A new ransomware variant has begun to increasingly infect user PCs, encrypting their files with the .uzltzyc extenison. Since the ransomware’s behavior is familiar to another virus, some experts believe that it is a newer version of it. The believed to be malware is called CTB Locker (Critroni or Onion) ransomware. All users who have had their files encrypted with this crypto malware are advised not to pay any ransom money. This is because there is no guarantee they will get their files back and also by doing so they fund the cyber-crooks to develop further and spread the malware.
|Short Description||The malware scans for and encrypts users’ files extorting them for money to restore the encrypted data.|
|Symptoms||Users might encounter a ransom note on the desktop in the form of .jpg .txt or other extension.|
|Distribution Method||Via exploit kits, malicious URLs or dangerous email attachments|
|Detection Tool||Download Malware Removal Tool, to See If Your System Has Been Affected by .uzltzyc Ransomware|
|User Experience||Join our forum to discuss .uzltzyc Ransomware.|
The .uzltzyc Ransomware – How Did I Get Infected
One way to become a victim of this devastating virus is to click on malicious URL web links as well as malicious email attachments. The malicious files may be concealed in archives and via obfuscators. The malicious payload usually consists of one or more files from the following file formats.
- .exe .bat .cmd .vbs .dll .tmp
Users should also beware of exploit kits and Trojans that are used to initially infect the computer after which downloads the malware onto the user PC via a foreign host.
The .uzltzyc Ransomware In Detail
This ransomware is believed to generate an extension based on some type of mechanism when a computer has been initially infected. Once the ransomware has been downloaded it may begin to deploy various files of different character in key Windows locations:
The dropped files may be of several types. They may resemble an active process such as notepad.exe or svchost.exe. They might also contain random file names such as 9d23823.exe. Another possibility is that they carry a name of a program installed on the user PC.
After the files are dropped, the malware then may change Windows settings by modified the Windows Registry editor to make its malicious files run every time Windows starts. The usual key used for this is the following:
After this, the ransomware may begin to scan for and immediately encrypt your important files. It looks for most types of images, documents, video files, audio files, presentations and others. What is more, the ransomware may even have the ability to scan and encrypt files in flash or other external drives connected to the user PC.
After encrypting the files it leaves a ransom note, notifying the user that the files are encoded with a strong encryption algorithm and further scaring him that he should pay a large sum of money in BTC, most likely via onion networking (Tor). They may feature randomly generated email addresses that have the .onion domain extension on them to protect their privacy during the extortion process.
Remove .Uzltzyc Ransomware and Restore the Encrypted Files
Fortunately, you can remove this ransomware completely without affecting any of your files. All that is advisable is to copy the encrypted files elsewhere just in case and then run a scan with advanced anti-malware software that also specializes in removing ransomware Trojans. It is recommended to isolate the threat first by scanning while offline or in safe mode, instructions for which are provided hereinafter.