Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove .uzltzyc Extension Ransomware and Restore Your Files

A new ransomware variant has begun to increasingly infect user PCs, encrypting their files with the .uzltzyc extenison. Since the ransomware’s behavior is familiar to another virus, some experts believe that it is a newer version of it. The believed to be malware is called CTB Locker (Critroni or Onion) ransomware. All users who have had their files encrypted with this crypto malware are advised not to pay any ransom money. This is because there is no guarantee they will get their files back and also by doing so they fund the cyber-crooks to develop further and spread the malware.

Name .uzltzyc Ransomware
Type Ransomware
Short Description The malware scans for and encrypts users’ files extorting them for money to restore the encrypted data.
Symptoms Users might encounter a ransom note on the desktop in the form of .jpg .txt or other extension.
Distribution Method Via exploit kits, malicious URLs or dangerous email attachments
Detection Tool Download Malware Removal Tool, to See If Your System Has Been Affected by .uzltzyc Ransomware
User Experience Join our forum to discuss .uzltzyc Ransomware.

encrypted files-ctb-locker-sensorstechforum

The .uzltzyc Ransomware – How Did I Get Infected

One way to become a victim of this devastating virus is to click on malicious URL web links as well as malicious email attachments. The malicious files may be concealed in archives and via obfuscators. The malicious payload usually consists of one or more files from the following file formats.

  • .exe .bat .cmd .vbs .dll .tmp

Users should also beware of exploit kits and Trojans that are used to initially infect the computer after which downloads the malware onto the user PC via a foreign host.

The .uzltzyc Ransomware In Detail

This ransomware is believed to generate an extension based on some type of mechanism when a computer has been initially infected. Once the ransomware has been downloaded it may begin to deploy various files of different character in key Windows locations:

  • %temp%
  • %AppData%
  • %Users%
  • %Windows%

The dropped files may be of several types. They may resemble an active process such as notepad.exe or svchost.exe. They might also contain random file names such as 9d23823.exe. Another possibility is that they carry a name of a program installed on the user PC.

After the files are dropped, the malware then may change Windows settings by modified the Windows Registry editor to make its malicious files run every time Windows starts. The usual key used for this is the following:

  • “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run”

After this, the ransomware may begin to scan for and immediately encrypt your important files. It looks for most types of images, documents, video files, audio files, presentations and others. What is more, the ransomware may even have the ability to scan and encrypt files in flash or other external drives connected to the user PC.

After encrypting the files it leaves a ransom note, notifying the user that the files are encoded with a strong encryption algorithm and further scaring him that he should pay a large sum of money in BTC, most likely via onion networking (Tor). They may feature randomly generated email addresses that have the .onion domain extension on them to protect their privacy during the extortion process.

Remove .Uzltzyc Ransomware and Restore the Encrypted Files

Fortunately, you can remove this ransomware completely without affecting any of your files. All that is advisable is to copy the encrypted files elsewhere just in case and then run a scan with advanced anti-malware software that also specializes in removing ransomware Trojans. It is recommended to isolate the threat first by scanning while offline or in safe mode, instructions for which are provided hereinafter.

1. Boot Your PC In Safe Mode to isolate and remove .uzltzyc Ransomware
2. Remove .uzltzyc Ransomware with SpyHunter Anti-Malware Tool
3. Back up your data to secure it against infections and file encryption by .uzltzyc Ransomware in the future
4. Restore files encrypted by .uzltzyc Ransomware
Optional: Using Alternative Anti-Malware Tools
NOTE! Substantial notification about the .uzltzyc Ransomware threat: Manual removal of .uzltzyc Ransomware requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.