.Encrypted5 Files Virus - How to Remove It
THREAT REMOVAL

.Encrypted5 Files Virus – How to Remove It

This article has been created in order to explain what is the .Encrypted5 files virus and what can you do to remove it completely from your computer.

New ransomware virus using the .Encrypted5 file extension which it ads to the computers of victims has been recently detected. The ransomware aims to encrypt files on the computers infected by it and then extort victims to pay ransom in order to get their files to work once more. In the events that your computer system was infected by the .Encrypted5 ransomware, we suggest that you read this article.

Threat Summary

Name.Encrypted5
TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on your infected machine and then add the .Encrypted5 file extension to them. The ransomware may also
SymptomsFiles cannot be opened and have the .Encrypted 5 file extension added to them.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .Encrypted5

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .Encrypted5.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.Encrypted5 Ransomware – Distribution Methods

The is more than one way via which this ransomware could have spread onto your computer. For starters, one method is to send victims direct e-mail messages that aim to get them to open the malicious attachments in those e-mails. These malicious attachments aim to convince victims that they are documents of utmost importance, like invoices, money taken from the victim’s PayPal, cancelled tickets, documents from the victim’s bank or even work-related e-mails.

Furthermore, in addition to this, the .Encrypted5 ransomware may also have its infection files uploaded on websites, where they might pose as cracks, patches or other license activators. Another possibility is also for the files themselves to exist in torrent websites, where the files themselves may pose as setups of programs or portable versions of different types of software.

.Encrypted5 File Ransomware – More Information

Once the .Encrypted5 ransomware has already infected your computer, the virus may drop it’s malicious payload onto the following Windows directories:

  • %AppData%
  • %Local%
  • %LocalLow%
  • %Temp%
  • %Roaming%

Once the files are already dropped on your computer, the ransomware may then make sure to delete the shadow copies on your PC by escalating it’s privileges and injecting a script which runs the following Windows Command Prompt commands:

→ sc stop VVS
sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
sc stop WerSvc
cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe” /C vssadmin.exe Delete Shadows /All /Quiet

Once the .Encrypted5 file ransomware has done this, the virus may perform the following activities on the computers, infected by it:

  • Create mutexes.
  • Copy your system information.
  • See your language and region settings.
  • Obtain location data.
  • Use network POST traffic to communicate to it’s C&C servers.

In addition to this, the .Encrypted5 files virus may also modify the following registry sub-keys in Windows:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveTimeOut
HKEY_CURRENT_USER\Control Panel\Desktop

The encryption performed by the .Encrypted5 ransomware may follow the dropping of a ransom note file, which could either be an offline web page or a .txt file.

.Encrypted5 Ransomware – Encryption Process

In order to encrypt files on your computer, the .Encrypted5 file ransowmare may first scan for documents, images, videos, archives and other types of often used files an encrypt them based on their file extensions. The virus may look for the following file types:

→ “PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX .INI .PRF .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”

After the files are encrypted, they may be locked with an advanced encryption algorithm, that may be among one of the following:

  • AES.
  • RSA.
  • Salsa20.
  • TEA.

When the .Encrypted5 ransomware virus locks your files, the ransomware may then add it’s distinctive file suffix, making the files starting to appear like the following:

Remove .Encrypted5 Ransomware and Try and Restore Your Files

If you want to remove this ransomware virus, we would advise that you follow the removal instructions underneath this article. They have been divided in manual and automatic removal manuals, with the main goal to help you based on the situation you are in. If you fail to remove the .Encrypted5 ransomware manually, we suggest what most cyber-security experts would – to download an anti-malware program and perform a scan on your computer with it in order to automatically contain the situation and delete all of the malicious files, related to this ransomware.

If you want to try and restore files, encrypted by this virus, we would recommend that you give the file restore methods in the accordion below a try. They may not be a 100% solution to your problems, but with their aid, you might be able to restore at least some of your files.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...