How to remove 8chan ransomware

8chan ransomware is a file locker that demands payment for encrypted data

8chan ransomware^[1] is a newly discovered crypto-virus that encrypts user's personal files using a sophisticated encryption algorithm. Ransomware infection infiltrates target machines via malicious email attachment and renames each of the files by adding one of these extensions: [random].supdec@8chan.co or [random].recover@8chan.co. Victims who would like to get their data back are requested to pay a ransom in Bitcoin cryptocurrency. They are informed about the situation in the text file that is created and inserted into every infected folder on the machine.

The name of the ransom note used by ransomware to warn its victims might vary and mostly depends on the version of the virus. At the moment, there are two names known to security researchers: HOW TO RECOVER ENCRYPTED FILES-supdec@8chan.co.TXT or HOW TO RECOVER ENCRYPTED FILES-recover@8chan.co.TXT. Nevertheless, users should simply remove 8chan ransomware and ignore their messages.

8chan ransomware does not immediately lock all files on the machine. First, the computer is compromised by malware modifying registry keys^[2] and other settings on Windows OS. This ensures that the virus is booted with every operating system startup.

Soon after that, it renames every file present into a different name, rendering it useless. For example, a file called picture.jpg will be turned into FpHbBbNTesX4aK9KSgbU6Avxb7s4DTg5bYs.decrypts@8chan.co or similar. To be able to open it again, victims are required to obtain a key that cybercrooks possess. For that, hackers ask for a payment in return.

They provide the following information inside the ransom note:

======================
decrypts@8chan.co
======================
Your files are encrypted!
Your personal identifier: –
=======================
To decrypt files, please contact us by email:
decrypts@8chan.co
=======================
reserved:
techn@airmail.cc
=======================

As you can see, users are asked to email decrypts@8chan.co to get further instructions. Because the activity is highly illegal, hackers do not accept payments in any other ways apart from cryptocurrency transactions. The most popular digital currency currently is Bitcoin and is widely used by ransomware authors.

The size of ransom is not stated. If you thought about contacting creators of 8chan ransomware to pay them – don’t! Even if the amount of money required by them is relatively small (typically, ransom size ranges between $300 and $1500), never contact cybercriminals. This will encourage them to create more malware in the future as their illegal attempts to monetize on unsuspecting users will become successful.

Thus, instead of paying hackers, proceed with 8chan ransomware removal. Manual elimination is not recommended and is very unsafe (can lead to system damage); therefore, download and install reputable anti-malware software (such as FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes) and run in in Safe Mode with Networking. Only then you can recover your data using a backup or third-party software.

Ransomware infections are more likely to occur if you are careless online

Despite popular belief, ransomware does not infect machines out of thin air. Users are typically at fault themselves. To avoid malware and other harmful viruses, such as trojan horses or spyware, security experts^[3] recommend following these simple rules:

• Do not carelessly open every single email that comes your way. Ransomware authors often employ bots that are cable of sending our thousands of emails to users. These phishing emails typically have a .txt, .pdf, .doc or similar file attached. If you open the contaminated file, the virus' payload will be executed immediately;
• Keep your operating system and software up to date. Hackers often exploit software vulnerabilities to contaminate as many computers as possible. Thus, patching your applications and OS on time might save you from a lot of stress;
• Employ a robust security software with real-time protection feature;
• Keep your files backed up on a remote server, such as Dropbox or Google Drive.

Eliminate 8chan ransomware automatically

As we already mentioned, manual 8chan removal should never be attempted. This procedure can only be executed by professionals. Therefore, users should not wait and install malware removal tool, such as FortectIntego or MalwarebytesMalwarebytes. This software will eliminate all components that belong to this virus and will take care of Windows registry.

8chan virus might block security software from starting. In that case, reboot your PC in Safe Mode with Networking as explained below. As soon as you remove 8chan ransomware, you can attempt file recovery.