Do you know what Exte Ransomware is?
Exte Ransomware is a new member in the CryptoMix ransomware family that consists of Mole Ransomware, CryptoShield Ransomware, Revenge Ransomware, and similar infections analyzed recently by our experienced malware researchers. The infection rate of this threat is still quite low, but this might change soon because it is a newly-detected ransomware infection. Cyber criminals develop such infections having the only purpose in mind – to obtain money, so, even though Exte Ransomware does not tell users anything about the ransom in advance, there is basically no doubt that it will try to extract money from users too. Malicious software developers know well that users will not let go of their money easily, so they ruin their files by encrypting them. Do not send cyber criminals money even if such important files as documents and pictures have been locked by this nasty infection. It is because you have no guarantees that your files will be unlocked for you. Also, a free decryption tool might be developed soon because other similar threats belonging to the same ransomware family are already decryptable. We recommend taking action only after the full removal of this infection because this threat has a point of execution and, as a consequence, might launch again automatically and lock those decrypted files one more time.
You can be sure that the malicious application you have encountered is Exte Ransomware if those files you can no longer open have a new extension .EXTE appended to all of them. The names of the files will be changed to random strings of letters and numbers as well, so you will see something like B0887D26451E559214DB535948AB34B2.EXTE in the place of each personal file encrypted by this threat. To tell users what has happened to their files, Exte Ransomware also drops a ransom note in a .txt format – _HELP_INSTRUCTION.txt. If users open it and read the message left for them, they find out that they cannot open their files because they have all been encrypted. Unlike similar ransomware infections, this one does not tell users anything about the ransom they need to pay; however, it does not mean that victims will not be told to pay for the decryption tool when they send an email to exte1@msgden.net, exte2@protonmail.com, or exte3@reddithub.com with a unique ID available in the ransom note as instructed. You are not allowed to send cyber criminals money even if you are told that the only way to decrypt files is to use the special key that can only be bought from cyber criminals because there are no guarantees that they have this key. Even if they do, they might not want it to give it to you after receiving your money, so better go to recover your files from a backup or wait until a free decryption key is developed and available for download.
Exte Ransomware screenshot
Scroll down for full removal instructions
Some users think that Exte Ransomware can no longer cause harm after encrypting files and, as a consequence, decide not to do anything about its presence. Specialists say that it is the worst thing users can do because this infection does not delete itself after the encryption of users’ files. Instead, it creates two entries in the Run registry key so that it could automatically launch and continue working on victims’ PCs even if they reboot their computers. This also means that Exte Ransomware will stay active and might lock your new files again. Do not let it do this – erase this infection fully as soon as possible. When its removal is complete, install a security application so that similar infections could not enter your PC again and lock your files.
It will be enough to delete Exte Ransomware fully from your system by erasing its entries from the Run registry key and an executable file from the %APPDATA% directory. This .exe file might have a random name, so if you cannot find it anywhere, you should scan your system with an automatic malware remover. It will find end erase all malicious files belonging to ransomware for you.
How to delete Exte Ransomware
- Press Win+R.
- Enter regedit.exe and click OK.
- Delete two values 00FF0EBCF2F2 and BC0EBCF2F2 (they might have different names) from HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
- Close Registry Editor and press Win+E to launch Explorer.
- Type %APPDATA% in the URL bar and press Enter.
- Delete an executable file belonging to the ransomware infection, e.g. BC0EBCF2F2.exe.
- Remove _HELP_INSTRUCTION.txt from Desktop.
- Empty the Recycle bin.
In non-techie terms:
Exte Ransomware, like previously-analyzed ransomware infections, is a malicious application whose main purpose is to extract money from users. Although victims will not find any information about the ransom provided for them in the ransom note dropped by this infection, it is very likely that they will be told that the decryption tool will be given to them only if they send the required money when they contact cyber criminals. Do not send malware developers money because you do not know whether they have this key for decrypting files. There are also no guarantees that they will give it to you even if they really have it.