How to Remove Doubleoffset Ransomware (+ .doubleoffset File Recovery)

How to Remove Doubleoffset Ransomware?

Readers recently started to report the following message being displayed when they boot their computer:

Your files was encrypted! To decrypt write us
biger@x-mail.pro
biger@x-mail.pro
biger@x-mail.pro

Doubleoffset is the name of the latest ransomware threat. It gets its name from the attachment, it adds on your files, after it locks them. The tool belongs to the Cryakl family of threats. It’s a newer version of that notorious ransomware. V1.5.1.0, to be precise. And, once Doubleoffset sneaks in, it proceeds to seize control of your data. It uses special cryptography algorithms to encrypt everything. Music, video, archives, documents, pictures. All, you keep on your PC, falls victim to the hazardous tool. To solidify its reach over your files, it places a certain attachment, at the end of each file. Here’s an example. Say, you have a photo called ‘yes.jpg.’ It changes, once Doubleoffset is done with it. It becomes ’email-biger@x-mail.pro.ver-CL 1.5.1.0.id-512064768-82822172792612420478100.fname-yes.jpg.doubleoffset.‘ That’s lengthy, to say the least. And, once your files get renamed, you can no longer access them. And, moving or renaming them does not help. After the encryption is complete, you get a ransom note. It’s the exact opposite of the attachment as it’s unexpectedly short. Most ransomware tools use the note to explain the situation to the user. Not Doubleoffset. Usually, the note gives you key information. Like, the ransom amount, you have to pay to get your files back. Or, a time limit, to decide whether to comply or not. But with Doubleoffset, you get no deadline, and no payment amount. It’s quite simple. ‘Your files was encrypted! To decrypt write us.’ And, you get an email address. Presumably, once you contact them, you’ll get further instructions. Do NO such thing! Don’t contact these people! And, above all, do NOT pay them! To reach out is to further your grievances. So, avoid that, and don’t make the mistake of writing them. Most importantly, do NOT send them a single dime. Paying the ransom guarantees you nothing. In fact, chances are, no matter what you do, your files remain lost to you. So, cut your losses, and save your money. Say goodbye to your files. It’s a tough call to make, but it’s the right one.

How did I get infected with?

Ransomware tools are quite sneaky. They resort to the old but gold methods to invade your system. That includes the usual antics. Hiding behind freeware, and corrupted links or torrents. Pretending to be a system or program update. Like, Adobe Flash Player or Java. But, above all, these tools turn to spam emails. Say, you receive an email from a well-known company. It seems legitimate, so you open it. There’s an attachment, like a receipt or invoice, or even a banking statement. The email urges you to download it. And, if you do, and then open it, brace yourself for trouble. It doesn’t have to be an attachment. It can be a link that you get asked to click. The infection has an array of tricks, up its sleeve. Don’t let them prove successful. Approach every email with caution. When installing tools or updates, off the web, make sure to do your due diligence. Caution helps to keep infections out. Distraction, gullibility and haste, don’t. Make the right choice.

Why is Doubleoffset dangerous?

It may seem harsh, but you can’t win against Doubleoffset. You’re set up to lose, no matter what. Let’s examine your options, shall we? One day, you come to find your files encrypted. To decrypt them, you need a special key. The cyber kidnappers promise to send you the one, you need, if you comply. They request monetary payment, and leave you with nothing but a promise. Ask yourself. Can you trust these cyber criminals to keep their word? Don’t be naive. So, option one is, you comply. You send them the amount of money, they demanded. It’s usually in Bitcoin, and it rangers between 500 and 1000 US Dollars. Sometimes, even more. So, it’s no small fee. You pay up, and then what? You wait for the decryption key, they promised to send. Well, what if they don’t? What if they send nothing your way? But, even if you do get a key, don’t rejoice just yet. It can prove to be the wrong key. And, even in your best case scenario, you’re still not in the clear. You pay the ransom, get the key, it works, and your data gets unlocked. But what then? You paid money to remove a symptom, not the infection itself. The ransomware remains, free to strike once more. It can act up a week, a day, an hour, a minute, after you decrypt your files. Then, you’re back to square one. That’s why, experts advise against payment. Choose option two. Save your money, and forsake your files. Don’t place your faith on cyber extortionists. Place it on external storage and cloud services.

Doubleoffset Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover Doubleoffset Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with Doubleoffset encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate Doubleoffset encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.