Do you know what Mosk Ransomware is?
Mosk Ransomware might be a new infection, but it looks identical to hundreds of other ransomware infections that were created using the same malware code. It is very possible that all infections from this group are controlled by the same attacker(s) because even the contact information is usually the same. The more recent threats tend to have a mix of email addresses that can be associated with other clones, including Rote Ransomware, Msop Ransomware, Zobm Ransomware, Grod Ransomware, or Mbed Ransomware. An umbrella name for all of these threats is STOP Ransomware, and that is the name that you might face if you employ a malware scanner or an automatic anti-malware tool. Of course, you need to remove Mosk Ransomware regardless of the name that you recognize it by. If you are lucky, you will delete the threat before it corrupts your files, but if they were corrupted already, you might find yourself in an unfavorable position.
RDP vulnerabilities and spam emails can be used to spread all kinds of threats, but these methods of malware distribution are most common when we look at ransomware. So, if you want to avoid Mosk Ransomware and similar threats, you definitely want to be cautious about spam and unpatched RDP vulnerabilities. If the threat slithers in, it immediately encrypts personal files, and the “.mosk” extension is also added to the names. Some victims of the ransomware might not know that anything has happened until they discover the odd extension and find that their files are unreadable. Of course, most victims will learn about the ransomware only after a file named “_readme.txt” is dropped. This is the file that follows every STOP Ransomware infection. The message inside is the same in every case too, and it instructs the victim to email the attackers and also pay the ransom. In the Mosk Ransomware case, restoredatahelp@firemail.cc and gorentos@bitmessage.ch are the email addresses that are used. The ransom stays the same – $490 within three days, and $980 after that.
Mosk Ransomware screenshot
Scroll down for full removal instructions
Since there are so many infections in the STOP Ransomware family, it is no wonder that a STOP Decryptor was created. It was created by malware researchers, and it is free to use. Unfortunately, it does not guarantee full decryption. Also, not all versions of this malware become decryptable right away. When we analyzed the malicious Mosk Ransomware, the decryptor was not yet effective, but we hope that victims will be able to use it successfully in the future. This gives hope to those victims of the threat who do not have backups that could replace the encrypted files. Please take note that you should always backup personal files because you do not want to be stuck in a position where you end up losing the only copies you own. If you have backups, wait no more to delete Mosk Ransomware from your operating system. After this, use backups as replacements.
You need to clear your operating system immediately. Even though your files will not be restored once you delete Mosk Ransomware, your operating system will become a much safer place, and you will be able to manage files, connect to backups, install new programs, and handle your virtual security overall. The .exe file – the one that launched the threat – could be anywhere, and so we cannot point you to it, but we can show you how to remove the remaining components. Of course, if you want to have all threats erased, and if you also want your system protected simultaneously, we strongly recommend installing anti-malware software.
Remove Mosk Ransomware
- Delete every copy of the ransom note file, _readme.txt.
- Delete all recently downloaded files that you do not recognize or are suspicious about.
- Simultaneously tap Windows and E keys to access Windows Explorer.
- Enter %LOCALAPPDATA% into the field at the top. Windows XP users need to enter %USERPROFILE%\Local Settings\Application Data\ instead.
- Delete the [unknown name] folder with a malicious [unknown name].exe file inside.
- Enter %WINDIR%\System32\Tasks\ into the field at the top.
- Delete the task called Time Trigger Task.
- Simultaneously tap Windows and R keys to access Run.
- Enter regedit into the dialog box and click OK to access Registry Editor.
- Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
- Delete the key named SysHelper if value data points to %LOCALAPPDATA%\[random]\[random].exe.
- Empty Recycle Bin.
- Install and use a malware scanner to perform a thorough system scan and check for leftovers.
In non-techie terms:
Mosk Ransomware encrypts files and then demands a ransom payment. We hope that victims of this malware can use a free decryptor or replace files using backups. If these options are not viable, victims might decide to pay the ransom, but we do not recommend doing that. The cybercriminals who created this malware created it for one purpose only, and that is to make money, and as soon as they get it, it is highly unlikely that they would hold up their end of the deal. After all, no one can force them to give you the decryptor. They are untouchable, and that gives them a lot of power. We hope that you do not need to take risks and, instead, you can focus on removing Mosk Ransomware. Even if you can do it manually using the guide above, we advise implementing anti-malware software because reliable, full-time Windows protection is the most important.