A_princ@aol.com is the name of this particular ransomware crypto-virus, because it uses that email address in its ransom message. Lots of viruses from the Troldesh/Shade ransomware family have been seen in the past couple of days. This virus will put a picture with instructions on your desktop once it finishes encrypting files. The ransomware will lock files, placing a long extension ending in .xtbl behind their original one. The virus does not give a set price for decryption but leaves a contact email only. To remove the ransomware and find out how you could restore your files, you should read the whole article.
|Short Description||The ransomware encrypts files with an extension ending in firstname.lastname@example.org and leaves an email address as a contact for the supposed decryption of the files.|
|Symptoms||The ransomware will place a new picture on your desktop with instructions that point to an email address as a contact.|
|Distribution Method||Spam Emails, Email Attachments, Executable Files|
|Detection Tool|| See If Your System Has Been Affected by malware |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss email@example.com.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
A_princ@aol.com Virus – Distribution Tactics
The firstname.lastname@example.org ransomware may have several distribution tactics. Targeted attacks and spam email campaigns are certainly among the main ones. Spam emails usually contain a short message stating that the whole part of it or something important is in the file attached to the letter. The attachment in question could seem ordinary, but if you open it, the file will release the payload for the ransomware and infect your computer. Be on high alert while browsing through emails which seem suspicious, especially if they have attachments or download links.
Social media sites and services for file-sharing are another possible way of distribution for the email@example.com virus. The script with the payload could be inside executables or batch files, presented as useful utilities on the above-mentioned networks. A good advice to follow so you might prevent ransomware infecting your PC is to avoid emails, files or links which seem suspicious or of unknown origins. Also, before opening any files, check the signatures and sizes of files and possibly scan them with security software. You can find more tips about preventing ransomware infections from the topic in our forum.
A_princ@aol.com Virus – Detailed Overview
The firstname.lastname@example.org virus belongs to the Shade/Troldesh family of ransomware. These viruses are widely known to encrypt files with a long extension containing the email they use for contact and putting the .xtbl extension at the end. That is why some researchers label this as a XTBL ransomware type.
This virus is named after the email that its maker has left as a contact – email@example.com.
The ransomware will place the following file and use it as a starting point for infecting your system:
The virus will then create an executable file and probably create a registry entry, so it makes it run with each start of Windows. Other files that the ransomware will create are a text file and a picture with the instructions. Those files will remain hidden until your files get locked. After that, the virus encrypts files found on your disk drives and on storage devices you have connected.
Whenever the encryption process is done, you will see that your desktop background will have a new wallpaper and a text file, too. Both will have the name How to decrypt your files. This is what the wallpaper looks like:
The text on that image reads:
To restore information email technical support
send 3 encrypted files
The other one is a .txt file and its contents are the following:
The firstname.lastname@example.org virus does not give a particular price for the decryption of your data. No deadline is provided either. The ransomware maker has put only one email for contact, and that is what distinguishes this variant of the ransomware from others in the security world.
Do NOT contact the email@example.com email trying to negotiate a price for paying the ransom. Even if you do that, you may not get your data back. Funding cyber criminals will only give them more money to aid them in their criminal activity. As firstname.lastname@example.org is a variant of the Shade/Troldesh ransomware family, there is a way you could try to recover your files. A decryptor tool made by Kaspersky exists, and you can check it from the instructions written under this article.
The email@example.com ransomware encrypts a lot of file types. The ransomware encrypts files that have these file extensions:
→.odc, .odm, .odp, .ods, .odt, .docm, .docx, .doc, .odb, .mp4, sql, .7z, .m4a, .rar, .wma, .gdb, .tax, .pkpass, .bc6, .bc7, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum, .ibank, .t13, .t12, .qdf, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps
After all, files get encrypted, you will see that all files will have the following extension appended to them – .id-[eight digit number]-firstname.lastname@example.org.
Next, the ransomware may send some the following data to a remote location:
- Trojan ID
- Compromised computer ID
- Host name
- Email address used by the Trojan
- Number of encrypted document, archive, database, and image files
- Total number of encrypted files
The A_princ@aol.com ransomware might delete the Shadow Volume Copies from the Windows Operating System. Read further to learn how you might decrypt your files.
Remove A_princ@aol.com Virus and Restore .xtbl Files
If your computer is infected with the email@example.com ransomware, you should have some experience with removing viruses. You should get rid of this ransomware as fast as you can before it can spread deeper in the network you use and infect more files. You should remove the ransomware and follow the step-by-step instructions manual provided below. To see how you might try to recover your files, check the step titled 3. Restore files encrypted by firstname.lastname@example.org.
- Guide 1: How to Remove email@example.com from Windows.
- Guide 2: Get rid of firstname.lastname@example.org from Mac OS X.
- Guide 3: Remove email@example.com from Google Chrome.
- Guide 4: Erase firstname.lastname@example.org from Mozilla Firefox.
- Guide 5: Uninstall email@example.com from Microsoft Edge.
- Guide 6: Remove firstname.lastname@example.org from Safari.
- Guide 7: Eliminate email@example.com from Internet Explorer.
How to Remove firstname.lastname@example.org from Windows.
Step 1: Boot Your PC In Safe Mode to isolate and remove email@example.com
Step 2: Uninstall firstname.lastname@example.org and related software from Windows
Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it.
Step 3: Clean any registries, created by email@example.com on your computer.
The usually targeted registries of Windows machines are the following:
You can access them by opening the Windows registry editor and deleting any values, created by firstname.lastname@example.org there. This can happen by following the steps underneath:
Get rid of email@example.com from Mac OS X.
Step 1: Uninstall firstname.lastname@example.org and remove related files and objects
1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:
- Go to Finder.
- In the search bar type the name of the app that you want to remove.
- Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
- If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.
In case you cannot remove email@example.com via Step 1 above:
In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:
You can repeat the same procedure with the following other Library directories:
Tip: ~ is there on purpose, because it leads to more LaunchAgents.
Step 2: Scan for and remove malware from your Mac
When you are facing problems on your Mac as a result of unwanted scripts, programs and malware, the recommended way of eliminating the threat is by using an anti-malware program. Combo Cleaner offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.
Remove firstname.lastname@example.org from Google Chrome.
Step 1: Start Google Chrome and open the drop menu
Step 2: Move the cursor over "Tools" and then from the extended menu choose "Extensions"
Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.
Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.
Erase email@example.com from Mozilla Firefox.
Step 1: Start Mozilla Firefox. Open the menu window
Step 2: Select the "Add-ons" icon from the menu.
Step 3: Select the unwanted extension and click "Remove"
Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.
Uninstall firstname.lastname@example.org from Microsoft Edge.
Step 1: Start Edge browser.
Step 2: Open the drop menu by clicking on the icon at the top right corner.
Step 3: From the drop menu select "Extensions".
Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.
Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.
Remove email@example.com from Safari.
Step 1: Start the Safari app.
Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.
Step 3: From the menu, click on "Preferences".
Step 4: After that, select the 'Extensions' Tab.
Step 5: Click once on the extension you want to remove.
Step 6: Click 'Uninstall'.
A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the firstname.lastname@example.org will be removed.
Eliminate email@example.com from Internet Explorer.
Step 1: Start Internet Explorer.
Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'
Step 3: In the 'Manage Add-ons' window.
Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.
Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.