Remove Esmeralda Ransomware and Restore .encrypted Files - How to, Technology and PC Security Forum |

Remove Esmeralda Ransomware and Restore .encrypted Files


Esmeralda ransomware is believed to be a new variant of the Apocalypse cryptovirus. The new strain uses the same domain for an e-mail contact and encrypts files by placing the same extension. That extension is .encrypted and is placed on each locked file. The AES algorithm is used for the encryption process. To see how to remove the ransomware and how you can try to decrypt your files, carefully read the article.

Threat Summary

TypeRansomware, Cryptovirus
Short DescriptionThe ransomware encrypts your files and then displays a ransom note with demand instructions.
SymptomsYour files will become encrypted and inaccessible. The .encrypted extension will be appended to all of them.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Esmeralda


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Esmeralda.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Esmeralda Ransomware – Infection

The Esmeralda ransomware can infiltrate your computer system in a number of ways. The payload file could be spreading through spam e-mails. Spam mail is made in such a way that is presented to you as something of crucial importance or like surprising news. The focus is put on the attachment, and while you don’t think about whether the letter is telling the truth or not, you open that attached file. Inside, the malicious content is released, and your computer machine is infected. The payload file in most cases is an executable or a Trojan horse, and you can see an example of such a file on the VirusTotal database:


Esmeralda ransomware could infect your device in other ways. For example, the malware creators could be delivering the files via social media networks and file-share websites. The malicious file might be hosted on one of these platforms with the goal of infecting more unsuspecting users. Refrain from opening unknown links and files from dubious sources. Do an initial scan with a security application and check their signature and size beforehand. You should read the ransomware prevention tips in the STF forum.

Esmeralda Ransomware – Information

A ransomware cryptovirus has been found a few days back, which goes by the name of Esmeralda. Malware researchers from Emsisoft believe that it is a variant of the Apocalypse ransomware.

It will encrypt your files and after that put the extension .encrypted to each of them. Instructions with demands will be written in a text file and also launched as a ransom message on your screen after the encryption process is finished.

When the Esmeralda ransomware executes its payload, it could create entries inside the Windows Registry for achieving persistence. Those registry entries are created to make the virus launch automatically with every boot of the Windows operating system. What follows is that your data becomes encrypted, and then the ransom note shows up on your desktop screen. The ransom message is contained inside a file named How_To_Decrypt.txt.

You can see the ransom message from the below screenshot:


The message reads the following:

Windows has encountered a critical problem and needs your immediate action to recover your data. The system access is locked and all the data have been encrypted to avoid the information be published or misused. You will not be able to access to your files and ignoring this message may cause the total loss of data. We are sorry for the inconvenience.

You need to contact the email below to restore the data of your system.


You will have to order the Unlock-Password and the Esmeralda Decryption Software. All the
instructions will be sent to you by email.

No further instructions are given unless you contact the email address and write to the crooks. The ransom note is English and doesn’t appear to target specific users. The contact email is in Russian, and the instructions are to write to the provided e-mail. However, you should NOT, in any case, think of contacting the criminals or paying them. No one can guarantee you that by paying you will get your data restored. Adding to that the cybercriminals will probably invest the money in other ransomware viruses or more criminal activities.

The Esmeralda ransomware encrypts files while appending the .encrypted extension to them. The encryption process utilizes the AES encryption algorithm according to researchers. For now, this new variant of the Apocalypse ransomware does not seem decryptable.

The Esmeralda cryptovirus is very likely to delete the Shadow Volume Copies from the Windows operating system via the following command:

→vssadmin.exe delete shadows /all /Quiet

Read further to see what types of methods you can try to possibly restore some of your data.

Remove Esmeralda Ransomware and Restore .encrypted Files

If your computer got infected with the Esmeralda ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by Esmeralda.


Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share