Remove Thedon78@mail.com Ransomware Virus

How to Remove Thedon78@mail.com Ransomware?

Readers recently started to report the following message being displayed when they boot their computer:

All of your files are encrypted, to
decrypt them write me to
Thedon78@mail.com
Your key:

Ransomware is probably the most dangerous thing out there. Sadly, it is also the most popular type of cyber infection right now. You see, ransomware allows hackers to gain effortless profit by blackmailing gullible PC users. Every hacker’s dream is making easy money online. That means they will not be giving up on ransomware-type viruses any time soon. Why are we telling you all that? Because you’ve accidentally installed a ransomware program. The infection is called FenixLocker and it’s just as devastating as all the other file-encrypting parasites. For one thing, it relies on your distraction to get installed. Then it uses the complicated AES encrypting algorithm to lock files. Funnily enough, FenixLocker’s latest variant does not encrypt .exe files. It locks all the other file formats, though. Pictures and music and videos and documents… Consider them gone. As soon as the ransomware lands on board, it performs a scan. That way it locates your private data. FenixLocker takes down a huge variety of formats and surely creates a mess. Thanks to its encrypting cipher, you’re now unable to use your files. Your very own files stored on your own computer. Yes, hackers dare to go after your precious data. That is because most people would give anything to restore their information. Eventually, they get scammed. It’s quite obvious why crooks seem to be loving ransomware lately. File-encrypting infections try to involve you in a nasty cyber fraud so keep that in mind. While locking your files, the FenixLocker Ransomware also drops ransom notes. After all, the virus isn’t named “ransomware” for no reason. You will see the Help to decrypt.txt files in all folders that contain locked data. In addition, the ransom messages get added to your desktop wallpaper. As a result, you cannot get rid of the parasite’s ransom notes. That is because hackers are playing mind games with you. In their ransom notes you’ll see the Thedon78@mail.com email address. You’re supposed to contact hackers and receive further instructions. Despite being laconic, the ransom note is pretty straightforward. Unless you pay a certain ransom, your private files will remain inaccessible. However, keep in mind that ransomware is nothing but an online scam. Setting your data free was never really part of the picture. Stealing your money, on the other hand, is.

How did I get infected with?

This program didn’t seek your permission to get installed. And yet, there it is on your computer. You may already know that infections apply sneaky techniques to get spread. Number one method involves spam email-attachments. This tactic is a perfect combination of stealthy and efficient. Hackers rely on your curiosity and present malware as safe emails. For example, ransomware may be disguised as a job application. Another possibility is a fake email from some shipping company. Be very careful what you click open. Unless you’re willing to compromise your device, pay attention. Delete anything you don’t trust and put your safety first. Remember, the Internet is full of potential infections. It is your responsibility and yours only to prevent malware installation. Do not overlook the threats hackers constantly work on. Stay away from unverified websites, program updates and suspicious-looking torrents. You only need one wrong move online to cause your own device trouble. Ransomware viruses also use some help from Trojan horses. You might be having a whole bunch of sneaky parasites on your PC right now. Check out the device; better safe than sorry.

Why is Thedon78@mail.com dangerous?

Researchers successfully decrypted FenixLocker’s previous variant. There is a big change they will do it again with the new version. Hence, paying the ransom would be a terrible mistake. Hackers promise a special decryption key in exchange for your Bitcoins. However, paying the ransom guarantees you nothing because crooks don’t tend to follow the rules. Including the rules they invent. You may follow diligently hackers’ commands and still receive no decryptor. The one thing you would achieve in this scenario is becoming a sponsor of crooks. Is that something you’re aiming for online, supporting criminals’ business? We assume not. This infection messes with your files’ format and adds a malicious extension to them. It leaves your data useless. Take action as soon as possible and get rid of the virus. Restrain yourself from paying anything too. To delete the ransomware manually, please follow our detailed removal guide down below.

Thedon78@mail.com Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover Thedon78@mail.com Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with Thedon78@mail.com encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate Thedon78@mail.com encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.