PedCont Ransomware – How to Remove and Restore Your Files

PedCont Ransomware – How to Remove and Restore Your Files

This article as been created in order to help explain what is the PedCont ransomware virus and how to remove this malware from your computer plus how to restore files, encrypted by it.

The PedCont ransowmare is a virus which claims to encrypt the files on your computer, making them no longer usable after which the malware starts to encrypt the files on your computer. In addition to this, the ransomware also leaves behind a ransom note file, whose primary purpose is to get victims to pay a hefty ransom in order to get the encrypted files to work once again. If your computer has been infected by the PedCont ransomware virus, keep reading this article. It will show you how you can remove this ransomware infection from your computer and how you can restore the files, encrypted by it on your computer.

Threat Summary

NamePedCont Ransomware
TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on your computer, while dropping a ransom note which asks you to pay a hefty ransom to get the files recovered back to normal.
SymptomsFiles may no longer be able to be opened and a ransom note appears on the user’s computer, shortly after the screen of the victim goes black.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by PedCont Ransomware


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss PedCont Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Pedcont Ransomware – Distribution

The PedCont ransomware virus is the type of malware, whose primary purpose is to infect you unnoticed and conduct it’s activities without you being able to stop the virus. To reach this end goal, the ransomware virus may perform series of unwanted activities on the victim’s computer, the main of which are reported to be via malicious e-mail attachments or URLs posted on the e-mails themselves. The e-mails that may be sent to the victims may aim to get them to open the attachments, while portraying them as important documents, such as invoices as well as other documents that must be opened immediately.

In addition to via e-mail, the PedCont ransomware virus may also spread by being uploaded on websites, while posing as a file which claims to be a seemingly legitimate type of software installer or some kind of a software license activator, whose main goal is to claim to help you activate your OS, a game or a program.

PedCont Ransomware – More Information

As soon as PedCont ransomware has infected your computer system, the virus may drop it’s payload files, which in their turn may reside in the following Windows directories:

  • %AppData%
  • %Local%
  • %LocalLow%
  • %Roaming%
  • %Temp%

Among the payload of PedCont ransomware is it’s main malicious file, detected(4ee60e0221726dbbe2da563c4d175b57d7b51e9e83e2c4b78364fba2272121c2) by security researchers to be the following:

→ SHA-256: 4ee60e0221726dbbe2da563c4d175b57d7b51e9e83e2c4b78364fba2272121c2
Name: AliceRides.mp4_Unpack.WinRAR_SFX.scr
Size:539 KB

From the file it appears as it is posing as a legitimate screensaver, however it contains an embedded self extracting archive.

Related:How to Check SFX Self-Extracting .exe Archives Online

In addition to this, among the files dropped by this virus is also it’s ransom note type of file, whose primary purpose is to get victims to pay a hefty ransom fee in order to recover their files. The ransom note appears like the following:

Text from image:

ATTENTION H! – Please read this immediately:

Dear potential criminal,

Due to you actively seeking out child pornography or similarly illegal content on the
Deep Web, you have been infected with our ransomware called PedCont.


All of your sensitive data, location and files – pictures, videos, documents, etc. – have
been auto-collected and saved to an external server and will be stored & protected for
the next 72 hours (counting from the first time you see this message). If we do not
receive any cooperation from your part once the time is up, international authorities
WILL be contacted and sent detailed information about everything that we have
scraped from your computer.

While it is no longer necessary for this program to stay on your computer, should you
wish to prevent legal prosecution and safely get rid of our records, do NOT manually
remove it, but instead follow the steps listed below:


In addition to this, the ransomware virus also aims to perform series of other unwanted activities on the victim’s computer, such as extract informtion from it in order to check whether or not it is running in a virtual environment. In addition to this, the ransomware infection may also delete the volume shadow copies from the victim’s computer, preferrably by executing a script. This script makes it possible to run Windows Command Prompt as an administrator and then focus on performing various different types of methods and activities on the user’s computer

PedCont Ransomware – Encryption Process

PedCont ransomware has been classified as a destructive ransomware type by cyber-sec researchers( with allegations that the ransomware aims to delete the display drivers on the computers infected by it and allegedly encrypting the important files on the victim’s cpomputer. The encryption process of PedCont ransomware virus is conducted by firstly checking for the types of files that are targeted for encryption, which are usually often used file types, such as:


After this is done, the files on the computer that has been infected are no longer openable and the victim is accused of performing online crime. The only way ot seems to be following the instructions and paying the ransom, which is highly inadvisable.

Remove PedCont Ransomware and Restore Encrypted Files

If you have unfortunately been infected by PedCont ransomware virus, we advise that you read the manual and automatic instructions underneath in order to learn ow to remove this malware from your computer. If manual removal of this threat does not seem to work out for you, we recommend that you remove it automatically, preferrably by downloading and running a scan with an advanced anti-malware software, as most security experts recommend. Such program will make sure to remove PedCont ransomware automatially from your computer and make sure to ensure that future protection is guaranteed as well.

If you want to restore files that have been encrypted by this ransomware infection, we advise that you try out the alternative methods underneath in step “2. Restore files, encrypted by PedCont” ransomware. They are in no way 100% guarantee to be able to recover all of your files, but with their aid you may be able to recover most of the encrypted files.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share