Do you know what Ims00ry Ransomware is?
Ims00ry Ransomware is a dangerous infection, and you want to do everything it takes to protect your personal files against it. The good news is that it does not take much to keep yourself safe. All you have to do is backup your personal files (we recommend using cloud storage, which can be a free solution), and then you need to install reliable security software to defend your operating system. Things become much trickier once this infection slithers in, but we have good news: This malware is decryptable. This is not something that happens often, and you are truly lucky. Hopefully, you can find a reliable decryptor to have all your files restored in no time. That being said, even if you do get your files decrypted, you still need to remove Ims00ry Ransomware. Obviously, the sooner you take care of this, the better.
According to our malware research team, Ims00ry Ransomware comes as a self-extracting archive, and there are plenty of security backdoors that the attackers could use to introduce you to it. Of course, it is most likely to employ spam emails, malicious downloaders, and other infections. Once executed, the threat extracts itself to %APPDATA%, where files called “svchost .exe,” “des1.jpg,” and “desk.bat” are dropped. All files are malicious and all of them must be deleted, but if you can remove the EXE and BAT files right away, that would be ideal. The BAT file can rename the JPG file, change the wallpaper image (to introduce the des1.jpg file), update user’s system parameters, and delete shadow volume copies. The last part means that if internal system backups exist, the infection makes it impossible to recover files using them. Besides that, Ims00ry Ransomware also tries to find and terminate the processes of active antivirus tools, which, of course, can make it easier for the threat to encrypt files.
Ims00ry Ransomware screenshot
Scroll down for full removal instructions
Once files are encrypted, no identifying marker (e.g., a unique extension) is added, but you will not be able to open them in a normal manner. To make things clearer, Ims00ry Ransomware creates two files to send you a message. The first one is the JPG file we have already discussed, and the second one is a file named “README.txt” that is created on the Desktop. According to our researchers, both files represent the same message. It informs that all files were encrypted using RSA-4096 and AES-256 algorithms and that they can be restored only if you pay a ransom. The ransom is set at $50, and you are instructed to pay it to the 1tnZbveCXmqRS1gfZSxztG5MbdJhptaqu Bitcoin Wallet. You are also instructed to send a message to @Ims00rybot via Telegram after the payment. Now that you know that a free decryptor is available, you must pay no attention to these demands. In fact, even if the decryptor was not available, we would not recommend paying the ransom, as there are no guarantees that that would help you in any way. Hopefully, you can now focus on the removal of the threat.
Our research team is confident that you will be able to delete Ims00ry Ransomware using the guide below, but that does not mean that your issues are over. You still need to secure the system against other kinds of infections, and note that most of them are much worse and that restoring files is usually impossible. That is why you need to think about employing anti-malware software. It could protect your system against invaders in the future, and it could also automatically remove Ims00ry Ransomware in the meantime. Besides employing security software, do NOT forget to backup your personal files.
Remove Ims00ry Ransomware
- Tap keys Win+E on the keyboard.
- In the Explorer’s quick access field, enter %APPDATA%.
- Delete these malicious files: svchost .exe, des1.jpg, and desk.bat.
- Move to the Desktop and Delete the file named README.txt.
- Restore your preferred Desktop wallpaper.
- Empty Recycle Bin.
- Install and run a reliable malware scanner to check for leftovers.
In non-techie terms:
Ims00ry Ransomware is one of the many threats that are capable of encrypting your personal files and then demanding a ransom payment in return for decryption services. The good news is that this particular threat is decryptable, which means that a tool capable of deciphering the encryption key and restoring your files for free exists. If you cannot find it yourself, do not hesitate to post a comment below. All in all, even though you can restore your files for free, you still need to figure out the removal of the infection. Can you delete Ims00ry Ransomware manually? Most likely, you can, but it might be time for you to install an anti-malware tool that would automatically erase active threats and, at the same time, ensure full-time protection.