Do you know what Prometey Ransomware is?
Prometey Ransomware is a Windows infection that is likely to use remote access vulnerabilities, bundle downloaders, spam emails, and, possibly, other infections to access unprotected systems. If it manages to do so, this malware can kill certain processes, drop its own files, and also delete shadow volume copies to ensure that victims cannot use system restore points to evade full encryption of personal files. Needless to say, this malware cannot affect external drives or cloud storage systems, and so if you have backups stored externally, you should be able to replace the encrypted files. If that is not the case, you might be convinced to take risky actions, which we discuss further in the report. We also discuss the removal of Prometey Ransomware. Even though files cannot be restored by eliminating this threat, it must be destroyed as soon as possible.
When our research team tested Prometey Ransomware, its C&C server was no longer working, and so the infection itself was not functioning as intended. It is possible that the attackers behind this malware have already abandoned it, but it is also possible that a new server could be set up and that the threat could be revived in the future. When the infection was still fully functional, it dropped files named “DirectX1I.dll” and “news.html” to the %WINDIR% directory. It also dropped a .txt file with an unknown name, and this file presented a message from the attackers. It informed victims that files were encrypted and that they would be deleted if the computer was restarted. The message proposed an alleged solution claiming that victims could restore their files if they downloaded the Tor Browser, followed the presented link, and then fulfilled the demands introduced to them.
It does not take a lot of imagination to speculate that the victims of Prometey Ransomware were asked to pay money in return for decryption software or decryption services. Cybercriminals always create malware with some kind of a purpose, and, in most cases, it is to steal money. Although Prometey Ransomware cannot steal banking information or hijack banking accounts to take money, it can take personal files hostage to convince victims to pay a ransom. Whether you face Ponce.lorena@aol.com Ransomware, Dever Ransomware, Chch Ransomware, or any other file-encryptor, you need to be very cautious about the demands that cybercriminals make. It is most likely that you would waste money by paying a ransom requested by any of these threats. Needless to say, we do not recommend paying the ransom at all. Does that mean that you have to accept the loss of files? Hopefully, you do not need to because you have backups stored outside the infected computer.
Before you can replace the encrypted files with backups – which we hope you have – you need to delete Prometey Ransomware from your operating system. Since this malware was not fully functional at the time of research, we hope that the threat no longer spreads and that Windows users will not need to worry about its removal in the future. Just in case you have only now got the chance to delete the threat, we strongly advise implementing anti-malware software. It will automatically remove Prometey Ransomware, and your system’s protection will be reestablished also. If you choose to remove the threat manually, do not forget to secure it afterward because there are plenty of other threats that could attack.
Remove Prometey Ransomware
- Delete all suspicious, recently downloaded files.
- Tap Win+E keys at the same time to launch Explorer.
- Enter %windir% into the quick access bar at the top.
- Delete files names DirectX1I.dll and news.html.
- Empty Recycle Bin.
- Install and run a malware scanner to check for leftovers.
In non-techie terms:
When Prometey Ransomware encrypts files, they cannot be restored manually, and free tools that could do it do not exist either. Unfortunately, that is what makes some victims take unnecessary risks. As soon as files are encrypted, the threat introduces a message that suggests following cybercriminals’ demands. Eventually, victims are asked to pay a ransom in return for a decryptor, and if you do that, you are likely to waste your money. This is why we do not recommend following attackers’ demands. If you have backups of your personal files stored outside the computer, you do not even need to consider this option. All you have to do is delete Prometey Ransomware and then replace the corrupted files with the copies that you have. To have the threat deleted fully and completely, we recommend implementing legitimate anti-malware software.