now infected with a ransomware program so check out today’s article. The more you know about this parasite, the better. As mentioned, you’re now stuck with a notoriously dangerous PC virus. Most ransomware-type programs follow the exact same pattern. And it includes locking your private, precious files. The parasite gets activated immediately after installation. The installation itself happens completely behind your back. Once that first step is complete, your computer gets thoroughly scanned. You see, that’s how ransomware locates the files that it’s about to lock. It successfully finds and locks every single bit of information stored on board. Yes, that means all your data falls victim to the parasite. Do you keep important files on your machine? Many people do and that’s what hackers aim for. They rely on the fact that you’d want to free your files at all cost. The virus uses a complicated encrypting algorithm. As a result, it turns your information into unreadable gibberish. Then it adds the .Oldbat extension to the target files. That’s how you can tell whether your data has been modified. If you notice the .Oldbat appendix, it’s game over. The parasite has already messed with the format of your files. Hence, you’re no longer able to open any of them. Do you see the scheme already? Crooks are trying to blackmail you by holding your files hostage. Ransomware is nothing but a clever attempt for a fraud. If you give into your anxiety, you lose money. That’s how it works. The parasite denies you access to your favorite files. It locks pictures, music, videos, documents, etc. It also drops .txt or .html files on your desktop. In addition, you will them in all folders which contain encrypted data. As you could imagine, those are your payment instructions. The most important part of the scam. According to the ransom notes, you only have one way to restore your locked information. Hackers offer a unique decryptor key which, obviously, doesn’t come for free. You’re actually supposed to pay a hefty sum of money in Bitcoin to get that decryptor. Even after that, though, you may receive nothing. Cyber criminals are definitely not the kind of people to negotiate with. Why trust them then?

How did I get infected with?

How can you determine the method this infection used? Well, you can’t. Malware has an incredibly rich variety of infiltration techniques. The most plausible scenario is that the virus was hidden in a fake email/message. That’s one of the most commonly used methods when it comes to ransomware. It is both stealthy and efficient so it’s no wonder hackers prefer this tactic. However, that means you have to be super careful what you open. You may receive an extremely harmful spam message/email-attachment. Delete it ASAP. Remember, deleting it would only take you a moment. Having to delete ransomware, on the other hand, would be much more time-consuming. Furthermore, ransomware could steal your money. Now that you know how problematic these programs are, why risk it again? Put your safety first and don’t be gullible. Another popular technique involves freeware and shareware bundles. Those could have a nasty intruder attached to them as well. Unless you check out all programs in the bundle one by one, you may install an infection. Ransomware travels the Web via exploit kits, fake torrents or via other parasites. Long story short, you should always be cautious while surfing the Internet.

Why is Oldbat dangerous?

Ransomware locks your personal files. Then this pest even demands money from you. Unlike some other parasites that use subtle approaches, ransomware directly asks for money. Are you willing to give your Bitcoins to the very people who encrypted your files, though? Hackers do promise a decryptor. To put it mildly, crooks aren’t known for being honorable people. Paying the ransom guarantees you nothing. The parasite’s complicated cipher doesn’t allow you to use your own information. You’re supposed to pay for the privilege to use your own data. Does that seem like a fair deal to you? Keep in mind that hackers have no intentions to restore your locked files. Don’t even consider following their instructions and take action now. To delete the virus manually, please follow our detailed removal guide down below.

Oldbat Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover Oldbat Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with Oldbat encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate Oldbat encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.