Remove Last_centurion@aol.com Ransomware

How to Remove Last_centurion@aol.com Ransomware?

Reader recently start to report the following message being displayed when they boot their computer:

All of your files are encrypted, to decrypt them write me to email: Last_centurion@aol.com.

In case of no answer in 24 hours, write to Last_centurion@aol.com

According to some researchers, this program belongs to the Troldesh Ransomware family. What everyone agrees on is that it’s a terrible PC infection. Ransomware programs in general are very nasty and usually cause great damage. Yes, you’re stuck with a particularly harmful type of virus. It travels the Web in complete and utter silence. Furthermore, it starts wreaking havoc immediately after installation. The virus firstly scans your PC system in order to find your personal files. Then encryption begins. By using a strong encrypting cipher, this program takes down a huge variety of file formats. Consider most of your information gone. Anything from MS Office documents and videos to music and pictures – ransomware isn’t picky. Once encryption is complete, you’ll notice a bizarre extension added to your files. It includes a unique ID and ends with {Last_centurion@aol.com}.xtbl. Now, this extension is a crystal clear sign that your data is inaccessible. That’s precisely what ransomware is after. These parasites hold your files hostage and attempt to blackmail you. It’s quite a clever scheme, actually. The virus utilizes a highly complicated encrypting cipher. As a result, it turns all your precious files into unreadable gibberish. While locking your data, the parasite creates detailed payment instructions. Yes, you’re supposed to PAY for the privilege to use your very own files. If you give into your despair and anxiety, you fall straight into the trap. Remember, ransomware is playing mind games with you. According to the ransom notes, you have to contact hackers. That’s what the Last_centurion@aol.com email address is for. Crooks promise a decryption key, a unique combination of symbols. However, those are the people who locked your files to begin with. Do you really believe giving them money is the right way to go? If anything, you’d become a sponsor of hackers’ malicious business. There’s absolutely no guarantee you will receive anything after you pay the random. Furthermore, the money demanded usually isn’t small. As mentioned, ransomware is just a pesky attempt for a cyber fraud. Do not let hackers scam you and do not trust their ransom messages. Get rid of the parasite instead.

How did I get infected with?

No one downloads ransomware infections voluntarily. That leads to the aggravating conclusion this virus used stealth to get installed. For example, it might have been attached to a spam email. Another popular technique involves spam messages from unknown senders. Always pay attention to what you click open as it could be corrupted. Keep an eye out for potential threats and take your time. Delete the emails you find suspicious. You will thank yourself later on. Also, ransomware travels the Web in illegitimate freeware/shareware bundles. Stay away from unverified programs and websites to prevent installation. The parasite might also use the help of a Trojan horse. That means you must make sure there aren’t more infections on board. Ransomware gets spread via torrents, third-party pop-ups, fake program updates, etc. Long story short, these parasites have various techniques to choose from. It’s your responsibility and yours only to protect your safety on time. Don’t overlook any cyber pest.

Why is Last_centurion@aol.com dangerous?

As mentioned, this program holds your files hostage. It demands a certain sum of money in Bitcoin (online currency). Ransomware is among the most popular infections out there for a reason. These viruses are extremely effective when it comes to scamming gullible PC users. Remember that hackers are the ones who created this program. Paying the ransom is simply not an option. You would be making a deal with cyber criminals. And, to put it mildly, they aren’t particularly honorable people. In the worst case scenario (which isn’t rare), your computer remains infected after payment. Your files remain unreadable. Furthermore, your money is gone. Do yourself a favor and don’t believe the parasite’s lies. This pest of a program is aiming directly at your bank account. Hence, you have no reason whatsoever to follow hackers’ instructions. Apart from anything else, ransomware also serves as a back door to other infections. You see, the sooner you uninstall this sneaky intruder, the better. To do so manually, please follow our comprehensive removal guide down below.

Last_centurion@aol.com Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover Last_centurion@aol.com Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with Last_centurion@aol.com encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate Last_centurion@aol.com encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.