mrpeterson@cock.li ransomware is a cryptovirus that uses RSA-2048 algorithm for the data encryption process and marks file using .GFS appendix
| Name | mrpeterson@cock.li ransomware |
|---|---|
| Type | Cryptovirus |
| Alternate name | Gefest ransomware |
| Main purpose | Extort money from victims |
| Family | Scarab |
| Encryption method | RSA-2048 |
| File marker | .[mrpeterson@cock.li].GFS |
| Contact emails | mrpeterson@cock.li and debora2019@airmail.cc |
| Ransom note | HOW TO RECOVER ENCRYPTED FILES.txt |
| Elimination tips | Employ the anti-malware program to remove mrpeterson@cock.li ransomware and clean the system with FortectIntego |
Mrpeterson@cock.li ransomware virus emerged from the well-known ransomware family called Scarab in the middle of March and brought .[Mrpeterson@cock.li] .GFS file marker to the mix. This extension appears at the end of every encoded photo, image, document, or audio file after encryption process.[1]
For this process, mrpeterson@cock.li ransomware uses the army-grade RSA-2048 encryption algorithm that allows making targeted files useless and inaccessible by changing the original code. This is the main symptom that indicates a cryptovirus from other types of malware because the file-locking becomes a purpose of demanding money from victims.[2]
The ransom demand appears in the note placed on the Desktop and in every folder containing encrypted data. mrpeterson@cock.li ransomware generates this note in a file HOW TO RECOVER ENCRYPTED FILES.txt which delivers the following message:
GEFEST RANSOMWARE
Your files has been encrypted using RSA2048 algorithm with unique public-key stored on your PC.
There is only one way to get your files back: contact with us, pay, and get decryptor software.
We accept Bitcoin, and other cryptocurrencies, you can find exchangers on bestbitcoinexchange.io
You have unique idkey , write it in letter when contact with us.
Also you can decrypt 1 file for test, its guarantee what we can decrypt your files.
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Contact information:
primary email: mrpeterson@cock.li
reserve email: debora2019@airmail.cc
Your unique idkey:
Besides this encryption and ransom demanding, mrpeterson@cock.li ransomware alters various parts of the system and ads files or programs without your notice. Ransomware can run particular commands, access information about your location, obtain administration permissions and disable or launch functions and create registry entries. These changes allow virus developers to access wanted data and make the removal process more difficult.
You need to remove mrpeterson@cock.li ransomware as soon as possible, so none of those changes interfere with elimination and system cleaning. In most cases, ransomware disables security tools or features and even blocks access to spyware and cybersecurity-related websites like ours.
Make sure to choose trustworthy anti-malware tools for mrpeterson@cock.li ransomware removal process and scan the system entirely. This is a crucial step because manual virus termination is not a good solution. Get FortectIntego or a similar antivirus program and let it find all intruders on the machine.
It is understandable that data recovery is very important, but you should focus on terminating mrpeterson@cock.li ransomware first. Any data recovery methods can be used when the system is virus-free only. Then you can safely insert devices with data backups or use files stored on the cloud to replace affected ones.
Various experts[3] recommend scanning the system a few times to make sure mrpeterson@cock.li ransomware is deleted. When you make sure that the device is not infected anymore, various data recovery software can help you to restore files. We also have a few suggestions below the article.
Infected files distribute dangerous malware
Various website online seems to be useless because of the lack of valuable content, but often these sites have a purpose of delivering malicious programs to peoples' machines. Unfortunately, visiting some of them may lead to download or install a malicious file that contains payload dropper or malware script.
Similar files also get delivered from insecure emails or spam messages. These days, spam email campaigns got more advanced, and infected emails go straight to the regular email box and not spam. When users get an email statement about financial information or order details, the email seems legitimate.
However, you should be cautious if the email contains shortened hyperlinks or attached documents. These files often contain malicious macros, and once they get triggered, your machine becomes infected with direct ransomware or another malicious program.
Get rid of mrpeterson@cock.li ransomware virus with antivirus tools
For the proper mrpeterson@cock.li ransomware removal, we recommend using professional anti-malware tools and scanning the computer thoroughly to find all intruders and programs this virus may install after infiltration. These additional alterations often cause issues with the termination process.
Make sure to remove mrpeterson@cock.li ransomware and other associated files by double-checking. You can do that by installing FortectIntego, SpyHunterCombo Cleaner, or MalwarebytesMalwarebytes and performing a system scan again. Remember that not all antivirus programs work the same, and the databases may not be the same.
mrpeterson@cock.li ransomware virus can be detected by one AV engine but not the other, so using a few different programs can give the advantage. Also, reboot the system in Safe Mode and scan the machine then so all functions can work.
Was this guide helpful?
Be the first to comment