Remove Supportfriend@india.com Ransomware

How to Remove Supportfriend@india.com Ransomware?

Reader recently start to report the following message being displayed when they boot their computer:

ALL YOUR FILES ARE ENCRYPTED
TO DECRYPT WRITE ON THE MAIL supportfriend@india.com
DECRYPTION PRICE INCREASES EVERY 24 HOURS

 

If you didn’t know this already, hackers are not your friends. That means despite its amicable name, the Supportfriend@india.com email address must be avoided. It will contact you directly with dangerous, unpredictable cyber criminals. Why would you want to contact them in the first place? Keep on reading to find out. Now, what’s currently on your PC is a version of the Crysis Ransomware. A brand new version, to be exact. Ransomware is among the most popular types of parasites you could come across online. Not to mention that it’s among the most destructive infections out there. There’s a reason for ransomware’s immense popularity. As you could imagine, hackers constantly aim for gaining profit. And when it comes to gaining revenue, ransomware is a virus like no other. It offers crooks an easy, effective method to blackmail PC users. You’re dealing with a particularly harmful and tricky program. Its shenanigans begin as soon as your computer gets compromised. The parasite firstly performs a scan. This way it manages to find all your personal files. We’re talking pictures, music, MS Office documents, videos, presentations, etc. Ransomware takes down a huge variety of file formats. As a result, all your personal information falls victim to the virus. What this pest actually does is, it changes the format of your files. You probably noticed a Supportfriend@india.com.xtbl extension that the ransomware adds. This appendix also includes a random combination of characters – your ID. All files that have been renamed are now inaccessible. Your computer is unable to recognize their new format so you’re unable to use them. Quite upsetting, don’t you think? The virus locks your own data and keeps it hostage. That’s not even the worst part. While encrypting, this program also creates detailed payment instructions. You will find these .txt files in all  folders that contain locked information. Obviously, that’s a lot of folders. Hackers offer you a deal. You might pay a certain sum of money in bitcoins or have your files locked forever. Needless to say this is nothing but a nasty attempt for a cyber scam. Crooks promise a decryptor in exchange for your money. However, there’s no guarantee you would receive anything after you pay. More often than not, crooks simply ignore their victims. Do the right thing and keep your bitcoins.

How did I get infected with?

The most commonly used infiltration method involves spam emails. Yes, crooks sometimes send infections straight to your inbox. Clicking a corrupted email open will automatically set the parasite free. How do you prevent this? Don’t click. Instead, delete what you don’t trust and avoid messages from unknown senders. Some viruses might pretend to be software updates or torrents. Another popular technique is freeware/shareware bundling. Ransomware may get spread online with the help of a Trojan horse. As you can clearly see, these infections have various ways to compromise computers. Hackers could be very creative people when it comes to distributing malware. To protect your PC, always watch out for potential parasites. You might infect your device without even knowing it so make no mistake. Last but not least, stay away from unverified bundles and websites as well. Those are usually corrupted and dangerous.

Why is Supportfriend@india.com dangerous?

Many researchers go as far as to say ransomware is the worst infection out there. These programs not only work in complete silence but they also lock all your personal data. They leave your precious files encrypted and practically useless. The program you’re now stuck with is no exception. By using a strong encrypting algorithm, this pest denies you access to your files. As you could imagine, some incredibly important files could get encrypted too. As if that wasn’t enough, the ransomware also plays mind games with you. Hackers are trying to get you to panic so you have to ignore all the ransom notes you see. Remember, you’re dealing with greedy and dishonest cyber crooks. Paying the money is not an option. According to the ransom messages, you will receive a decryption key after payment. As mentioned already, though, you won’t receive anything. Crooks are trying to scam you and steal your money. That is why they locked your files to begin with. Ransomware is an attempt for a fraud so the last thing you do should be paying the ransom. To delete this infection manually, please follow our detailed removal guide down below.

Supportfriend@india.com Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover Supportfriend@india.com Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with Supportfriend@india.com encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate Supportfriend@india.com encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.