Ykcol ransomware / virus (Removal Guide) - Virus Removal Instructions
Ykcol virus Removal Guide
What is Ykcol ransomware virus?
Locky is currently distributed as Ykcol ransomware virus – protect your computer now!
Ykcol ransomware is the latest strain of the infamous Locky ransomware. It follows previously released Lukitus and Diablo6[1] versions and uses a combination of RSA-2048 and AES-128 ciphers to lock victim’s files. The virus appends .ykcol file extension to every encrypted file and drops ykcol.bmp and ykcol.htm files on the desktop.
Locky’s developers chose the new name for the ransomware by simply reversing the name of the initial virus backward. The malicious software is currently being pushed via malicious spam[2] that delivers a compromised attachment containing a script that downloads and executes Ykcol virus on the system.
After hijacking the system, the malicious virus drops to aforementioned files that function as ransom notes. The BMP file will be set as desktop’s wallpaper while the HTM file opens via web browser and provides links leading to user’s personal payment page (accessible via Tor browser only). In order to view contents of the personal payment page, the victim has to download the aforementioned browser and enter the .onion website via it.
The payment page on Tor network presents “Locky decryptor” which is the decryption tool offered by the ransomware authors. While previous versions of the virus used to demand half a Bitcoin to set all files free, Ykcol malware asks for 0.25 Bitcoin.
However, since the Bitcoin’s value has been increasing, this amount is now approximately equal to more than 1000 US dollars, which is a high price for data decryption.
Cybersecurity experts recommend ignoring criminals’ demands and using available data recovery methods instead of paying cybercriminals. Currently, there is no news regarding successful data recovery attempts, so at the moment the only efficient data restoration method is to use a backup.
NoVirus.uk[3] strongly recommends you to remove Ykcol virus from your computer as soon as possible. The recovery after a ransomware attack requires time, and in order to use your PC safely again, you must get rid of the malware before doing anything else. Use a trustworthy program like FortectIntego or Malwarebytes to clean your PC. In addition, you will need to reboot your PC in Safe Mode with Networking to eliminate the new Locky version.
Start Ykcol removal by reading the directions provided below the article. Once you learn how to prepare your PC for this task, you should do it immediately. Once your PC is in a safe mode for malware removal, run anti-malware software to find the malicious files and delete them. Also, we would like to remind you to update your security software before scanning your PC for malware.
Currently used distribution methods that spread Locky ransomware
All variants of Locky are typically distributed via mail spam, and Ykcol virus is no different. The latest variant of ransomware is being pushed via malspam campaign that delivers fake 7Zip attachments with a .vbs file inside of them. The malicious emails are again based on the fake invoice theme. The emails with malicious attachments will kindly ask the victim to review “attached invoice” and let the sender know about the status of it.
The compromised attachment is named with a set of random chars and contains a VBS file that, once opened, connects to one of remote servers and downloads Locky payload from it. Following a successful download of the ransomware, the VBS file runs it. As a consequence, the victim loses all of his files immediately and faces ransom notes left by cybercriminals.
The authors of this virtual extortion tool have been using a variety of different malware distribution techniques, but so far it seems that phishing and malicious spam is their go-to combo that they use to deceive victims. Locky’s developers rarely change the distribution tactics as so far it seems that their methods are working quite well.
Remove Ykcol virus right now
In case the latest Locky’s version attacked your PC and compromised your files, the first thing you need to do is to remove Ykcol virus from the system. Unfortunately, the malicious software can refuse to enter your computer so easily, so you will need to use programs developed by IT experts to identify and kill it.
Ykcol removal might be complicated because this malicious software aims to avoid detection using professional obfuscation techniques. However, if your security software did not manage to stop it from encrypting your files, you must update it and remove remains of Locky malware right now. This will secure and protect your computer from illegal activities that the virus might be trying to implement.
Getting rid of Ykcol virus. Follow these steps
Manual removal using Safe Mode
When infected with Locky, you need to act fast. The first thing you need to do to remove Ykcol file extension virus from your PC is to prepare your PC for malware removal and then delete ransomware remains using professional malware removal software.
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Remove Ykcol using System Restore
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of Ykcol. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Bonus: Recover your data
Guide which is presented above is supposed to help you remove Ykcol from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.If your data was damaged by Ykcol ransomware, you should see .ykcol file extension appended to their names. These files cannot be recovered without having a backup, although cyber security experts always recommend trying alternative data recovery options which we listed below.
If your files are encrypted by Ykcol, you can use several methods to restore them:
Reverse the damage using Data Recovery Pro
You can try to reverse the damage inflicted by Ykcol ransomware using data recovery software called Data Recovery Pro. We have added simple instructions on how to use this tool to try and restore some encrypted files. NOTE. Unfortunately, there is NO guarantee that this software will help you to recover all of your records. Considering the sophistication of the ransomware that encrypted your files, this data recovery software might be powerless.
- Download Data Recovery Pro;
- Follow the steps of Data Recovery Setup and install the program on your computer;
- Launch it and scan your computer for files encrypted by Ykcol ransomware;
- Restore them.
Locky decryption tool
All security experts advise against paying the ransom to cyber criminals. First of all, they ask for an enormously large sum of money; besides, the chances or restoring files are low anyways. There is no guarantee that scammers will help you to recover your files. Besides, we believe that paying the ransom to extortionists motivates them to continue their activities, and that is why we do not recommend paying them.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Ykcol and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity. While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful Private Internet Access VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important – recover your lost files
Ransomware is one of the biggest threats to personal data. Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as Data Recovery Pro can also be effective and restore at least some of your lost data.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
- ^ Bill Brenner. It’s baaaack: Locky ransomware is on the rise again. Naked Security. Computer Security News, Advice and Research.
- ^ Joie Salvio, Rommel Joven, Floser Bacurio. Locky Launches a More Massive Spam Campaign with New “Lukitus” Variant. Fortinet Blog: Latest Posts about Cyber Security.
- ^ The Main Page of NoVirus Project. NoVirus. Malware, Spyware and Security News.