How to remove PClock virus

PClock is the threat considered to be a ransomware-type

PClock virus is one of the most aggressive cyber threats that are spread around the world quickly. If you know what Cryptolocker is, then you will have no problem understanding what the PClock virus is. For those who are not familiar with this threat, we will say that it is capable of infiltrating computers without being noticed, encrypting almost every file that can be found on the system (*.xls, *.docx, *.doc, *.text, *.jpg, *.jpeg, *.ppt, *.pdf, *.pps, *.wps, *.pptm, *.pptx, *.pst, *.zip, *.tar, *.rar, etc.) and then asking to pay a ransom in exchange for unblocking affected files.

PClock virus relies on XOR encryption routine when trying to block target system files, so there is no surprise that there is the only method that can be used for the decryption of these files and this method is to pay a ransom and get the key. You can hardly miss the fact that your computer was affected by this ransomware because as soon as it finishes encrypting your files, it shows a huge warning message asking to pay a ransom.

The ransom message that PClock displays:

Support e-mail: suppteam01@india.com suppteam01@yandex.ru
Your personal files encryption produced on this computer: photos, videos, documents, etc.
Encryption was produced using a unique public key RSA-2048 generated for this computer.
To decrypt files you need to obtain the private key.
The single copy of the private key, which will allow to decrypt the files,
located on a secret server on the Internet; the server will destroy the key after 120 hours.
After that nobody and never will be able to restore files.
To obtain the private key for this computer, you need pay 1.2 Bitcoin (~761 USD)
—————————————————————————————————
Your Bitcoin address:
14DuLWSHUQt2CKTsWCjpos4RYBFzvgxrLW
You must send 1.2 Bitcoin to the specified address and report it to e-mail customer support.
In the letter must specify your Bitcoin address to which the payment was made.
—————————————————————————————————
The most convenient tool for buying Bitcoins in our opinion is the site:
hxxps://localbitcoins.com/
There you can buy Bitcoins in your country in any way you like, including electronic payment systems,
credit and debit cards, money orders, and others.
Instructions for purchasing Bitcoins on account localbitcoins.com read here:
hxxps://localbitcoins.com/guides/how-to-buy-bitcoins
Video tutorial detailing on buying Bitcoins using the site localbitcoins.com here:
hxxp://www.youtube.com/watch?v=hroPcR-0zSI
How to withdraw Bitcoins from account localbitcoins.com to our bitcoin wallet:
hxxps://localbitcoins.com/faq#howto_buy
Also you can use to buy Bitcoins these sites:
hxxps://www.bitstamp.net/ – Big BTC exchanger
hxxps://www.coinbase.com/ – Other big BTC exchanger
hxxps://www.moneypakforbitcoins.us/ – Buy BTC via Green Dot MoneyPak
hxxps://btcdirect.eu/ – Best for Europe
hxxps://coincafe.com/ – Recommended for fast, many payment methods
hxxps://bittylicious.com/ – Good service for Europe and World
hxxps://www.247exchange.com/ – Other exchanger

This payment should be made in bitcoins and within 72 hours. Please, do NOT make this payment because it might be that it won't help you to recover the connection to your files. For that, you should install SpyHunterCombo Cleaner or MalwarebytesMalwarebytes and run a full system scan with it. In order to recover your affected files, you can try to use the alternatives listed below.

Ways computers get infected

PClock is spread using well-known techniques that should be kept in mind forever. One of the mostly-used methods relies on fake notifications that report about such things as missing updates, possible infections, or even discounts. Once any of such ads is clicked, the computer is infected by a trojan horse, which is additionally used for making predetermined system changes and also encrypting required files.

If you want to stay safe, you should ignore all these ads that claim that you should update your Java, Flash Player, FLV Player, etc. In addition, stay away from those ads that 'recommend' contacting some kind of customer service and similar assistants because they can also lead you to the infiltration of the virus. Finally, you should avoid illegal websites and also stay away from suspicious emails.

If the message looks very suspicious and claims that should download the attachment, you should never do that because this can easily lead you to the infiltration of this ransomware. Once this threat enters the computer, it does what it was set for and then shows such fake warning message:

CryptoLocker

Your important files encryption produced on this computer: photos, videos, documents, etc.
If you see this text, but do not see the “CryptoLocker” window, then your antivirus deleted “CryptoLocker” from computer.
If you need your files, you have to recover “CryptoLocker” from the antivirus quarantine, or find a copy of “CryptoLocker” in the Internet and start it again.
You can download “CryptoLocker from the link given below.
hxxp://invisioncorp.com/au/XXXXXXXXXX
Approximate destruction time of your proviate key:

If the time is finished you are unable to recover files anymore! Simply remove this wallpaper from your desktop.

Removing the virus with the guide

If the PClock virus has just shown up on your PC's desktop, you should ignore its requirement to pay a fine because you can be left without your files and your money. Instead of making a payment and supporting hackers, we recommend using a guide below.

In the end, we highly recommend thinking about the prevention of such infections. For that, you should always have reputable anti-spyware installed on your computer. You can rely on SpyHunterCombo Cleaner or MalwarebytesMalwarebytes or different anti-malware. Besides, don't forget to think about the immunity of your files and backup. If you have been making backups, you should be capable of recovering your files. You can also use file recovery software or system tools like FortectIntego.