Remove Eth Ransomware Virus (+.Eth File Recovery)

How to Remove Eth Ransomware?

Readers recently started to report the following message being displayed when they boot their computer:

all your data has been locked us
You want to return?
write email helpfilerestore@india.com

There’s a new player on the ransomware field. The latest cyber threat, part of that category, goes by the name Eth. Users have come to calling it that, because of the extension it adds, when it targets your data. The Eth threat is a variant of the Dharma virus family. After it infiltrates your system, it locks all the data, you have. Archives, documents, music, videos, pictures. Nothing escapes it. The infection uses encryption algorithms to seize control of your files. As mentioned, it attaches the ‘.eth’ extension at the end of each file. Say, your photo is called ‘yes.jpg.‘ Well, it won’t stay like that, after Eth is done with it. You’ll find it as ‘yes.jpg.id-1E857D00.[helpfilerestore@india.com].ETH.’ As you can see, the infection also adds the email address, it wants you to write to. Do NOT! In fact, do not follow any of the ransomware’s demands. Nothing good comes from compliance. So, don’t comply! It may seem a tough decision to make. But it’s the right one. And, experts urge you to take it. Don’t contact these people, and don’t pay them a single dime. Don’t forget you’re dealing with cyber criminals, who’ve taken your data hostage. Strangers, who extort you for monetary gain. They’re untrustworthy, and you cannot rely on them to keep their word. They’ll double-cross you, once they get their money. So, don’t give them any. Don’t reach out to them at all.

How did I get infected with?

Ransomware tools, like Eth, are pretty sneaky. They resort to the usual antics, when it comes to infiltration. They use trickery to slip by you, undetected. The usual methods include posing as a fake system or program update. Like, Java or Adobe Flash Player. Or, hiding behind corrupted sites, links, or torrents. Or, using freeware or spam emails as a way in. The infection has a plethora of methods, it can turn to, and sneak past you. It’s up to you to prevent its success. Don’t let it slither by you, unnoticed! You see, the infection preys on your carelessness. It needs you to give into naivety, and rely on luck. To rush, and not bother doing due diligence. To leave your faith to chance, and choose carelessness over caution. Don’t! Do yourself a favor, and do the opposite. Always take the time tp be thorough. Double-check everything. Look for the fine print. Even a little extra attention can save you a ton of troubles.

Why is Eth dangerous?

When Eth finishes the encryption process, it leaves you a note. It’s a text file called ‘FILES ENCRYPTED.txt.’ It leaves the ransom note on your Desktop. As well as, in each folder that has encrypted data. It’s a rather concise one. It states that “all your data has been locked.” And, if you wish to change that, you must “write email.” That’s all you get. You’re expected to contact these cyber criminals. And, once you do, they’ll provide you with further instructions. Generally, the ransom is to get paid in Bitcoin. And, the amount may vary from $500 to $1000, or even more. Sometimes, extortionists claim they’ll change the price, depending on how fast you carry out their demands. Don’t fall for that. These people want your money. Once they get it, they move on to the next victim. Yes, they try to convince you that payment guarantees you your files back. But think about that. Payment guarantees you nothing! Say, you do transfer the ransom amount. What then? These people promised to send you the decryption key, you need. What if they don’t? Or, what if they give you one that doesn’t work? You’re left with less money, and your files stay locked. And, even if you pay, get the key, and it works, it’s no cause for celebration. You removed a mere symptom of the infection. Not the problem itself. The Eth threat remains, ready to strike again. And, if it does, you’re back to square one. Only, apart from having your files locked, you’ll have less money, too. So, ask yourself. Are you willing to take such chances? Experts advise against it. Heed their advice!

Eth Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover Eth Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with Eth encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate Eth encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.