Remove Corp Ransomware (+File Recovery)

How to Remove Corp Ransomware?

Readers recently started to report the following message being displayed when they boot their computer:

Your files are encrypted!

Paradise Ransomware Team!
[Your personal ID] [WHAT HAPPENED]

Your important files produced on this computer have been encrypted due a security problem
If you want to restore them, write to us by e-mail.
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.
[FREE DECRYPTION AS GUARANTEE]

Before paying you can send us 1-3 files for free decryption.
Please note that files must NOT contain valuable information
The file size should not exceed 1MB.
As evidence, we can decrypt one file
[HOW TO OBTAIN BITCOINS]

The easiest way to buy bitcoin is LocalBitcoins site.
You have to register, click Buy bitcoins and select the seller by payment method and price
https://localbitcoins.com/buy_bitcoins
write to Google how to buy Bitcoin in your country?

Contact!
[email address]
or
[email address]

The latest ransomware, users have complained of, goes by the name Corp. They’ve come to calling it that, courtesy of the extension it appends, when it strikes. Let’s explain. Corp belongs to the Paradise family of threats. The ransomware slithers into your system via deception. Then, once inside, spreads corruption. The tool uses RSA cipher algorithm. To encrypt your data. All your files get affected. Music, videos, documents, archives, pictures. Everything, you store on your computer, gets locked. The infection adds a special extension at the end of each file. Thus, making it unreachable. Here’s an example. Say, you have a photo called ‘1.jpg.’ That turns into ‘1.jpg_%ID%_{alexbanan@tuta.io}.CORP.’ Once the extension gets put into place, you can no longer access your files. Moving and renaming them is a futile effort. They’re under lock-down. The only way to change that is to comply with the cyber kidnappers’ demands. After encryption, the infection leaves you a ransom note. It’s called $%%! NOTE ABOUT FILES -=!-.html. It explains your current predicament, and contains instructions. Do NOT follow these instructions! The extortionists try to get you to pay them money for your files. They promise that, once you pay up, they’ll send you a special decryption key. Apply it, and your files get unlocked. All that seems fine and dandy, but ask yourself the following. Can you trust cyber criminals to keep their word? The answer is ‘No.’ Don’t take any chances. Don’t waste your money. Say goodbye to your files, and move on. Put your faith in backups. Use cloud services and external storage. The fight against a ransomware is not one, you can win.

How did I get infected with?

How do you imagine you get stuck with Corp? Well, like most infections online, it uses your carelessness as a way in. The tool turns to the old but gold invasive methods to gain passage into your PC. It hides behind freeware, corrupted sites, or torrents. It can pretend to be a fake system or program update. Like, Java or Adobe Flash Player. And, of course, it uses spam emails. One day, you receive an email from a well-known company. It seems legitimate so you open it to discover an attachment, or a specific link. The email reads that you must click said link, or download said attachment. They pose as confirmation links, invoices, receipts, anything. Click nothing! Don’t give into naivety. Always make sure to know what you open, press, download. Even a little extra attention can save you a ton of troubles. Do your due diligence. Caution helps to catch cyber threats in the act of attempting invasion. Carelessness helps them sneak by you, unnoticed. Don’t ease their infiltration. Spot them trying to slip by undetected, and prevent them from doing so. Choose caution over carelessness.

Why is Corp dangerous?

As soon as Corp strikes, you face a conundrum. You have a choice to make. Give into fear and naivety, and comply. Or, keep level-headed, and make the tough, but right, call. Here’s the thing. Even if you follow these people’s instructions to the dot, you won’t get your files. Think about it. There are countless ways for them to double-cross you. If you pay the ransom, you wait to receive a key, they promised to send. But what if they don’t? Or, what if they give you one that doesn’t work? And, even if they send the right one, don’t rejoice yet. The decryption key removes the encryption. The infection that did the encryption remains. And, it’s free to strike again. It can lock your data a mere minute after you apply the key. What then? Are you going to pay again? Don’t put your faith to the mercy of cyber criminals. They’re unreliable and malicious. Don’t pay. Cut your losses, and discard your data.

Corp Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover Corp Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with Corp encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate Corp encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.