Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove [email protected] Ransomware and Restore .Xtbl Encrypted Files

A new ransomware, carrying the vulgar name of its ransom email address, [email protected] has been reported to be massively spread. It encrypts the user files with a strong cypher and uses the ransom email plus a .xtbl file extension after it. The questionable malware is believed by security experts to be a part of RaaS (Ransomware as a service) operation because it has many variants.

Threat Summary

Name

[email protected]

TypeRansomware
Short DescriptionPart of the “@” ransomware variants. Encrypts the files on the infected computer then asks for ransom money in email correspondences.
SymptomsThe user may witness his files to become corrupt with the questionable email and .xtbl as file extensions that are added.
Distribution MethodVia Exploit kits or downloader Trojans.
Detection Tool See If Your System Has Been Affected by [email protected]

Download

Malware Removal Tool

User ExperienceJoin our forum to Discuss [email protected] Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

[email protected] – How Did I Get It

The most likely method that the [email protected] crypto-malware may have used to spread onto the user PCs may be via two main methods:

  • Malicious URLs posted as spam comments on forums or other social websites.
  • Malicious URLs featured in spam emails may resemble like they are originating from a legitimate service.

Either way, the [email protected] ransomwar may also not come directly onto the computer, but arrive via other malware. The most often used malware to download crypto-viruses are MSIL Trojans and Exploit Kits, such as the Angler Exploit Kit. Since their executables are obfuscated by the so-called cryptors or obfuscating software, it is difficult for a conventional antivirus software to detect them. The distribution malware may either open a port, connect to a host and download the malicious .exe via the port or directly create an exploit for the attackers.

[email protected] Ransomware In Detail

Similar to other variants, like [email protected] or [email protected] this variant may drop its payload in several locations:

  • %UserProfile%
  • %Roaming%
  • %AppData%

The files dropped may be of the following file types:

→ .exe, .dll, .tmp

Each one of the modules of this ransomware may have different function. The malware then may set a registry key to run on system startup after which look for the most commonly used file types and encrypt them.

An encrypted file by the [email protected] ransomware looks as follows:

[email protected]

The [email protected] virus then may change the wallpaper of the user to a wallpaper that asks the user to contact the questionable e-mail for further instructions. Here is what the wallpaper states:

→ “WARNING!!!
Important files on this PC are locked
If you want to reset this operation send one locked file to this email:
[email protected]
reserve:[email protected]
Important information: You only have 3 days to reply to this email before unlocking becomes impossible.”

The [email protected] ransomware also has a text file, named “How to decrypt your files.txt”. Judging by what type it is this ransomware is most likely sold on the dark web as a service for cyber-criminals who do not have the experience to program their own [email protected] ransomware. This is why all of the [email protected] types of ransomware use a specific contact email address that is unique to them and different wallpaper. However, they may be very similar in their structure.

Remove Redshitline Ransomware and Restore .Xtbl Files

In order to delete this ransomware, it is strongly advisable to use an advanced anti-malware software. Furthermore, we strongly recommend using the advanced anti-malware software because it will remove the ransomware and other malware that be executed on your computer without damaging your files.

Regarding file restoration, we recommend using the methods outlined in Step “4” from the instruction below.

Manually delete [email protected] from your computer

Note! Substantial notification about the [email protected] threat: Manual removal of [email protected] requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove [email protected] files and objects
2. Find malicious files created by [email protected] on your PC
3. Fix registry entries created by [email protected] on your PC

Automatically remove [email protected] by downloading an advanced anti-malware program

1. Remove [email protected] with SpyHunter Anti-Malware Tool
2. Back up your data to secure it against infections and file encryption by [email protected] in the future
3. Restore files encrypted by [email protected]
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

  • Brian Lakstins

    I have a customer with this virus. It started encrypting network shares on March 21st.

    The system infected is a virtual machine, so it is now shutdown without being cleaned.

    I tried Kaspersky Rakhni Decryptor and Rannoh Decryptor, but with no luck. Rakhni Decryptor gives an unsupported file type error. Rannoh Decryptor gives an error Can’t initialize on pair followed by Can’t init decryptor.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.