A ransomware Trojan, Threat Finder encrypts the files on the compromised machine, locks the computer and demands a $300 fee in order to restore the encrypted data. Experts suggest that the currently spread version Threat Finder v4.2 is a copy of the infamous CryptoLocker ransomware. Threat Finder applies the same timer that gives the victim a four-day-period to pay the fine, or it threatens to delete the files permanently. To put more pressure on the user, Threat Finder even displays an exact date when the private key needed for the encryption of the files will be eliminated.
Threat Finder Ransomware – Distribution and Infection
Threat Finder is usually distributed via email attachments or drive-by downloads from corrupted websites. The infection can also be delivered to machines that are a part of certain botnets. Cyber crooks are also known to use social engineering as a distribution method, for example, posts with corrupted links on social platforms like Twitter or Facebook. Just through one click the infection will be downloaded to the targeted computer and exploit weak spots in the affected computer’s security.
For the file-encrypting process Threat Finder uses RSA 2048 cryptosystem.
Threat Finder – The Ransom
Detailed information about the payment options is displayed in the ransom message in quite a simple way for everyone to understand. The fee is to be paid via MoneyPak or BitCoin, and the victim is provided with instructions on how to pay via each of the both services. Naturally, the whole effort the attackers have put in the instructions serves one purpose only – to make the payment process as easy as possible so they can get their hand on more money.
Experts reveal that the file-encryption and the timer activated on the targeted machine are real and unfortunately, the victims have two options – to restore their files from a backup or to pay the ransom and hope that the attackers will send back the private key. This is why it is crucial for the safety of your system to backup your important data on a regular basis and to keep your AV tool up-to-date.
The ransom message displayed by Threat Finder contains the following information:
→Threat Finder v2.4
Warning! Your personal files are encrypted!
Don’t switch off your computer and/or internet, otherwise your key will be disabled
Your important files encryption produced on this computer: photos, videos, documents, etc. Here is a complete list of encrypted files, and you can personally verify this.
Encryption was produced using a unique public key RSA-2048 generated for this computer. To decrypt the files, you need to obtain the private key.
The single copy of the private key, which will allow you to decrypt the files, located on a secret server on the Internet, the server will destroy the key after a time specified in this window. After that, nobody and never will be able to restore files.
To obtain the private key for this computer, which will automatically decrypt files, you need to pay 300 USD / 300 EUR / similar amount in another currency.
Any attempt to remove or damage this software will lead to immediate destruction of the private key by the server.
What Can You Do If Your Files Were Encrypted By Threat Finder?
Malware experts advise against paying the ransom unless there are some really important files among the encrypted data. And even if you pay the fee, there is no guarantee that you will receive the private key needed for the decryption of your files. Your information can be restored with the help of Shadow Explorer and other tools designed for such operations. Follow the instructions below to remove Threat Finder and restore the encrypted files.
How to Remove Threat Finder and Restore the Encrypted Files
Stage One: Remove Threat Finder
1. First and most important – download and install a legitimate and trustworthy anti-malware scanner, which will help you run a full system scan and eliminate all threats.
Spy Hunter FREE scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool. Find Out More About SpyHunter Anti-Malware Tool
2. Run a second scan to make sure that there are no malicious software programs running on your PC. For that purpose, it’s recommended to download ESET Online Scanner.
Your PC should be clean now.
Stage Two: Restore the Encrypted Files
Option 1: Best case scenario – You have backed up your data on a regular basis, and now you can use the most recent backup to restore your files.
Option 2: Try to decrypt your files with the help of Kaspersky’s RectorDecryptor.exe and RakhniDecryptor.exe. They might help you in the process but keep in mind that they were not specially designed to encrypt information that was decrypted by this particular ransomware.
Option 3: Shadow Volume Copies
1. Install the Shadow Explorer, which is available with Windows Vista, Windows 7, Windows 8 and Windows XP Service Pack 2.
2. From Shadow Explorer’s drop down menu choose a drive and the latest date you would like to restore information from.
3. Right-click on a random encrypted file or folder then select “Export”. Select a location to restore the content of the selected file or folder.
Remove Threat Finder Automatically with Spy Hunter Malware – Removal Tool.
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter