What is Ransomware and How to remove it using Quick Heal?

Ransomware is called so, because it holds the victim’s computer hostage in return for money (ransom) from the user. This post tells you about ransomware, and how Quick Heal helps you deal with it.

What is Ransomware?
Ransomware is a sophisticated malware. It hijacks the victim’s system and renders it nonfunctional. The malware prevents the user from using any applications or even accessing the operating system itself, until the victim agrees to pay a certain amount of money.

Ransomwares usually spread via infected software programs, malicious websites, and infected email attachments.

One type of ransomware, after infecting the victim’s computer, begins to encrypt the system’s data. To put it in another way, the malware kidnaps the data. Thereafter, the malware artist demands money in exchange for decrypting the data.

Some strains of ransomware only display a banner on the victim’s system. The banner claims that the government law-enforcement agency has fined the user for being associated with or performing illegal activities on the Internet such as:

1. Copyright infringement

2. Pornography

3. Child Pornography

4. Promoting terrorism

6. Gambling

Here are some examples:

[Note: click the images for an enlarged view.]

FBI-ransomware-banner

FBI-ransomware-banner1

FBI-ransomware-banner2

Precautionary Measures against Ransomwares

1. Keep your operating system/browser/plug-ins up-to-date with security patches and updates.

2. Use a multi-layered and reliable security software for your machine; keep it updated.

3. Ignore any unexpected or unsolicited mails, or any mail from sources you do not recognize.

4. Use Quick Heal for Autorun protection, so that no malware gets executed automatically through infected removable drives.

5. Keep your system’s restore point up-to-date; this makes it easier to remove malware if you just go back to an earlier, malware-free state.

How to remove Ransomware using Quick Heal?

A. Obtain an Emergency CD/Pen Dive

For this, as your machine is already infected by a ransomware, you would need another system where Quick Heal is installed and has the latest security updates.

Follow these steps to create an emergency CD/Pen Drive:

1. Open the dashboard of Quick Heal.

Go to Start-> Programs -> Quick Heal XXXX XXXX -> Quick Heal XXXX XXXX

quickheal-total-security-GUI

2. Click Tools; present at the top-right corner of the Quick Heal dashboard

quickheal-total-security-tools

3. Thereafter, click Create Emergency Disk

quickheal-total-securitycreate-emergency-disk

4. Follow the subsequent instructions to create the Emergency Disk

quickheal-total-securitycreate-emergency-disk1

quickheal-total-securitycreate-emergency-disk2

quickheal-total-securitycreate-emergency-disk3

quickheal-total-securitycreate-emergency-disk4

quickheal-total-securitycreate-emergency-disk5

create-disk

B. Perform Emergency Scan on the Infected System

1. Once the Emergency CD/Pen Drive is created, boot the disk rather than your affected system’s operating system. (Depending on your Operating System, switch on the infected machine, hit F8 or F7 before the Windows Logo pops up). Follow these steps:

a. Change the booting sequence from the Bios menu

b. Change the boot device priority to pen drive or cd drive

quickheal-total-securitycreate-emergency-disk6

2. Once it begins booting, you should see Quick Heal emergency Scan Disk in action cleaning the infection from the system.

quickheal-total-securitycreate-emergency-disk7

quickheal-total-securitycreate-emergency-disk8

quickheal-total-securitycreate-emergency-disk9

3. Once the scan is complete, your system will restart. Thereafter, follow these steps:

a. Change the booting sequence from the Bios menu

b. Change the boot device priority to Hard Disk Drive

4. If your system boots correctly, we advise you to run a Full System Scan of the system to remove footprints of any remaining ransomware, if any.

quickheal-total-security-full-system-scan

To conclude with a last piece of advice, paying the “fine (ransom)” will not necessarily return your computer to its normal state. We strongly advise our readers not to pay heed to such scams. Remember, with ransomwares, the threat of prosecution does not come from legitimate authorities.

Rajiv Singha

Rajiv Singha


78 Comments

Your email address will not be published.

CAPTCHA Image

  1. Avatar Hrushi SonarAugust 13, 2013 at 9:57 AM

    Thank you Rajib sir, and info of Ransomwares is really good and very use-full.

    Regards,
    Hrushi Sonar.

    Reply
  2. Avatar AMRIT KHOUNDAugust 13, 2013 at 3:55 PM

    Respected Quick Heal You Are Rocking always

    Reply
  3. Avatar Saurav MalviyaAugust 13, 2013 at 8:40 PM

    Thanks for detailed info of Ransomware its really good and very helpful.

    Regards,
    Saurav Malviya.

    Reply
  4. Avatar Jayant BabarAugust 14, 2013 at 12:03 PM

    Thanks for the detailed information and solution provided.

    Reply
  5. Avatar dr,r.h.gobbur.August 14, 2013 at 6:51 PM

    An I opener for novices like us.Useful blog indeed.

    Reply
  6. Avatar Digital GowdaAugust 14, 2013 at 7:31 PM

    Really new type of cyber crime or terrorism, people should be educated in this. The above article is really usefull

    Reply
  7. Avatar MANOJ DESAIAugust 14, 2013 at 7:42 PM

    Hi
    I feel money invested in Quickheal is paid up to the fullest. I strongly advise all to routinely check popup of Quickheal. The are very informative and helpful.

    Reply
  8. Avatar Davda NiteshAugust 14, 2013 at 7:47 PM

    Very good useful information.

    Thanks a Lot.

    Reply
  9. Avatar Saikat GuptaAugust 14, 2013 at 8:24 PM

    It’s really a useful post. Thanks rajib for the valuable information.

    Reply
  10. Avatar Abhishek SinghAugust 14, 2013 at 8:24 PM

    Thank you sir for this valuable information 🙂

    Reply
  11. It’s really very useful!
    Forewarned is fore-alarmed always!
    thank you very much.
    I have one question. i receive a message about code ndls. I suspect this to be a virus. please guide.
    thank you,
    mr. shekhar

    Reply
  12. Avatar Sharad PhadkeAugust 14, 2013 at 8:50 PM

    Two days back while replying email through “Thunderbird” all of a sudden my inbox of gmail was deleted.
    Is this some sort of malware?

    Reply
  13. Avatar CA BIMAL AGARWALLA, CUTTACKAugust 14, 2013 at 9:42 PM

    REALLY A USEFUL TOOL TO OVERCOME THE EMERGENCY SITUATION

    Reply
  14. Avatar Soumya Kanti MitraAugust 14, 2013 at 10:55 PM

    Thanks for a Great New topic…

    Reply
  15. Thnkqsss for this useful info. Now I know, how to deal with Ransomwares.

    Reply
  16. dear sir i have tried your suggested way but i am not successful in process
    if i require you help how can you help me
    my mail id given in previous dilog box.
    thanks
    madhur patel

    Reply
  17. very informative.thanq QH

    Reply
  18. Thank you Rajib sir, and info of Ransomwares is really good and very use-full.

    Regards
    satish trivedi

    Reply
  19. Avatar suresh dharma bhoirAugust 15, 2013 at 6:07 AM

    Thanks for providing important information about Ransom ware

    Reply
  20. Avatar Rajesh MenonAugust 15, 2013 at 6:32 AM

    Thank You Very Much For This Information __/__

    Reply
  21. Avatar vinod kumar pandeyAugust 15, 2013 at 7:40 AM

    does ransomware will affect those consumer also who are already having quickheal total security antiviruse software installed in it. if yes then how it should be removed.

    Reply
    • Rajiv Singha Rajiv SinghaAugust 19, 2013 at 12:35 PM

      Hi Vinod,

      Quick Heal offers multilayer protection. This protection is reinforced with proactive and reactive techniques to protect against known and unknown malware threats. A system having Quick Heal with the latest security updates prevents ransomware infection automatically. However, only in certain circumstances, if required, we need to follow the procedure (as mentioned in the post) to clean the infection manually.

      Regards,

      Reply
  22. Avatar MAHESH DASWANIAugust 15, 2013 at 8:59 AM

    Thank you so much for this information. It is really helpful. I will be careful and if God forbids then will follow this to get back.
    Regards, Mahesh

    Reply
  23. Avatar P B KakathkarAugust 15, 2013 at 9:11 AM

    Sir, This is very useful and important information. Thank you.

    Reply
  24. Avatar Ashish KOlarkarAugust 15, 2013 at 9:23 AM

    A very good post and timely information

    Reply
  25. Avatar Satadal GuruAugust 15, 2013 at 9:38 AM

    Very good information. I don’t know about that malware but now i know, Thanks very much.

    Reply
  26. Avatar Dr. A.S. DevakumarAugust 15, 2013 at 9:46 AM

    Thanks very much for the information

    Reply
  27. very useful info

    Reply
  28. Avatar Bhavesh SharmaAugust 15, 2013 at 11:55 AM

    Thank You Very Much…
    QH you are great

    Reply
  29. good info.and very much
    ]

    Reply
  30. Avatar Ashish RaneAugust 15, 2013 at 12:39 PM

    Thanks for the info. I really appreciate. Quick Heal rocks.

    Reply
  31. Avatar Abdulmanan KhatriAugust 15, 2013 at 4:52 PM

    Great news for helps and protect our data…. It is real security… I♥QuickHeal…

    Reply
  32. Thank U for the information……

    Reply
  33. Avatar asoke kumar mitraAugust 15, 2013 at 11:53 PM

    very useful information, it must be notified in press..

    Reply
  34. Avatar shreem jainAugust 16, 2013 at 1:01 AM

    thanks for this info thanq so so so much…………………………………………………………………………………………………………………………………..

    Reply
  35. I’m really grateful for the advice

    Reply
  36. Avatar sreyashi B.August 16, 2013 at 8:11 AM

    verymuch helpful blog posted !thankyou.

    Reply
  37. I paid for full verious then my mobile said this key is not valid nd i m try num then say this num is not valid please check the num.

    Reply
  38. Avatar ATUL KUMAR VARMAAugust 16, 2013 at 9:12 AM

    Thank you. It has made me more alert against ransom ware notifications.

    Reply
  39. Avatar DR.M.M.KarvaAugust 16, 2013 at 9:35 AM

    Nice & imp.information! Thanks a lot!

    Reply
  40. Very useful advice and with clear and easy instructions. Thanks.

    Reply
  41. Thank you very much for providing such useful information. Thank You again.

    Reply
  42. Avatar Javed HashmiAugust 16, 2013 at 11:41 AM

    Thanks for this useful information

    Reply
  43. Avatar S.M. ZAHID NAQVIAugust 16, 2013 at 2:28 PM

    Thanx, for valuable information.

    Reply
  44. Thanks, information well noted.
    Really helpful.

    Reply
  45. Avatar SUTANU MUKHERJEEAugust 16, 2013 at 9:15 PM

    Thanks a lot Rajib. It was compleatly unknown to me. I think it is a most dangerous malware I ever hard.

    Reply
  46. this app is really awesome

    Reply
  47. awesome antivirus

    Reply
  48. Avatar Dr. S.N.TYAGIAugust 17, 2013 at 9:43 AM

    Thanks for this useful information

    Reply
  49. Good, valuable information

    Reply
  50. Avatar Birender Kumar SharmaAugust 17, 2013 at 3:02 PM

    very helpful information…………thanks

    Reply
  51. all the info is good but i cant do. Please give a video of the above. In our system there is a TROJAN virus that we can’t clear. Please do about this type of VIRUS.

    regards

    Thanks

    Reply
  52. Avatar Kausik PaulAugust 17, 2013 at 8:40 PM

    very helpful information…………thanks

    Reply
  53. So educative,keep it up.

    Reply
  54. Thanx…
    Nice description….

    Reply
  55. Avatar Ansumay DattaAugust 18, 2013 at 6:38 PM

    Very useful advice.

    Reply
  56. Avatar Jayesh ShahAugust 18, 2013 at 7:44 PM

    Thanks. Good information.

    Reply
  57. Avatar gayadhara beheraAugust 19, 2013 at 12:51 AM

    its a awesome antivirous… bcz when I go to play store and download any thing its catch the virous software and its detected then I will uninstall that.

    Reply
  58. Avatar gayadhara beheraAugust 19, 2013 at 12:53 AM

    it’s awesome antivirous

    Reply
  59. The best feature of QH is Emergency Disk and very useful advise against the ransom ware

    Reply
  60. CLEAN LOCKY VIRUS IN Quick Heal ?
    HELP ME

    Reply
  61. Avatar ARUN JADHAVAugust 3, 2016 at 8:01 PM

    i always trust with quickheal antivirus. by the way thanks for the giving such a kind of information about the ransomware virus removal procedures.

    Reply
  62. Avatar SRIJIT BHARAugust 23, 2016 at 3:44 PM

    Please help me.

    Reply
  63. Avatar nidhish85@gmail.comSeptember 15, 2016 at 7:49 PM

    My laptop is infected by Ransomwares which encrypted my all documents, photos, databases and other important files. my question is there any way to decrypted my all stuff. please help me out from this life hunting situation

    Reply
    • Rajiv Singha Rajiv SinghaOctober 19, 2016 at 4:09 PM

      Hi,

      Unfortunately, files encrypted by a ransomware cannot be decrypted without using the private key that is being sold for a ransom.

      Regards,

      Reply
  64. how to recover the encrypted files which was already affected by the ransom ware

    Reply
    • Rajiv Singha Rajiv SinghaOctober 19, 2016 at 3:49 PM

      Hi Sanjib,

      Thanks for writing in. Files once encrypted by a ransomware cannot be decrypted without the private key which needs to be bought with the demanded ransom.

      Regards,

      Reply
  65. Avatar Shantanu KhandelwalSeptember 25, 2016 at 9:24 AM

    Hi. My friend disabled quick heal for a few moments before installing a software downloaded over the internet. Thereafter, all files in the PC have been encrypted and ransom is being demanded. Using this method, will we able to decrypt the files?

    Reply
  66. Avatar Ashis SardarNovember 11, 2016 at 7:04 PM

    I am using QH Internet Security. one month back ransom malware attract on my desktop. QH support team member not to recover my data (Word Xls, PPT ) file.
    I am really help less. we lost our 12 yrs company data. If any solution please give me call or mail me to retrive my data.
    Mobile no: 9051084433
    mail id ashis.sardar@priyaentertainments.com

    Reply