Do you know what Start Ransomware is?
Start Ransomware is another threat based on the Crysis/Dharma Ransomware. Recently, we have encountered and researched a lot of these malicious applications, and we do not think this new variant is the last one. Like most of the infections from this family, it was designed to encrypt files and display a ransom note. Files that become encrypted become unreadable, which means a system can no longer recognize them. To reverse this process, you have to have a decryptor and a unique decryption key that gets created during encryption. No doubt, the hackers behind the malware are the ones who might be able to provide such means, and the ransom note their malicious application displays indicates that they wish to receive a payment in return. Of course, making a deal with such people would be risky. Therefore, for those who do not want to risk their money, we advise concentrating on the Start Ransomware’s deletion. For more details about this threat, you should read the rest of this article.
Further, in this report, we describe the malicious application’s working manner in more detail. In this paragraph, we wish to talk about how Start Ransomware could enter a system and how to prevent it. Our computer security specialists say that most of such threats ate received via email or downloaded from unreliable websites. Meaning, if you open files obtained from the Internet carelessly, without checking them with a security tool even if they come from unreliable sources, you are more likely to encounter such a threat.
What is considered as untrustworthy sources? In short, it could be messages from unknown senders and data from torrent sites and other P2P file-sharing networks. Thus, if you want to stay safe, you have to pay more attention to details, such as the sender’s email address, the tone of the message and reason for sending a file, the reliability of websites you visit, and so on. If you do not feel like inspecting every email that carries an attachment or every website that you visit, we advise having a reputable antimalware tool. You could use it to scan suspicious data, and it might be able to warn you when you enter malicious sites. Your browser might be able to stop you from visiting potentially dangerous sites too, so keep it always up to date and pay attention to its warning.
Start Ransomware screenshot
Scroll down for full removal instructions
What happens if Start Ransomware manages to get in? The malware should create files that are listed in the removal guide available below. Once this task is done, it should start encrypting various files located on your system. Our researchers say that it should mainly target personal data, for example, pictures, documents, etc. Since each encrypted file ought to be marked with a unique extension that could look like this: id-3D8F098C.[starter@cumallover.me].start; it should be easy to recognize affected files. After this task is done, the malicious application should drop a text document named FILES ENCRYPTED.txt and open a pop-up window.
Start Ransomware’s window should contain a full ransom note, while the mentioned text document ought to carry a couple of sentences only. In any case, neither of the texts explain how to make a payment. Instead, they provide contact information so a victim could message the malware’s creators and learn what to do next for themselves. Doing so could turn out to be a mistake because there are no guarantees these cybercriminals will hold on to their promise and send decryption tools to those who pay a ransom. If you decide it is too risky, we recommend not to contact the malware’s creators.
Users who have any backup copies could use them to replace encrypted files. However, we advise doing so only after you delete Start Ransomware. You can get rid of it either manually or with a chosen antimalware tool. If you pick the first option, you should follow the removal guide available below. If you select the second option, you should download a reputable antimalware tool.
Erase Start Ransomware
- Restart your computer in Safe Mode with Networking.
- Click Windows Key+E.
- Navigate to the suggested paths:
%TEMP%
%USERPROFILE%Desktop
%USERPROFILE%Downloads - Identify a file launched at the time the system got infected, right-click the malicious file, and select Delete.
- Find these particular paths:
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
%ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup
%WINDIR%\System32 - Find copies of the malware’s launcher (the title could be random), right-click them and select Delete.
- Navigate to these paths:
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
%ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup
%WINDIR%\System32
%APPDATA% - Look for documents called Info.hta, right-click them and choose Delete.
- Locate and erase files called FILES ENCRYPTED.txt.
- Exit File Explorer.
- Press Windows Key+R, insert Regedit and choose OK.
- Navigate to this path: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Look for value names that could be related to the malicious application (their value data might point to similar locations and files: C:\Users\user\AppData\Roaming\Info.hta, C:\Windows\System32\file.exe, and C:\Windows\System32\Info.hta).
- Right-click such value names and press Delete.
- Close the Registry Editor.
- Empty Recycle bin.
- Restart the computer.
In non-techie terms:
Start Ransomware is a threat that might make you consider making data backups in the future if you did not back your files up till now. That is because the malware encrypts victims’ personal data to make it unusable and displays a note demanding a ransom in exchange for decryption tools. As you can probably guess, the way not to pay the ransom and still get your data back is to replace it with backup copies. Thus, making extra copies of your personal and valuable files is very important nowadays, when ransomware is so popular. We do not recommend paying a ransom because there are no guarantees the hackers will send the decryption tools they may promise. As a result, the money you pay could be lost for nothing. If it is not something you want to risk happening, we advise paying no attention to the malware’s ransom note and erasing Start Ransomware with no hesitation. To delete it manually, you could check the instructions available above this paragraph.