Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


.CryptoShield 2.0 Virus (Restore Files)

Article created to help you remove the 2.0 version of CryptoShield ransomware and restore AES encrypted files with an added .CRYPTOSHIELD file extension.

A ransomware virus, that came out in 2 versions back in January 2017, named CryptoShield, has reappeared. The virus has a ransom note that imitates one of the most notorious viruses out there – CryptoWall. It came out in 1.0 and 1.1 versions and was distributed by a very dangerous exploit kit and distribution malware. The new version does not step away from this tendency. Since this ransomware virus aims only to encrypt the files on the computers it infects to ask for money to get them back, we advise you to read this article carefully. It will help you remove CryptoShield 2.0 ransomware and restore .CRYPTOSHIELD encrypted files.

Threat Summary

Name

CryptoShield 2.0

TypeRansomware
Short DescriptionEncrypts the files on the computers it infects and then drops a ransom note, asking to pay a hefty sum to get the files back.
SymptomsEncrypts files via the AES cipher, leaving the .CRYPTOSHIELD file extension and changing their names to an e-mail and random symbols. Then drops ransom note files, named # RESTORING FILES #.txt and # RESTORING FILES #.html in which, the ransom instructions are written.
Distribution MethodVia an Exploit kit, Dll file attack, malicious JavaScript or a drive-by download of the malware itself in an obfuscated manner.
Detection Tool See If Your System Has Been Affected by CryptoShield 2.0

Download

Malware Removal Tool

User ExperienceJoin our forum to Discuss CryptoShield 2.0.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

CryptoShield 2.0 Ransomware – More Information

CryptoShield Is a ransomware virus that encrypts files, rendering them no longer openable until a hefty ransom fee is paid to the cyber-criminals. The virus came out in 1.0 and 1.1 versions earlier this year.

CryptoShield 2.0 Ransomware – How Does It Infect

The infection of CryptoShield 2.0 ransomware is conducted in combination with the 4th version of RIG Exploit Kit. The exploit kit has also been reported to spread other notorious ransomware viruses such as Locky, Cerber, Spora and Sage 2.0 ransomware viruses.

This exploit kit is embedded in a malicious executable, which is sent to unsuspecting users’ e-mails in the form of spam message. Such messages may contain a malicious e-mail attachment, which may be a malicious file type, like one of the following:

→ ‘sys’,’shs’,’wmf’,’chm’,’wmf’,’ozd’,’ocx’,’aru’,’xtbl’,’bin’,’exe1′,’386′,’dev’,’xnxx’,’vexe’,’tps’,’pgm’,’php3′,’hlp’,’vxd’,’buk’,’dxz’,’rsc_tmp’,’sop’,’wlpginstall’,’boo’,’bkd’,’tsa’,’cla’,’cih’,’kcd’,’s7p’,’smm’,’osa’,’exe_renamed’,’smtp’,’dom’,’vbx’,’hlw’,’dyz’,’rhk’,’fag’,’qrn’,’fnr’,’dlb’,’mfu’,’xir’,’lik’,’ctbl’,’dyv’,’bll’,’bxz’,’mjz’,’mjg’,’dli’,’fjl’,’ska’,’dllx’,’tti’,’upa’,’txs’,’wsh’,’uzy’,’cfxxe’,’xdu’,’bup’,’spam’,’nls’,’iws’,’ezt’,’oar’,’.9′,’blf’,’cxq’,’cxq’,’cc’,’dbd’,’xlv’,’rna’,’tko’,’delf’,’ceo’,’bhx’,’atm’,’lkh’,’vzr’,’ce0′,’bps’,’pid’,’hsq’,’zvz’,’bmw’,’fuj’,’ssy’,’hts’,’qit’,’aepl’,’dx’,’lok’,’plc’,’mcq’,’cyw’,’let’,’bqf’,’iva’,’xnt’,’pr’,’lpaq5′,’capxml’

There may also be documents with malicious macros, like Microsoft Office or Adobe files. These may cause an infection when the user opens them and clicks on the “Enable Content” button. Usually, such ransomware infections are caused primarily because of deceitful messages, such as a fake notification, from PayPal claiming the user’s invoice for a purchase is in the attachment.

Once the attachment is opened, the infection process commences. It consists primarily of various different scripts, and connects to a remote distribution website to download the payload of CryptoShield 2.0. The payload of this virus consists of multiple files that it drops on the computer of the victim:

# RESTORING FILES #.txt
# RESTORING FILES #.html
rad93DD5.tmp.exe
CryptoShield.tmp.exe
net1.exe
net.exe
{random}.exe
{random}.tmp.exe
{random}.temp
recovery.js.tmp
recovery.js
%ALLUSERSPROFILE%\MicroSoftTMP\system32\conhost.exe
To download these files, the virus may remotely connect to the following locations:
107.191.62.136:80
107.191.62.1107.191.62.136:8036/js/prettyPhoto/images/prettyPhoto/default/infromation.php

CryptoShield 2.0 Ransomware – Post-Infection Activity

In addition to this CryptoShield 2.0 Ransomware also performs multiple different commands on the computer of the user to disable data recovery procedures and delete shadow backups on the user’s PC.

→ cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
{DRIVE}:\Windows\System32\cmd.exe” /C vssadmin.exe Delete Shadows /All /Quiet
{DRIVE}:\Windows\System32\cmd.exe” /C net stop vss

The virus also adds itself automatically on the startup of the system and after it’s encryption module is started, it begins to encipher the files on the compromised computer. To encrypt files, CryptoShield 2.0 uses the same AES encryption mode and the virus attacks:

  • Microsoft Office documents.
  • Pictures.
  • Audio files.
  • Videos.
  • Adobe PDF files.
  • Virtual Images.
  • Archive file types.

After the encryption process has completed, the ransomware virus leaves the files modified with a random id plus the file extension .CRYPTOSHIELD. The encoded files look like the following:

After encrypting the files on the compromised computer, CryptoShield 2.0 ransomware makes sure that the user is known of it’s presence on the computer. This is achieved by dropping multiple files on the computer, called # RESTORING FILES #.txt and # RESTORING FILES #.html. They have similar content:

The instructions themselves ask to contact an e-mail with a personal identification and from there the cyber-criminals most likely provide a Tor-based website or a BitCoin address for the ransom payoff.

CryptoShield 2.0 Ransomware – Remove and Restore .CRYPTOSHIELD Files

In order to remove this file encryption virus from your computer, recommendations are to focus on following the instructions for the removal below. They are carefully designed to assist in the removal of CryptoShield 2.0 ransomware by following methodological steps. For maximum effectiveness, or If you do not have experience in manual malware removal, experts often advise using an advanced anti-malware program, which will make sure that the removal of CryptoShield 2.0 ransomware is full.

After having removed this virus, do not try to tamper with the files in any way. The first thing you should do is to back up your encrypted data. This will allow you to try using copies of them in combination with the alternative data recovery tools below in step “2. Restore files encrypted by CryptoShield 2.0”. They are carefully designed to help you recover at least some of the files, but are not entirely effective, so we take no responsibility of the outcome.

Manually delete CryptoShield 2.0 from your computer

Note! Substantial notification about the CryptoShield 2.0 threat: Manual removal of CryptoShield 2.0 requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove CryptoShield 2.0 files and objects
2.Find malicious files created by CryptoShield 2.0 on your PC

Automatically remove CryptoShield 2.0 by downloading an advanced anti-malware program

1. Remove CryptoShield 2.0 with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by CryptoShield 2.0
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.