How to remove Pxj ransomware

Pxj ransomware is crypto-malware that threatens to delete decryption key if victims will not pay a ransom within a week

Pxj ransomware is a malicious program designed to lock all pictures, videos, music, documents databases and other personal files on the infected computer. For that, the malware uses a combination of sophisticated encryption algorithms AES + RSA, and also appends .pxj extension to each of the files, restricting access to them. For example, a file “picture.jpg” is turned into a “picture.jpg.pxj,” and the original file type icon dispersal, leaving a blank one instead.

Upon infiltration, Pxj virus also drops a ransom note LOOK.txt – it serves as a message designed to inform users about the infection, and what they have to do next. According to cybercriminals, victims need contact hackers via xvfxgw3929@protonmail.com or xvfxgw213@decoymail.com emails, and then purchase decyption tool from them. However, we suggest not to try fulfilling threat actors' demands, despite that they are threatening to permanently remove Pxj ransomware decryption tool from their servers after seven days – there may be other methods that could help you with data recovery.

Discovered by a security researcher that uses pseudonym dnwls0719 at the end of February 2020, Pxj ransomware does not seem to have any connections to other ransomware strains. Its analysis on Virus Total shows that multiple AV engines detect the threat as follows:^[1]

• Ransom.FileCryptor
• Trojan:Win32/Genasom!MSR
• Trojan.Ransom.Genasom
• Trojan.GenericKD.33369615
• Win32:Malware-gen
• A Variant Of Win32/Filecoder.OAU
• Trojan.Win32.Encoder.hcnyni, etc.

As evident, most of the AVs detect the executable as a generic malicious file, meaning that it was not present in malware databases (heuristic detection).^[2] Because of this, it is not exactly clear how Pxj ransomware virus propagates, but it is highly likely that malicious actors implement a variety of attack vectors, including spam emails, web injects, software cracks, exploits/vulnerabilities, etc.

Once executed, the Pxj ransomware creates multiple new folders in User, Temp, and Desktop folders, and performs the necessary system changes that are needed to ensure a successful data encryption process and malware operation. For example, it deletes Shadow Volume Copies by using “vssadmin.exe delete shadows /all /quiet” command to prevent a quick file recovery using automatic Windows backups.

Once the preparations are complete, Pxj ransomware encrypts the most commonly used file types in order to maximize the damage caused to the victim. After the encryption, users can see the following ransom note “LOOK.txt” which is opened automatically:

Hello.

All your files like photos, databases, videos, documents and other importants are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.

Guarantee:
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only one for free. File must not contain valuable information.

If you do not contact us within 3 days, the price will double every day.
And if you do not get in touch for a week, your files will be lost forever.

Our mail address:
xvfxgw3929@protonmail.com

Reserved mail address:
xvfxgw213@decoymail.com

While we stand by the statement that paying the ransom to cybercriminals might be a huge mistake, it is also true that deciphering encrypted files requires a unique key that they store on a remote server. In other words, only Pxj ransomware developers have the key that can unlock data on your device. Nevertheless, some alternative methods are worth checking out – we provide all the details below, although keep in mind that there is no guarantee that they will be effective when trying to decrypt Pxj ransomware-locked files.

Nevertheless, before you attempt that, you should make a copy of all your important files that were encrypted, as any type of modifications may permanently damage them, and then even a working Pxj ransomware decryption tool will not be able to recover the data.

After you copy files, it is equally as important to perform comprehensive Pxj ransomware removal by using a reputable anti-malware tool. Many people get confused when they deal with a ransomware infection, and wrongly believe that its removal will restore encrypted files. It is not possible, as security software is not designed for such purposes. What is possible, however, is rebuilding the Windows operating system and ensuring its stability – we advise using FortectIntego for that.

Ransomware intrusion prevention methods

Malicious actors behind ransomware chose this malware type because it is extremely lucrative, and while not all the victims pay ransoms, those that do are enough to make it worthwhile. Many developers/distributors also employ ransomware-as-a-service scheme to make the malware more prevalent or go “big game hunting” – attack high profile corporations, businesses, and cities to extort a large sum of money from one attack.^[3]

Unfortunately, security researchers have also observed a particularly alarming trend among ransomware developers – they threaten to publish the information they collected during the attack.^[4] As a result, ransomware can not only leave victims without file access but also compromise their personal safety by selling the data on the underground hacking forums.

Therefore, it is imperative to ensure that ransomware does not enter the computer and/or its connected networks in the first place – precautionary measures should be used for that. As a home user, you should apply the following practices to reduce the infection risk to a minimum:

• Install comprehensive security software with real-time protection feature;
• Update your operating system and the installed applications as soon as security patches are released;
• Protect all your accounts with alphanumeric passwords and never reuse them;
• Do not open spam email attachments that ask you to enable macro function;
• Never download software cracks/keygens or pirated program installers.

Additionally, by regularly backing your most important files, you can negate the impact of ransomware infection substantially.

Remove Pxj ransomware and only then attempt file recovery

For those who are facing the Pxj virus for the first time (or any ransomware), the cause of actions could be confusing, as many questions arise. For example, “should I pay for the decryption tool?” or “can I recover my files for free?”. As previously mentioned, paying cybercriminals is not a good idea, and should only be applied if absolutely necessary – it can result in monetary loss. First, we suggest you make copies of encrypted files, remove Pxj ransomware, and the try alternative recovery methods listed below.

For Pxj ransomware removal, you should employ powerful anti-malware software that could delete all the malicious files on your system. Note that some ransomware viruses self-delete after encrypting files, so there is nothing to eliminate afterwards. Nevertheless, we highly suggest scanning the machine with multiple AVs to ensure that malware is gone.