.TEST Files Virus (CryptoMix) - How to Remove and Restore Files
THREAT REMOVAL

.TEST Files Virus (CryptoMix) – How to Remove and Restore Files

OFFER

SCAN YOUR PC
with SpyHunter

Scan Your System for Malicious Files
Note! Your computer might be affected by .TEST Files Virus and other threats.
Threats such as .TEST Files Virus may be persistent on your system. They tend to re-appear if not fully deleted. A malware removal tool like SpyHunter will help you to remove malicious programs, saving you the time and the struggle of tracking down numerous malicious files.
SpyHunter’s scanner is free but the paid version is needed to remove the malware threats. Read SpyHunter’s EULA and Privacy Policy

This article has been created in order to help you by showing how to remove the .TEST files virus (CryptoMix variant) from your computer and how to restore files that have been encrypted with the .TEST file extension.

New ransomware infection has been reported to infect computers. The virus, using the .TEST file extension has been outlined by researchers to have the .TEST file extension which it appends on the files of the compromised computer. In addition to this, the malware also drops a ransom note, named _HELP_INSTRUCTION.TXT which aims to convince the victims of the virus in order to pay a hefty ransom fee in order to try and restore the AES encrypted files.

Threat Summary

Name.TEST Files Virus
TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on the infected computer and ask victims to pay ransom in order to restore the encrypted files.
SymptomsAims to append the .TEST file suffix on the encrypted files and then drops a ransom note, named _HELP_INSTRUCTION.TXT.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .TEST Files Virus

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .TEST Files Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Test CryptoMix Ransomware – Spread

For the infection process, the .TEST ransomware virus may use more than one techniques, the main of which may be e-mail spam messages that may be sent to victims. Such e-mails often pretend they come from big companies, like PayPal, DHL, FedEx, Dropbox and others and their goal is to make you trust the deceitful messages within them that often aim to get you to open malicious attachments within the e-mails or click on an URL which eventually leads to the infection itself. Here is an example of how such e-mails appear:

In addition to this, there may be other methods by which the CryptoMix .TEST variant can infect your computer system. One of those methods is known to be via fake files, such as setups, program license activators, key generators as well as other types of seemingly legitimate files.

.TEST Ransowmare – Analysis

Upon the initial infection with the infection file of .TEST ransomware, the malware may begin to drop it’s malicious files in the following Windows folders:

  • %AppData%
  • %Local%
  • %LocalLow%
  • %Roaming%
  • %Temp%

As soon as the malicious files of the .TEST files virus are dropped onto the victim’s computers, the ransomware may begin to perform various different activities, such as interfere with the Windows Registry Editor, more particularly modify the following Windows Registry sub-keys:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

After having done this, the .TEST files virus may also begin to modify various different types of processes and services in Windows, allowing it to obtain administrative power. Then, the .TEST ransomware may execute a script in Windows Command Prompt which stops several Windows processes and in addition to this may delete the Shadow Volume Copies of your computer, hence destroying backup and recovery via Windows. The commands to do these activities are as follows:

→ sc stop VVS
sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
sc stop WerSvc
cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe” /C vssadmin.exe Delete Shadows /All /Quiet

Then, the malware adds the _HELP_INSTRUCTION.TXT which aims to notify the victim of the ransomware virus that they must contact one of the test757 e-mails in order to pay a a ransom fee.

.TEST Files Virus – Encryption

For the encryption of files, the .TEST files virus may use various different techniques to located the files on your computer. It may scan for the most commonly used files on your computer, which are likely to be videos, documents, images and other types of important files with file extensions, among which may be the following:

“PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”

After the files are detected, the .TEST files virus begins to alter aspects of those files by replacing their original code with encrypted data with the AES encryption algorithm. In addition to this, the virus also renames the files with random letters and numbers and adds the .TEST file extension to them, making them appear like the following:

Remove .TEST Files Virus and Restore Encrypted Files

In order to remove the .TEST files virus, it is recommended that you follow the removal instructions below. They are divided in manual or automatic and their primary purpose is to make sure that the .TEST files virus is permanently gone. Be advised that if you lack the experience in removing the .TEST files virus automatically, recommendations by security experts are to perform the removal automatically via an advanced anti-malware software which will automatically scan for and remove the .TEST files virus from your computer completely and protect your computer against future infections.

In addition to this, if you want to restore files that have been encrypted by the .TEST files ransomware, you can try and follow the alternative instructions for file recovery below in step “2. Restore files, encrypted by .TEST Files Virus”. They are created in order to help you restore as many files as possible, but they are no guarantee you will be able to recover all of the data.

Note! Your computer system may be affected by .TEST Files Virus and other threats.
Scan Your PC with SpyHunter
SpyHunter is a powerful malware removal tool designed to help users with in-depth system security analysis, detection and removal of threats such as .TEST Files Virus.
Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter’s malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter’s EULA, Privacy Policy and Threat Assessment Criteria.

To remove .TEST Files Virus follow these steps:

1. Boot Your PC In Safe Mode to isolate and remove .TEST Files Virus files and objects
2. Find files created by .TEST Files Virus on your PC

Use SpyHunter to scan for malware and unwanted programs

3. Scan for malware and unwanted programs with SpyHunter Anti-Malware Tool
4. Try to Restore files encrypted by .TEST Files Virus

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...