Blog

Rajib Singha
What is Ransomware and How to remove it using Quick Heal?
August 12, 2013

Ransomware is called so, because it holds the victim’s computer hostage in return for money (ransom) from the user. This post tells you about ransomware, and how Quick Heal helps you deal with it.

What is Ransomware?
Ransomware is a sophisticated malware. It hijacks the victim’s system and renders it nonfunctional. The malware prevents the user from using any applications or even accessing the operating system itself, until the victim agrees to pay a certain amount of money.

Ransomwares usually spread via infected software programs, malicious websites, and infected email attachments.

One type of ransomware, after infecting the victim’s computer, begins to encrypt the system’s data. To put it in another way, the malware kidnaps the data. Thereafter, the malware artist demands money in exchange for decrypting the data.

Some strains of ransomware only display a banner on the victim’s system. The banner claims that the government law-enforcement agency has fined the user for being associated with or performing illegal activities on the Internet such as:

1. Copyright infringement

2. Pornography

3. Child Pornography

4. Promoting terrorism

6. Gambling

Here are some examples:

[Note: click the images for an enlarged view.]

FBI-ransomware-banner

FBI-ransomware-banner1

FBI-ransomware-banner2

Precautionary Measures against Ransomwares

1. Keep your operating system/browser/plug-ins up-to-date with security patches and updates.

2. Use a multi-layered and reliable security software for your machine; keep it updated.

3. Ignore any unexpected or unsolicited mails, or any mail from sources you do not recognize.

4. Use Quick Heal for Autorun protection, so that no malware gets executed automatically through infected removable drives.

5. Keep your system’s restore point up-to-date; this makes it easier to remove malware if you just go back to an earlier, malware-free state.

How to remove Ransomware using Quick Heal?

A. Obtain an Emergency CD/Pen Dive

For this, as your machine is already infected by a ransomware, you would need another system where Quick Heal is installed and has the latest security updates.

Follow these steps to create an emergency CD/Pen Drive:

1. Open the dashboard of Quick Heal.

Go to Start-> Programs -> Quick Heal XXXX XXXX -> Quick Heal XXXX XXXX

quickheal-total-security-GUI

2. Click Tools; present at the top-right corner of the Quick Heal dashboard

quickheal-total-security-tools

3. Thereafter, click Create Emergency Disk

quickheal-total-securitycreate-emergency-disk

4. Follow the subsequent instructions to create the Emergency Disk

quickheal-total-securitycreate-emergency-disk1

quickheal-total-securitycreate-emergency-disk2

quickheal-total-securitycreate-emergency-disk3

quickheal-total-securitycreate-emergency-disk4

quickheal-total-securitycreate-emergency-disk5

create-disk

B. Perform Emergency Scan on the Infected System

1. Once the Emergency CD/Pen Drive is created, boot the disk rather than your affected system’s operating system. (Depending on your Operating System, switch on the infected machine, hit F8 or F7 before the Windows Logo pops up). Follow these steps:

a. Change the booting sequence from the Bios menu

b. Change the boot device priority to pen drive or cd drive

quickheal-total-securitycreate-emergency-disk6

2. Once it begins booting, you should see Quick Heal emergency Scan Disk in action cleaning the infection from the system.

quickheal-total-securitycreate-emergency-disk7

quickheal-total-securitycreate-emergency-disk8

quickheal-total-securitycreate-emergency-disk9

3. Once the scan is complete, your system will restart. Thereafter, follow these steps:

a. Change the booting sequence from the Bios menu

b. Change the boot device priority to Hard Disk Drive

4. If your system boots correctly, we advise you to run a Full System Scan of the system to remove footprints of any remaining ransomware, if any.

quickheal-total-security-full-system-scan

To conclude with a last piece of advice, paying the “fine (ransom)” will not necessarily return your computer to its normal state. We strongly advise our readers not to pay heed to such scams. Remember, with ransomwares, the threat of prosecution does not come from legitimate authorities.

Have something to add to this story? Share it in the comments.

Rajib Singha
About Rajib Singha
Rajib is a Physics graduate and a technology enthusiast. Besides having a keen interest in the latest gadgets, he is also into IT security and all that it...
Articles by Rajib Singha »

78 Comments

Your email address will not be published.

CAPTCHA Image

  1. Hrushi SonarAugust 13, 2013 at 9:57 AM

    Thank you Rajib sir, and info of Ransomwares is really good and very use-full.

    Regards,
    Hrushi Sonar.

    Reply
  2. AMRIT KHOUNDAugust 13, 2013 at 3:55 PM

    Respected Quick Heal You Are Rocking always

    Reply
  3. Saurav MalviyaAugust 13, 2013 at 8:40 PM

    Thanks for detailed info of Ransomware its really good and very helpful.

    Regards,
    Saurav Malviya.

    Reply
  4. Jayant BabarAugust 14, 2013 at 12:03 PM

    Thanks for the detailed information and solution provided.

    Reply
  5. dr,r.h.gobbur.August 14, 2013 at 6:51 PM

    An I opener for novices like us.Useful blog indeed.

    Reply
  6. Digital GowdaAugust 14, 2013 at 7:31 PM

    Really new type of cyber crime or terrorism, people should be educated in this. The above article is really usefull

    Reply
  7. MANOJ DESAIAugust 14, 2013 at 7:42 PM

    Hi
    I feel money invested in Quickheal is paid up to the fullest. I strongly advise all to routinely check popup of Quickheal. The are very informative and helpful.

    Reply
  8. Davda NiteshAugust 14, 2013 at 7:47 PM

    Very good useful information.

    Thanks a Lot.

    Reply
  9. Saikat GuptaAugust 14, 2013 at 8:24 PM

    It’s really a useful post. Thanks rajib for the valuable information.

    Reply
  10. Abhishek SinghAugust 14, 2013 at 8:24 PM

    Thank you sir for this valuable information 🙂

    Reply
  11. It’s really very useful!
    Forewarned is fore-alarmed always!
    thank you very much.
    I have one question. i receive a message about code ndls. I suspect this to be a virus. please guide.
    thank you,
    mr. shekhar

    Reply
  12. Sharad PhadkeAugust 14, 2013 at 8:50 PM

    Two days back while replying email through “Thunderbird” all of a sudden my inbox of gmail was deleted.
    Is this some sort of malware?

    Reply
  13. CA BIMAL AGARWALLA, CUTTACKAugust 14, 2013 at 9:42 PM

    REALLY A USEFUL TOOL TO OVERCOME THE EMERGENCY SITUATION

    Reply
  14. Soumya Kanti MitraAugust 14, 2013 at 10:55 PM

    Thanks for a Great New topic…

    Reply
  15. Thnkqsss for this useful info. Now I know, how to deal with Ransomwares.

    Reply
  16. dear sir i have tried your suggested way but i am not successful in process
    if i require you help how can you help me
    my mail id given in previous dilog box.
    thanks
    madhur patel

    Reply
  17. very informative.thanq QH

    Reply
  18. Thank you Rajib sir, and info of Ransomwares is really good and very use-full.

    Regards
    satish trivedi

    Reply
  19. suresh dharma bhoirAugust 15, 2013 at 6:07 AM

    Thanks for providing important information about Ransom ware

    Reply
  20. Rajesh MenonAugust 15, 2013 at 6:32 AM

    Thank You Very Much For This Information __/__

    Reply
  21. vinod kumar pandeyAugust 15, 2013 at 7:40 AM

    does ransomware will affect those consumer also who are already having quickheal total security antiviruse software installed in it. if yes then how it should be removed.

    Reply
    • Hi Vinod,

      Quick Heal offers multilayer protection. This protection is reinforced with proactive and reactive techniques to protect against known and unknown malware threats. A system having Quick Heal with the latest security updates prevents ransomware infection automatically. However, only in certain circumstances, if required, we need to follow the procedure (as mentioned in the post) to clean the infection manually.

      Regards,

      Reply
  22. MAHESH DASWANIAugust 15, 2013 at 8:59 AM

    Thank you so much for this information. It is really helpful. I will be careful and if God forbids then will follow this to get back.
    Regards, Mahesh

    Reply
  23. P B KakathkarAugust 15, 2013 at 9:11 AM

    Sir, This is very useful and important information. Thank you.

    Reply
  24. Ashish KOlarkarAugust 15, 2013 at 9:23 AM

    A very good post and timely information

    Reply
  25. Satadal GuruAugust 15, 2013 at 9:38 AM

    Very good information. I don’t know about that malware but now i know, Thanks very much.

    Reply
  26. Dr. A.S. DevakumarAugust 15, 2013 at 9:46 AM

    Thanks very much for the information

    Reply
  27. very useful info

    Reply
  28. Bhavesh SharmaAugust 15, 2013 at 11:55 AM

    Thank You Very Much…
    QH you are great

    Reply
  29. good info.and very much
    ]

    Reply
  30. Ashish RaneAugust 15, 2013 at 12:39 PM

    Thanks for the info. I really appreciate. Quick Heal rocks.

    Reply
  31. Abdulmanan KhatriAugust 15, 2013 at 4:52 PM

    Great news for helps and protect our data…. It is real security… I♥QuickHeal…

    Reply
  32. Thank U for the information……

    Reply
  33. asoke kumar mitraAugust 15, 2013 at 11:53 PM

    very useful information, it must be notified in press..

    Reply
  34. shreem jainAugust 16, 2013 at 1:01 AM

    thanks for this info thanq so so so much…………………………………………………………………………………………………………………………………..

    Reply
  35. I’m really grateful for the advice

    Reply
  36. sreyashi B.August 16, 2013 at 8:11 AM

    verymuch helpful blog posted !thankyou.

    Reply
  37. I paid for full verious then my mobile said this key is not valid nd i m try num then say this num is not valid please check the num.

    Reply
  38. ATUL KUMAR VARMAAugust 16, 2013 at 9:12 AM

    Thank you. It has made me more alert against ransom ware notifications.

    Reply
  39. DR.M.M.KarvaAugust 16, 2013 at 9:35 AM

    Nice & imp.information! Thanks a lot!

    Reply
  40. Very useful advice and with clear and easy instructions. Thanks.

    Reply
  41. Thank you very much for providing such useful information. Thank You again.

    Reply
  42. Javed HashmiAugust 16, 2013 at 11:41 AM

    Thanks for this useful information

    Reply
  43. S.M. ZAHID NAQVIAugust 16, 2013 at 2:28 PM

    Thanx, for valuable information.

    Reply
  44. Thanks, information well noted.
    Really helpful.

    Reply
  45. SUTANU MUKHERJEEAugust 16, 2013 at 9:15 PM

    Thanks a lot Rajib. It was compleatly unknown to me. I think it is a most dangerous malware I ever hard.

    Reply
  46. this app is really awesome

    Reply
  47. awesome antivirus

    Reply
  48. Dr. S.N.TYAGIAugust 17, 2013 at 9:43 AM

    Thanks for this useful information

    Reply
  49. Good, valuable information

    Reply
  50. Birender Kumar SharmaAugust 17, 2013 at 3:02 PM

    very helpful information…………thanks

    Reply
  51. all the info is good but i cant do. Please give a video of the above. In our system there is a TROJAN virus that we can’t clear. Please do about this type of VIRUS.

    regards

    Thanks

    Reply
  52. Kausik PaulAugust 17, 2013 at 8:40 PM

    very helpful information…………thanks

    Reply
  53. So educative,keep it up.

    Reply
  54. Thanx…
    Nice description….

    Reply
  55. Ansumay DattaAugust 18, 2013 at 6:38 PM

    Very useful advice.

    Reply
  56. Jayesh ShahAugust 18, 2013 at 7:44 PM

    Thanks. Good information.

    Reply
  57. gayadhara beheraAugust 19, 2013 at 12:51 AM

    its a awesome antivirous… bcz when I go to play store and download any thing its catch the virous software and its detected then I will uninstall that.

    Reply
  58. gayadhara beheraAugust 19, 2013 at 12:53 AM

    it’s awesome antivirous

    Reply
  59. The best feature of QH is Emergency Disk and very useful advise against the ransom ware

    Reply
  60. CLEAN LOCKY VIRUS IN Quick Heal ?
    HELP ME

    Reply
  61. ARUN JADHAVAugust 3, 2016 at 8:01 PM

    i always trust with quickheal antivirus. by the way thanks for the giving such a kind of information about the ransomware virus removal procedures.

    Reply
  62. SRIJIT BHARAugust 23, 2016 at 3:44 PM

    Please help me.

    Reply
  63. nidhish85@gmail.comSeptember 15, 2016 at 7:49 PM

    My laptop is infected by Ransomwares which encrypted my all documents, photos, databases and other important files. my question is there any way to decrypted my all stuff. please help me out from this life hunting situation

    Reply
    • Rajib Singha Rajib SinghaOctober 19, 2016 at 4:09 PM

      Hi,

      Unfortunately, files encrypted by a ransomware cannot be decrypted without using the private key that is being sold for a ransom.

      Regards,

      Reply
  64. how to recover the encrypted files which was already affected by the ransom ware

    Reply
    • Rajib Singha Rajib SinghaOctober 19, 2016 at 3:49 PM

      Hi Sanjib,

      Thanks for writing in. Files once encrypted by a ransomware cannot be decrypted without the private key which needs to be bought with the demanded ransom.

      Regards,

      Reply
  65. Shantanu KhandelwalSeptember 25, 2016 at 9:24 AM

    Hi. My friend disabled quick heal for a few moments before installing a software downloaded over the internet. Thereafter, all files in the PC have been encrypted and ransom is being demanded. Using this method, will we able to decrypt the files?

    Reply
  66. Ashis SardarNovember 11, 2016 at 7:04 PM

    I am using QH Internet Security. one month back ransom malware attract on my desktop. QH support team member not to recover my data (Word Xls, PPT ) file.
    I am really help less. we lost our 12 yrs company data. If any solution please give me call or mail me to retrive my data.
    Mobile no: 9051084433
    mail id ashis.sardar@priyaentertainments.com

    Reply