Remove Apocalypse Ransomware and Decrypt .Encrypted Files

New ransomware variant, whose name was chosen by its creators to be “Apocalypse” has emerged out into the open. The ransomware also known as a crypto-virus uses either RSA or AES cipher to encrypt the files of the computers it infects and runs on startup pretending to be a Windows Update process. Since this ransomware virus demands different ransom payoff ammount in BitCoin, users infected with it are strongly advised not to pay any. Instead it is recommended to follow the instructions here to remove Apocalypse and decrypt your data, using the Decryptor posted below.

Update! AVG researchers have released two decryptors for Apocalypse Ransomware – for the older version and the newer version of Apocalypse ransomware. Do not pay the ransom and decrypt your files for free by using the download links below:
Apocalypse Ransomware Decryptor Variant 1
Apocalypse Ransomware Decryptor Variant 2

Threat Summary

Name	Apocalypse
Type	Ransomware
Short Description	The ransomware encrypts files with a strong cipher and asks a ransom payoff for decryption by contacting its e-mail.
Symptoms	Files are encrypted and become inaccessible. A ransom note with instructions for paying the ransom shows as a How_To_Decrypt.txt file.
Distribution Method	Spam Emails, Email Attachments, File Sharing Networks.
Detection Tool	See If Your System Has Been Affected by Apocalypse Download Malware Removal Tool
User Experience	Join our forum to Discuss Apocalypse Ransomware.
Data Recovery Tool	Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Apocalypse Ransomware – Ways of Spreading

In order to be successfully redistributed out into the open, Apocalypse uses different techniques. One of those is posting malicious web links on various places througout the web. Such web links may be featured in spam e-mails resembling a big company, like a bank or PayPal.

Another method of spreading this ransomware may be via potentially unwanted programs (PUPs) which are also known to cause browser redirects.

Apocalypse crypto-virus may also be featured as a malicious e-mail attachment in spam message sent via e-mail.

Apocalypse Ransomware – Methods of Operation

Once activated on your computer, the dropper of the ransomware virus creates an executable in the following Windows directory:

C:\Program Files (x86)\windowsupdate.exe,/p>

After doing so, Apocalypse modifies the registry entry of the infected computer so that this executable runs when you start your Windows OS. This is possible by adding values in the following registry key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Svc C:\Program Files (x86)\windowsupdate.exe

On system startup, the ransomware may run as a Windows Update service and block the user, explaining to him that the files are encrypted. It may also run in an obfuscated manner to avoid detection by anti Anti-Virus programs.

To encrypt the files, the Apocalypse ransomware uses an exclusion list. Basically, it encodes every single file of the infected computer except files with the following file extensions:

.encrypted, .dat, .bat, .bin, .ini, .tmp, .lnk, .com, .msi, .sys, .dll, .exe

After enciphering the data, Apocalypse ransomware adds the .encrypted extension to the files, for example:

Picture.jpg.enrypted.How_To_Decrypt.txt

The ransomware also drives users to open the “How_To_Decrypt.txt” file which states the following ransom note:

IF YOU ARE READING THIS MESSAGE, ALL THE FILES IN THIS COMPUTER HAVE BEEN CRYPTED!!!
documents,pictures,videos,audio,backups,etc
IF YOU WANT TO RECOVER YOUR DATA, CONTACT THE EMAIL BELOW
EMAIL: [email protected]
WE WILL PROVIDE DECRYPTION SOFTWARE TO RECOVER YOUR FILES.
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF YOU DONT CONTACT BEFORE 72 HOURS, ALL DATA WILL BE LOST FOREVER”

After the encryption process has finished, the ransomware locks the user out of his computer and the only way to access the system again is in Safe Mode.

Remove Apocalypse Ransomware and Decrypt Your Files

To fully erase this ransomware from your computer, we strongly advise following our instructions below. In addition to that experts also recommend removing its malicious files and objects using an advanced-anti-malware tool for maximum effectiveness.

To decrypt your files it is advisable to download EmsiSoft`s decrypter for Apocalypse Ransomware below:

EmsiSoft Decrypter for Apocalypse Ransomware

Manually delete Apocalypse from your computer

Note! Substantial notification about the Apocalypse threat: Manual removal of Apocalypse requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Apocalypse files and objects

2.Find malicious files created by Apocalypse on your PC

3.Fix registry entries created by Apocalypse on your PC

Automatically remove Apocalypse by downloading an advanced anti-malware program

1. Remove Apocalypse with SpyHunter Anti-Malware Tool

2. Back up your data to secure it against infections and file encryption by Apocalypse in the future

Back up your data to secure it against attacks in the future

IMPORTANT! Before reading the Windows backup instructions, we highly recommend to back up your data automatically with cloud backup and insure it against any type of data loss on your device, even the most severe. We recommend reading more about and downloading SOS Online Backup .

To back up your files via Windows and prevent any future intrusions, follow these instructions:

1. For Windows 7 and earlier

1. For Windows 8, 8.1 and 10

1. Enabling the Windows Defense Feature (Previous Versions)

1-Click on Windows Start Menu

2-Type Backup And Restore
3-Open it and click on Set Up Backup

4-A window will appear asking you where to set up backup. You should have a flash drive or an external hard drive. Mark it by clicking on it with your mouse then click on Next.

5-On the next window, the system will ask you what do you want to backup. Choose the ‘Let Me Choose’ option and then click on Next.

6-Click on ‘Save settings and run backup’ on the next window in order to protect your files from possible attacks by Apocalypse.

1-Press Windows button + R

2-In the window type ‘filehistory’ and press Enter

3-A File History window will appear. Click on ‘Configure file history settings’

4-The configuration menu for File History will appear. Click on ‘Turn On’. After its on, click on Select Drive in order to select the backup drive. It is recommended to choose an external HDD, SSD or a USB stick whose memory capacity is corresponding to the size of the files you want to backup.

5-Select the drive then click on ‘Ok’ in order to set up file backup and protect yourself from Apocalypse.

1- Press Windows button + R keys.

2- A run windows should appear. In it type ‘sysdm.cpl’ and then click on Run.

3- A System Properties windows should appear. In it choose System Protection.

5- Click on Turn on system protection and select the size on the hard disk you want to utilize for system protection.
6- Click on Ok and you should see an indication in Protection settings that the protection from Apocalypse is on.

Restoring a file via Windows Defense feature:
1-Right-click on the encrypted file, then choose Properties.

2-Click on the Previous Versions tab and then mark the last version of the file.

3-Click on Apply and Ok and the file encrypted by Apocalypse should be restored.