If your personal files, such as documents, photos, music does not open normally, their names changed on something like email-salazar_slytherin10@yahoo.com.ver-CL 1.3.1.0.id-xxx then your computer is infected with a new virus from a family of file-encrypting ransomware. Once started, it have encrypted your personal files stored on a computer drives and attached network drives.
It uses very strong hybrid encryption with a large key. When the ransomware encrypts a file, it will change filename to the email-salazar_slytherin10@yahoo.com.ver-[VERSION].id-[ID]-[DATA].randomname-[RANDOM] to each encrypted file.
The cyber criminals, authors of salazar_slytherin10@yahoo.com virus offers to make a payment in Bitcoins to get a key to decrypt files. Important to know, currently not possible to decrypt the files encrypted by the ransomware without the private key and decrypt program.
If you choose to pay the ransom, there is no 100% guarantee that you can get back your files! If you do not want to pay for a decryption key, then you have a chance to restore your files. Use the step-by-step guide below to remove the virus itself and try to restore your files.
- What is salazar_slytherin10@yahoo.com ransomware?
- Is my system infected with salazar_slytherin10@yahoo.com ransomware?
- How does my computer get infected with salazar_slytherin10@yahoo.com virus ?
- How to decrypt salazar_slytherin10@yahoo.com files ?
- How to remove salazar_slytherin10@yahoo.com virus?
- How to restore email-salazar_slytherin10@yahoo.com files ?
- How to prevent my computer from becoming infected by salazar_slytherin10@yahoo.com ransomware?
What is salazar_slytherin10@yahoo.com ransomware?
This virus is a variant of the Cbf ransomware infection. It affects all current versions of Windows operating systems such as Windows XP, Windows Vista, Windows 7, Windows 8, Windows 10. This virus uses a hybrid AES + RSA encryption mode to eliminate the possibility of brute force a key, which will allow to decrypt all encrypted files.
When the virus infects a computer, it uses system directories to store own files. To run automatically whenever you turn on your computer, salazar_slytherin10@yahoo.com ransomware creates a registry entry in Windows: sections HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run, HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ RunOnce, HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run, HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ RunOnce.
Immediately after the launch, the virus scans all available drives, including network and cloud storage, to determine which files will be encrypted. The ransomware uses the file name extension, as a way to define a group of files that will be subjected to encrypting. Encrypted almost all types of files, including common as:
0, .1, .1st, .2bp, .3dm, .3ds, .sql, .mp4, .7z, .rar, .m4a, .wma, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum, .ibank, .t13, .t12, .qdf, .gdb, .tax, .pkpass, .bc6, .bc7, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps, .docm, .docx, .doc, .odb, .odc, .odm, .odp, .ods, .odt, .wav, .wbc, .wbd, .wbk, .wbm, .wbmp, .wbz, .wcf, .wdb, .wdp, .webdoc, .webp, .wgz, .wire, .wm, .wma, .wmd, .wmf, .wmv, .wn, .wot, .wp, .wp4, .wp5, .wp6, .wp7, .wpa, .wpb, .wpd, .wpe, .wpg, .wpl, .wps, .wpt, .wpw, .wri, .ws, .wsc, .wsd, .wsh, .x, .x3d, .x3f, .xar, .xbdoc, .xbplate, .xdb, .xdl, .xld, .xlgc, .xll, .xls, .xlsm, .xlsx, .xmind, .xml, .xmmap, .xpm, .xwp, .xx, .xy3, .xyp, .xyw, .y, .yal, .ybk, .yml, .ysp, .z, .z3d, .zabw, .zdb, .zdc, .zi, .zif, .zip, .zw
Once a file is encrypted, its name changed to email-salazar_slytherin10@yahoo.com.ver-[VERSION].id-[ID]-[DATA].randomname-[RANDOM]. Next, the virus creates a file named “README.txt”. This file contain instructions on how to decrypt all encrypted files. An example of these instructions:
ATTENTION!
Your computer was attacked by trojan called cryptolocker. All your files are encrypted with cryptographically strong algorithm, and without original decryption key recovery is impossible.
To get your unique key and decode your files, you need to write us at email written below during 72 hours, otherwise your files will be destroyed forever!
salazar_slytherin10@yahoo.com
Is my system infected with salazar_slytherin10@yahoo.com ransomware?
Identify that your computer is infected with salazar_slytherin10@yahoo.com ransomware quite easily. If your personal files, such as documents, photos, music does not open normally, filenames changed, then your computer is infected. Of course, the presence on the desktop a ransom screen or threatening message is a sign of infection.
If you suspect that you have opened a email that infected with salazar_slytherin10@yahoo.com ransomware, but you does not see any symptoms of the infection, then do not turn off or restart your computer. First turn off the Internet! Then follow the steps in this guide, see How to remove the salazar_slytherin10@yahoo.com virus. Another option, shut down the computer, remove the hard drive and check it on another computer.
How does my computer get infected with salazar_slytherin10@yahoo.com virus
salazar_slytherin10@yahoo.com virus is distributed through the use of spam emails. Below is an email that is infected with a virus like salazar_slytherin10@yahoo.com ransomware.
Once this attachment has been opened, this virus will be started automatically as you do not even notice that. salazar_slytherin10@yahoo.com ransomware will start the encryption process.
How to decrypt salazar_slytherin10@yahoo.com files
Currently there is no available method to decrypt all encrypted files. The ransomware uses a strong encryption algorithm with 2048-bit key. What does it mean to decrypt the files is impossible without the private key. Use a “brute forcing” method is also not a way because of the big length of the key. Therefore, unfortunately, the only payment to the authors of the salazar_slytherin10@yahoo.com ransomware entire amount requested – the only way to try to get the decryption key. To contact the authors of this malicious program, look for the name of the encrypted files. Each of them contains the contact details – e-mail address. For example, the encrypted file is named:
email-salazar_slytherin10@yahoo.com.ver-CL_1.3.1.0.id-xxx
Then to get an instructions on how to decrypt all encrypted files you should send a email to salazar_slytherin10@yahoo.com
There is absolutely no guarantee that after the payment of the authors of the salazar_slytherin10@yahoo.com ransomware will provide the necessary key to decrypt your files. In addition, you must understand that paying money to the cyber criminals, you are encouraging them to create a new virus.
How to remove salazar_slytherin10@yahoo.com virus
The following instructions will help you to remove this malicious software. Before doing it, you need to know that starting to remove the virus, you may block the ability to decrypt files by paying authors of the virus requested ransom.
Kaspersky Virus Removal Tool and Malwarebytes Anti-malware can detect different types of active ransomware and easily remove it from your computer, but they can not recover encrypted files.
5.1. Remove salazar_slytherin10@yahoo.com virus with MalwareBytes Anti-malware
Download MalwareBytes Anti-malware (MBAM) from the link below.
MalwareBytes Anti-malware download link
Once downloaded, close all programs and windows on your computer. Open a directory in which you saved it. Double-click on the icon that named mbam-setup like below.
When the installation begins, you will see the Setup – Wizard that will help you install MalwareBytes Anti-malware on your computer.
Once installation is complete, you will see window similar to the one below.
Now click on the Scan Now button to start scanning your computer. This procedure can take some time, so please be patient.
When the scan is finished, make sure all entries have “checkmark” and click Remove Selected button. MalwareBytes Anti-malware will start to remove ransoware related files, folders, registry keys. Once disinfection is completed, you may be prompted to Restart.
5.2. Remove salazar_slytherin10@yahoo.com virus with Kaspersky virus removal tool
Download Kaspersky virus removal tool from here and save it directly to your Windows Desktop.
Double-click on the KVRT icon found on your desktop. Once initialization process is finished, you will see the Kaspersky virus removal tool screen as shown below.
Click Change Parameters and set a check near all your drives. Click OK to close the Parameters window. Next click Start scan button. Kaspersky virus removal tool will now start scanning your computer for known infections. This procedure can take some time, so please be patient.
When KVRT has finished scanning, you will see a screen like shown below.
Click on Continue to start a cleaning process.
How to restore email-salazar_slytherin10@yahoo.com files
In some cases, you can recover files encrypted by ransomware. Try both methods. Important to understand that we cannot guarantee that you will be able to recover all encrypted documents, photos and other files.
6.1. Restore email-salazar_slytherin10@yahoo.com files with ShadowExplorer
Download ShadowExplorer from the following link.
Open a directory in which you saved it. Right click to ShadowExplorer-0.9-portable and select Extract all. Follow the prompts. Next please open the ShadowExplorerPortable folder as shown below.
Double click ShadowExplorerPortable to run it. You will see the following screen.
In top left corner, select a Drive and a latest restore point as shown on the example below (1 – drive, 2 – restore point).
On right panel look for a file that you want to restore, right click to it and select Export. An example below.
6.2. Restore email-salazar_slytherin10@yahoo.com files with PhotoRec
Download PhotoRec from the link below.
Open a directory in which you saved it. Right click to testdisk-7.0.win and select Extract all. Follow the prompts. Next please open the testdisk-7.0 folder as shown below.
Double click on qphotorec_win to run PhotoRec for Windows. It will open a screen like below.
Select a drive to recover from as shown below.
You will see a list of available partitions. Select a partition that holds the lost and encrypted files. An example below.
Click on File Formats button and select file types to recover. You can to enable or disable the recovery of certain file types. When this is done, click OK button.
Next, click Browse button to select where recovered files should be written, then click Search.
Count of recovered files is updated in real time. All recovered files are written in a folder that you have selected on the previous step. You can to access the files even if the recovery process is not finished.
When the recovery is completed, click on Quit button. Next, open the directory where recovery files are stored. You will see a contents like below.
All recovered files are written in recup_dir.1, recup_dir.2 … sub-directories. If you are looking for a specific file, then you can to sort your recovered files by extension and/or date/time.
How to prevent my computer from becoming infected by salazar_slytherin10@yahoo.com ransomware?
Most antivirus programs already have built-in protection system against the ransomware. Therefore, if your computer does not have an antivirus program, make sure you install it. As an extra protection, use the CryptoPrevent.
Download CryptoPrevent from the link below.
www.foolishit.com/download/cryptoprevent/
Run it and follow the setup wizard. Once the installation is completed, you will be shown a window where you can select a level of protection, as shown in the following example.
Click the Apply button to activate the protection.
The End.
Your computer should now be free of the email-salazar_slytherin10@yahoo.com virus infection. If you need help with the instructions, then ask for help here.
