Do you know what Chch Ransomware is?
Chch Ransomware is a variant of a different infection called Squad Ransomware, and so it is clear that it was created by someone with experience and knowledge about ransomware. Our research team has tested the threat in our internal lab, and there is no doubt that this malware works and that it can cause great damage to your personal files. If you have not faced this malware yet, we recommend that you employ a trusted malware scanner to inspect your system for any potentially active threats. Even though this ransomware is most likely to spread using remote access system vulnerabilities or via bundled downloaders and spam, it could also be dropped by other threats. Hopefully, you do not need to delete anything yet, and you still have time to secure the system. If you already need to remove Chch Ransomware from your operating system, please continue reading this report.
You can figure out whether or not Chch Ransomware slithered into your Windows operating system by searching for the “.chch” extension. If the threat got in, and if your files were encrypted by it, this is the extension that you are likely to find appended to the original names. Unfortunately, even though you can delete this extension, your files will remain corrupted if you do this. If you think that you can reverse the damage using a system restore point, we have bad news for you. Chch Ransomware deletes shadow volume copies, thus making sure that you cannot use a restore point to go back in time, so to speak. Of course, externally saved copies of your files are safe, and so if you use external drives or cloud storage to backup files, you are good. Please remember this in the future because backing up files in a safe manner might help you prevent loss of files in the future as well.
Chch Ransomware screenshot
Scroll down for full removal instructions
Before you even think about backups or the removal of Chch Ransomware, you might decide to open a file named “READ_ME.TXT.” This file is created by ransomware, and copies are dropped everywhere to ensure that you open it. The message inside informs that you have to email squadhack@email.tg if you want to have your files restored. The message also informs that a price has to be paid for the decryption service, but the exact sum is not revealed. Presumably, you would get this information after initiating contact with the attackers. Unfortunately, it is highly unlikely that you would have your files decrypted if you followed the instructions presented by cybercriminals. Chch Ransomware was created to make money, not to assist victims, and, therefore, we believe that once attackers get the ransom payment, they are likely to stop communicating with victims. Of course, by emailing them, you could be exposing yourself to new scams and attacks.
If your files were encrypted by Chch Ransomware, we hope that you have backups; otherwise, it looks like you are out of options. A free decryptor did not exist at the time of research, and cybercriminals are unlikely to assist you regardless of what you give them. If you do have backups, we advise deleting Chch Ransomware first because you do not want to risk having copies of the corrupted files destroyed too. When it comes to the removal, you can try handling it yourself, but only if you are sure that you can find and erase the launcher file. Otherwise, we advise employing an anti-malware program that would erase the threat from your operating system automatically. An added bonus of such a program is that it would automatically secure your system and prevent new threats from attacking it.
Remove Chch Ransomware
- Delete every recently downloaded suspicious file that could belong to malware.
- Delete every copy of the ransom note file named READ_ME.TXT.
- Empty Recycle Bin and then install a malware scanner to check the system for leftovers.
In non-techie terms:
Chch Ransomware is a dangerous threat, and if you fail to secure your operating system against it, you might have your personal files permanently destroyed. This threat employs a complex algorithm to change the data of the files, and that makes them unreadable. A ransom note dropped next to the encrypted files suggests that you can pay to get your files decrypted, but our researchers warn that the attackers’ promises are most likely to be empty. If you do not want to lose your files AND your money, we suggest focusing on deleting Chch Ransomware. Even if you can erase this threat manually, we suggest employing an anti-malware program because it can also ensure protection in the future.