The new version of the popular among Russian users Unlock92 ransomware virus has been reported to be updated and now use the .kukaracha file extension which it adds to the files it encrypts. The Unlock92 ransomware then renders the files no longer openable by appending a file encryption cipher on them. This is done with the purpose to extort the average user for money in return for the files. Anyone who has been affected by the new version of Unlock92 should be careful and read the article to learn more about this threat and how to remove it and try to revert the files without having to pay the ransom payoff.
|Short Description||The malware encrypts users files using a strong encryption algorithm, making direct decryption possible only via a unique decryption key available to the cyber-criminals.|
|Symptoms||The user may witness ransom notes and “instructions” in a text file or a .tta file. Changed file names and the file-extension .kukaracha has been used.|
See If Your System Has Been Affected by malware
Malware Removal Tool
|User Experience||Join our forum to Discuss Unlock92.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Unlock92 Ransomware – More Information
Distribution of Unlock92
To successfully infect the average user, the ransomware virus uses standard techniques – spam e-mails. The e-mails may resemble an order form an online retailer with your name on it, for example:
“Michael, you order has been confirmed. Please check the Invoice for reference below.
Amazon Sales Team”
The malicious file attachment, containing Unlock92 ransomware may contain several tools that allow the successful infection, for example:
- Malware obfuscator to conceal the malicious file from any firewalls or real-time shields of most widely used antivirus software.
- Exploit kit or a Trojan.downloader that connects to a remote host and downloads the ransom notes and the file-encryption program.
- File Joiners that combine the malicious file with macros of documents, like Microsoft Office or Adobe documents, to increase legitimacy.
Some of those tools used in combination guarantee that more users will be infected, given the spam e-mail message to be convincing.
After the user opens the malicious file, multiple executable files of different types and having different names may be dropped In key Windows folders, for example:
Unlock92 Ransomware – Post-Infection Analysis
After having infected the user, Unlock92 ransomware may initiate a procedure to modify the registry entries of the infected computer. Amongst the registry keys affected by this virus, may be a lot of subkeys, but the primary ones which Unlock92 might attack are the Run and RunOnce subkeys:
These registry keys may contain values with data added in them, which make the executable that encrypts files of Unlock92 to run when Windows starts up.
After this executable is ran, it may begin to encrypt user files. TO perform this procedure, the virus may execute a .bin type of file which is pre-programmed to hunt for variety of file often used file types to cipher, just like the older verison of Unlock92, using the .CCCRRRPPP.: and .CRRRT extensions:
→ .psd, .jpeg, .docx, .doc, .arj, .tar, .7z, .rar, .zip, .tif, .jpg, .ai, .bmp, .png, .xlsx, .pptx, .accdb, .mdb, .rtf, .odt, .ods, .cd, .ldf, .mdf, .max, .dbf, .epf, .1cd, .md, .db, .pdf, .ppt, .xls, .cdr, .odb, .odg
After the encryption, this variant of Unlock92, adds the interesting file extension .kukaracha to the encoded files, making them look like the following:
In addition to this, Unlock92 ransomware may have new features added to it, such as the ability to destroy any backups, more specifically volume shadow copies on the compromised computer.
The virus may also drop two other files – a keynote.tta file and a .txt file which contains the ransom note and is most likely in Cyrillic.
Remove Unlock92 Ransomware and Restore .kukaracha Files
If you have been affected by this malware, the first action you should take is to disconnect your computer and copy the encrypted files to a flash drive or other external device. From there you may safely proceed to the removal of Unlock92 ransomware from your computer.
To remove Unlock92, bear in mind that you should follow the instructions below. In case you do not have the experience in manually removing ransomware, we advise you to use the help of an advanced anti-malware program which will take care of this for you.
After having removed Unlock 92 ransomware, you may use the alternative methods for restoring files mentioned in step “2.Restore Files Encrypted by Unlock92” below. They are not 100% guarantee you will restore the files, but are a good temporary solution until a real decryption is released, which is why we advise you to backup your data and try it on copies of the encrypted files.
- Guide 1: How to Remove Unlock92 from Windows.
- Guide 2: Get rid of Unlock92 from Mac OS X.
- Guide 3: Remove Unlock92 from Google Chrome.
- Guide 4: Erase Unlock92 from Mozilla Firefox.
- Guide 5: Uninstall Unlock92 from Microsoft Edge.
- Guide 6: Remove Unlock92 from Safari.
- Guide 7: Eliminate Unlock92 from Internet Explorer.
How to Remove Unlock92 from Windows.
Step 1: Boot Your PC In Safe Mode to isolate and remove Unlock92
Step 2: Uninstall Unlock92 and related software from Windows
Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it.
Step 3: Clean any registries, created by Unlock92 on your computer.
The usually targeted registries of Windows machines are the following:
You can access them by opening the Windows registry editor and deleting any values, created by Unlock92 there. This can happen by following the steps underneath:
Get rid of Unlock92 from Mac OS X.
Step 1: Uninstall Unlock92 and remove related files and objects
1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:
- Go to Finder.
- In the search bar type the name of the app that you want to remove.
- Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
- If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.
In case you cannot remove Unlock92 via Step 1 above:
In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:
You can repeat the same procedure with the following other Library directories:
Tip: ~ is there on purpose, because it leads to more LaunchAgents.
Step 2: Scan for and remove Unlock92 files from your Mac
When you are facing problems on your Mac as a result of unwanted scripts and programs such as Unlock92, the recommended way of eliminating the threat is by using an anti-malware program. SpyHunter for Mac offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.
Remove Unlock92 from Google Chrome.
Step 1: Start Google Chrome and open the drop menu
Step 2: Move the cursor over "Tools" and then from the extended menu choose "Extensions"
Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.
Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.
Erase Unlock92 from Mozilla Firefox.
Step 1: Start Mozilla Firefox. Open the menu window
Step 2: Select the "Add-ons" icon from the menu.
Step 3: Select the unwanted extension and click "Remove"
Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.
Uninstall Unlock92 from Microsoft Edge.
Step 1: Start Edge browser.
Step 2: Open the drop menu by clicking on the icon at the top right corner.
Step 3: From the drop menu select "Extensions".
Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.
Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.
Remove Unlock92 from Safari.
Step 1: Start the Safari app.
Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.
Step 3: From the menu, click on "Preferences".
Step 4: After that, select the 'Extensions' Tab.
Step 5: Click once on the extension you want to remove.
Step 6: Click 'Uninstall'.
A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the Unlock92 will be removed.
Eliminate Unlock92 from Internet Explorer.
Step 1: Start Internet Explorer.
Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'
Step 3: In the 'Manage Add-ons' window.
Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.
Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.