.mich Files Virus (LockCrypt Ransomware) – Restore Data + Remove It

.mich Files Virus (LockCrypt Ransomware) – Restore Data + Remove It

This article has been created in order to explain what is .mich files virus and how to remove it from your computer, plus how to restore .mich encrypted files.

The .mich files virus is a new variant of the LockCrypt ransomware, whose primary goal is to encrypt the files on your computer and then ask victims to pay ransom to get them to work again. The virus sets the .mich file extension to all of the files it encrypts and may also drop a ransom note with information on how to pay the ransom, likely in BitCoin or other cryptocurrencies. If your computer has been infected by the .mich files virus, we advise you to read this article and learn more about this malware and how to remove it from your computer plus how to restore files that have been encrypted on your computer without having to pay ransom.

Threat Summary

Name.mich Files Virus
TypeRansomware, Cryptovirus
Short DescriptionA variant of LockCrypt ransomware. Aims to encrypt the files on your PC and then ask you to pay ransom to get them back.
SymptomsThe files are encrypted with the .mich file extension added to them as a suffix.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .mich Files Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .mich Files Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.mich Files Virus – How Does It Infect

Similar to the previous variant of LockCrypt ransomware which used brute-forcing attacks, this version of the virus may be spread via exploits that utilize RDP (Remote Desktop Protocol) on the victim’s computer. These exploits take advantage of:

  • Weak passwords and lack of two-factor authentication for RDP access.
  • The allowing of incoming RDP connections from any IP address on the net.
  • Users usually login after a lot of failed login attempts, instead of being locked out.

According to reports, the previous versions of LockCrypt ransomware were also reported to be connected to Satan ransomware in some way, which is the result of a virus that is advertised as an RaaS (Ransomware-as-a-service).

The main methods via which such malicious files may be delivered onto servers and computers are via web links or files. Such objects can be encountered in multiple different types of locations, the crooks use to get inexperienced victims to click on, such as:

  • Malicious e-mail attachments or fake buttons that often imitate big companies or organizations.
  • Malicious files, posing as legitimate installers, setup wizards, cracks, key generators, patches or other license activators for software.
  • Malicious browser redirects to the infection URL as a result of the victim having adware or other forms of PUPs that cause browser redirects without any consent.

LockCrypt .mich Virus – Activity

Once the .mich files ransomware has already infected your computer, the malware may begin to drop it’s malicious payload files. These files are primarily malicious modules that perform different activities without you even realizing it. They are often randomly named and may reside in the following Windows directories:

  • %AppData%
  • %Local%
  • %LocalLow%
  • %Roaming%
  • %Temp%

Once the files are dropped, the .mich files variant of LockCrypt ransomware may perform different unwanted activities on the victim’s computer among which may be to modify the Windows Registry sub-keys by adding custom value entries with data In them. This data may point to the actual location of the malicious files, especially if the value entries have the following locations:


In addition to this, the .mich ransomware may also make sure that the shadow volume copies on your computer are permanently gone, so that you cannot recover the files in it without these copies. The .mich variant of LockCrypt(https://sensorstechforum.com/remove-lockcrypt-ransomware-restore-1btc-files/), may use the following types of commands as an administrator in Windows Command prompt to delete the copies and disable system recovery:

→ bcdedit /set bootstatuspolicy ignoreallfailures
bcdedit /set recoveryenabled No
bcdedit /set {default} bootstatuspolicy ignoreallfailures
bcdedit /set {default} recoveryenabled No
vssadmin delete shadows /for={volume} /oldest /all /shadow={ID of the Shadow} /quiet

After this has been done, .mich files virus may drop a .txt file containing it’s ransom note, which gave 24 hours deadline to pay for the decryption of your files in BitCoins via writing to anonymous e-mail.

.mich Files Virus – Encryption Information

In order to encrypt the files on the infected computer, Mich ransomware is very careful not to encrypt files in the important Windows directories that may damage the functioning of your PC. Other than that, the .mich version of LockCrypt may scan for the following list of files to encrypt them:

→ .incpas, .mp4, .pab, .st6, .sas7bdat, .wmv, .backup, .drf, .ibank, .3ds, .odg, .cer, .tif, .cs, .dotx, .7z, .png, .bak, .ibz, .db3, .pbl, .3fr, .dxf, .nk2, .bkp, .mdf, .svg, .xlm, .3dm, .pct, .java, .pot, .sxi, .ibd, .sxw, .pspimage, .ppt, .kbx, .ppsm, .ndd, .txt, .pdb, .say, .backupdb, .fla, .swf, .asx, .accdt, .mp3, .ycbcra, .erf, .cr2, .pfx, .potx, .qby, .sqlite, .blend, .class, .pat, .odp, .gray, .qbw, .tib, .thm, .htm, .mos, .rm, .key, .std, .tlg, .lua, .pst, .sqlitedb, .grey, .cdr4, .dc2, .ce1, .ps, .tex, .eml, .xlam, .pages, .st8, .jar, .st7, .potm, .sdf, .db-journal, .pcd, .aspx, .rwl, .kpdx, .fmb, .xlr, .gry, .kc2, .oil, .moneywell, .xlk, .sti, .accdr, .oth, .c, .xml, .nd, .mdb, .pem, .erbsql, .bpw, .ffd, .ost, .pptm, .dwg, .zip, .qbm, .cdx, .des, .dng, .pdd, .cfp, .nyf, .cgm, .sldm, .xla, .odf, .raf, .crw, .mef, .raw, .x11, .nsd, .fff, .design, .dcs, .ptx, .al, .ns2, .bik, .back, .accdb, .nwb, .cpi, .ads, .odt, .sqlite3, .docm, .drw, .pl, .nx2, .fpx, .rdb, .otp, .msg, .accde, .agdl, .php, .csv, .py, .rtf, .ach, .sda, .ddd, .asf, .dotm, .cmt, .h, .hbk, .xlsx, .s3db, .tga, .wav, .iif, .dxb, .sql, .db, .sd0, .bgt, .djvu, .jpg, .doc, .craw, .mpg, .sxd, .kdc, .jpeg, .psafe3, .flac, .dtd, .act, .qba, .vob, .cdrw, .eps, .bkf, .mdc, .rar, .mov, .cdf, .m4v, .ab4, .bank, .pps, .cib, .dot, .dgc, .exf, .flv, .xlsb, .ddrw, .adb, .srw, .plc, .csh, .xls, .fxg, .otg, .pas, .xlt, .indd, .rwz, .xltx, .apj, .stw, .xltm, .orf, .ott, .qbb, .max, .cls, .obj, .docx, .dcr, .cdr3, .qbx, .pdf, .nef, .ots, .srt, .ddoc, .rat, .phtml, .m, .dbx, .nxl, .avi, .p12, .awg, .dbf, .ns3, .mmw, .prf, .wallet, .rw2, .jin, .odc, .qbr, .ppsx, .ns4, .wpd, .wps, .nsh, .dxg, .fhd, .dac, .wb2, .nrw, .odb, .ait, .jpe, .odm, .sldx, .fdb, .acr, .war, .oab, .sxc, .cpp, .r3d, .hpp, .asm, .st5, .stx, .xis, .dds, .xlsm, .p7c, .cdr5, .3g2, .mrw, .sr2, .html, .cdr, .idx, .st4, .bdb, .kdbx, .nsg, .der, .ods, .myd, .nop, .ppam, .pptx, .yuv, .xlw, .mfw, .nsf, .csl, .php5, .p7b, .crt, .asp, .srf, .jsp, .cdr6, .sxm, .iiq, .3gp, .ce2, .arw, .bay, .ai, .sxg, .psd, .3pr, .fh, .pef, .x3f, .sik, .bpp, .vmdk, .spi, .bup, .cvt, .bb, .fkc, .tjl, .dbk, .swp, .fb, .vib, .dtb, .bke, .old, .bkc, .jou, .rpb, .abk, .sav, .bkn, .tbk, .fbw, .vrb, .spf, .bk, .sbk, .umb, .ac, .vbk, .wbk, .mbk

Extensions list Source: Bleeping Computer

Each of the files which becomes encrypted starts carrying the .mich file extension to it, and may appear like the following:

Remove .mich Files Virus and Restore Encrypted Files

In order for you to make sure that this ransomware virus is permanently gone from your computer, you can go ahead and follow the removal instructions for .mich files virus we have prepared underneath this article. They are divided in manual or automatic removal methods. If manual removal is something you do not feel confident in doing, security experts strongly recommend downloading and running a scan of your PC by using an advanced anti-malware software. It’s primary purpose is to completely secure your PC and protect it against future malware infections as well.

If you want to restore files that have been encrypted by .mich files virus, we recommend that you follow the alternative methods for file recovery underneath. Located In step “2. Restore files encrypted by .mich Files Virus” ,they may not be 100% guarantee you will be able to restore all your data, but may help you recover as many files as possible. We will keep track of this virus, since it’s previous variants were decryptable, this is why we recommend that you check up on this article often as we will update it when new information becomes available.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share