Remove Kabe Ix@hotmail.com Lockscreen Worm and Unlock Your PC - How to, Technology and PC Security Forum | SensorsTechForum.com
THREAT REMOVAL

Remove Kabe Ix@hotmail.com Lockscreen Worm and Unlock Your PC

help-removal-sensorstechforumA new worm has been detected in the wild. The cyber-threat has been reported to replicate via infected USB drives from the computers it has affected through malicious URLs. It locks the screen of the user displaying a ransom message pointing out to contacting an email ending in ix@hotmail.com. All users who have become a victim of this nasty worm should not contact the attackers at any circumstances. Experts recommend using instructions like the ones below to methodologically get rid of this threat from your computer.

NameKabe “ix@hotmail.com”
TypeLockscreen Worm/Ransomware
Short DescriptionThe cyber-threat locks the user PC’s screen displaying a ransom message with contact details. It demands around 4$ to unlock the computer.
SymptomsThe user may be prevented from accessing his PC.
Distribution MethodVia malicious URLs or attachments posted on sites or sent out via spam mails. The other method is self-replication via removable drives(USB, microSD, MMC, Phone memory) connected to the infected computer.
Detection ToolDownload Malware Removal Tool, to See If Your System Has Been Affected by Kabe “ix@hotmail.com”
User Experience Join our forum to discuss Kabe “ix@hotmail.com”.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Kabe Lockscreen Worm – How Did I Get Infected

There are two primary means of distribution, this malware uses. One of them is via spam-emails featuring malicious URLs, or attachments, such as the one from the example below:

malicious-email-spam-links-sensorstechforum

Such malicious URLs may redirect to exploit kits which might infect the user via a drive-by download or a malicious script.

The other method of replication is if a USB stick has been inserted into an infected computer. The worm immediately detects the removable drive, after which creates copies of its malicious modules in an obfuscated form in the drive itself:

→ The file kabe.exe
The file Autorun.inf, which contains the following settings:
action=Open
shellexecute=kabe.bat
shell\explore\command=kabe.bat
USEAUTOPLAY=1
shell\Open\command=kabe.bat
shell\Autorun\command=kabe.bat
shell\Search\command=kabe.bat

This technique is very effective in saving the cyber-crooks a lot of resources to spread the worm via spam. Users should know how to protect themselves and never use flash drives to multiple devices if one of them is infected.

Kabe Lockscreen Worm In Detail

Malware researchers have reported that this worm is associated with the following files which it creates to several key Windows locations:

→ In %Temp%
-explorer.exe
-sajith_and_rasini.db
-i_love_you_rasini.db
In %Startup%
-msfold.exe
In %RemovableDrive%
-kabe.exe
-autorun.inf
-kabe.bat
In %SystemDrive%
-kabe.exe
-autorun.inf
-kabe.bat

The msfold.exe module is reported to be the one responsible to enable the automatic start-up of the malware every time you turn on your computer.

Upon startup, this malware restricts user access displaying the following messages:

→ A pop-up with the message:
“Your Desktop is locked now!”
A note with the message:
Email {identification}ix@hotmail.com
Send Email to our team and pay 4$ for unlock code
together with the textbox and button for unlock.”

Remove Kabe Lockscreen Worm Completely

You cannot eradicate this threat by using the conventional methods since the access to the computer is restricted. This is why we recommend using the step-by-step instructions bellow to assist you with removing Kabe Lockscreen and its malicious modules effectively. We also advise choosing an advanced anti-malware tool which will remove the threat in full.

1. Boot Your PC In Safe Mode to isolate and remove Kabe “ix@hotmail.com”

1. Boot Your PC Into Safe Mode

1. For Windows 7,XP and Vista. 2. For Windows 8, 8.1 and 10.

For Windows XP, Vista, 7 systems:

1. Remove all CDs and DVDs, and then Restart your PC from the “Start” menu.
2. Select one of the two options provided below:

For PCs with a single operating system: Press “F8” repeatedly after the first boot screen shows up during the restart of your computer. In case the Windows logo appears on the screen, you have to repeat the same task again.

donload_now_140

For PCs with multiple operating systems: Тhe arrow keys will help you select the operating system you prefer to start in Safe Mode. Press “F8” just as described for a single operating system.

donload_now_140

3. As the “Advanced Boot Options” screen appears, select the Safe Mode option you want using the arrow keys. As you make your selection, press “Enter“.

4. Log on to your computer using your administrator account

donload_now_140

While your computer is in Safe Mode, the words “Safe Mode” will appear in all four corners of your screen.

Step 1: Open the Start Menu

donload_now_140

Step 2: Whilst holding down Shift button, click on Power and then click on Restart.
Step 3: After reboot, the aftermentioned menu will appear. From there you should choose Troubleshoot.

donload_now_140

Step 4: You will see the Troubleshoot menu. From this menu you can choose Advanced Options.

donload_now_140

Step 5: After the Advanced Options menu appears, click on Startup Settings.

donload_now_140

Step 6: Click on Restart.
donload_now_140

Step 7: A menu will appear upon reboot. You should choose Safe Mode by pressing its corresponding number and the machine will restart.

2. Remove Kabe “ix@hotmail.com” with SpyHunter Anti-Malware Tool

2. Remove Kabe “ix@hotmail.com” with SpyHunter Anti-Malware Tool

1. Install SpyHunter to scan for and remove Kabe “ix@hotmail.com”.2. Scan with SpyHunter to Detect and Remove Kabe “ix@hotmail.com”.
Step 1:Click on the “Download” button to proceed to SpyHunter’s download page.

donload_now_140
It is highly recommended to run a scan before purchasing the full version of the software to make sure that the current version of the malware can be detected by SpyHunter.

Step 2: Guide yourself by the download instructions provided for each browser.
Step 3: After you have installed SpyHunter, wait for it to automatically update.

pets-by-myway-ads-virus

Step1: After the update process has finished, click on the ‘Scan Computer Now’ button.
pets-by-myway-ads-virus
Step2: After SpyHunter has finished scanning your PC for any Kabe “ix@hotmail.com” files, click on the ‘Fix Threats’ button to remove them automatically and permanently.
pets-by-myway-ads-virus
Step3: Once the intrusions on your PC have been removed, it is highly recommended to restart it.

3. Uninstall your web browser to get it rid of Kabe “ix@hotmail.com” from it.

3. Remove or Uninstall Your Web Browser in Windows.

Step 1: Remove/Uninstall Your Browser using Windows Programs and Features.

Here is a method in few easy steps to uninstall your web browser. No matter if you are using Windows 8, 7, Vista or XP or 10, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program get left behind, and that can lead to unstable work of your PC, mistakes with the file type associations and other unpleasant activities caused by the virus. The proper way to get the browser off your computer is to Uninstall it. To do that:

  • Hold the Windows Logo Button and “R” on your keyboard. A Pop-up window will appear (fig.1).
  • uninstall-virus-fig1

  • In the field type in “appwiz.cpl” and press ENTER (fig.2).
  • affected-web-browser-sensorstechforum

  • This will open a window with all the programs installed on the PC.
    Select the web browser that you want to remove, and press “Uninstall” (fig.3).
  • affected-web-browser-sensorstechforum
    After you uninstall your web browser, you should clean up your registries before downloading it again. For more information on how to clean up your registries, proceed to the following article:
    Fix Windows Registry Errors Caused by Malware

    Optional: Using Alternative Anti-Malware Tools

    Remove Kabe “ix@hotmail.com” Using Other Alternative Tools

    Malwarebytes Anti-MalwareSTOPZilla Anti Malware
    1. Install Malwarebytes Anti-Malware to scan for and remove Kabe “ix@hotmail.com”.
    Step 1: Download Malwarebytes by clicking here.
    Step 2: A pop-up window will appear. Click on the ‘Save File’ button. If it does not, click on the Download button and save it afterwards.
    pets-by-myway-ads-virus
    pets-by-myway-ads-virus
    Step 3: After you have downloaded the setup, simply open it.
    Step 4: The installer should appear. Click on the ‘Next’ button.
    pets-by-myway-ads-virus
    Step 5: Check the ‘I accept the agreement’ check circle if not checked if you accept it and click the ‘Next’ button once again.
    pets-by-myway-ads-virus
    Step 6: Review and click on ‘Next’ on the following 4 steps that will appear afterwards and after that click on the ‘Install’ button.
    pets-by-myway-ads-virus
    Step 7: After the installation process has completed click on the ‘Finish’ button and check the ‘Launch MalwareBytes AntiMalware’ check box.

    2. Scan your PC with MalwareBytes to remove all Kabe “ix@hotmail.com” associated files automatically.

    Step 1: Launch MalwareBytes if you havent launched it after install.
    Step 2: Wait for the software to update and then click on the blue ‘Scan Now’ button. If it doesnt start updating automatically, click on the blue ‘Update Now’ highlighted text.
    pets-by-myway-ads-virus
    Step 3: At this point, after clicking the ‘Scan Now’ button, the system should start scanning your PC. It may take a while but be patient – it is worth it.
    pets-by-myway-ads-virus
    Step 4: After the scan has been complete and all of the threats have been identified, click on the ‘Remove Selected’ button to delete them permanently.
    pets-by-myway-ads-virus
    Step 5: Once the scan has completed, MalwareBytes will prompt you to restart your computer. It is recommended to save all your data you are working on before restarting.

    1. Download and Install STOPZilla Anti-malware to Scan for And Remove Kabe “ix@hotmail.com”.
    Step 1: Download STOPZilla by clicking here.
    Step 2: A pop-up window will appear. Click on the ‘Save File’ button. If it does not, click on the Download button and save it afterwards.
    pets-by-myway-ads-virus
    Step 3: After you have downloaded the setup, simply open it.
    Step 4: The installer should appear. Click on the ‘Next’ button.
    pets-by-myway-ads-virus
    Step 5: Check the ‘I accept the agreement’ check circle if not checked if you accept it and click the ‘Next’ button once again.
    pets-by-myway-ads-virus
    Step 6: Review and click on the ‘Install’ button.
    pets-by-myway-ads-virus
    Step 7: After the installation process has completed click on the ‘Finish’ button.

    2. Scan your PC with STOPZilla Anti Malware to remove all Kabe “ix@hotmail.com” associated files completely.
    Step 1: Launch STOPZilla if you haven’t launched it after install.
    Step 2: Wait for the software to automatically scan and then click on the ‘Repair Now’ button. If it does not scan automatically, click on the ‘Scan Now’ button.
    pets-by-myway-ads-virus
    Step 3: After the removal of all threats and associated objects, you should Restart your PC.

    NOTE! Substantial notification about the Kabe “ix@hotmail.com” threat: Manual removal of Kabe “ix@hotmail.com” requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.
    Avatar

    Ventsislav Krastev

    Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

    More Posts - Website

    Follow Me:
    Twitter

    Leave a Comment

    Your email address will not be published. Required fields are marked *

    Time limit is exhausted. Please reload CAPTCHA.

    Share on Facebook Share
    Loading...
    Share on Twitter Tweet
    Loading...
    Share on Google Plus Share
    Loading...
    Share on Linkedin Share
    Loading...
    Share on Digg Share
    Share on Reddit Share
    Loading...
    Share on Stumbleupon Share
    Loading...