Severity scale:  
  (64/100)

Remove Avest ransomware (Virus Removal Guide) - Recovery Instructions Included

removal by Jake Doevan - - | Type: Ransomware

Avest ransomware is a decryptable crypto-malware that appends .Pack14 marking after file locking process

Avest ransomware
Avest ransomware is a type of malware that focuses on encrypting all personal files on the machine and then asking for ransom to be paid for their release

Avest ransomware (also known as Pack14 ransomware) is a computer virus that sneaks into the machine via spam email attachments, software cracks, unprotected Remote Desktop connection, software vulnerabilities,[1] fake updates, and other deceptive methods. Once inside, the malware uses a taskkill.exe command to shut down MS Office, Notepad and other files that might be running on the system, and then begins the encryption process. In this way, picture, document, database, image, PDF, and other commonly used files can no longer be accessed, and also receive an extension .pack14 at the end.

Besides triggering the encryption process, Avest ransomware also contacts a remote server to send the key that is required for file retrieval process and drops a ransom note !!!Readme!!!Help!!!.txt which asks users to contact hackers via data1992@protonmail.com and send the provided ID.

While it is unknown what sum of money Avest virus developers ask for, paying them would be an enormous waste of money, as the security team at Emsisoft released a working free decryption tool that can recover all the encrypted data for free. However, be sure to remove Avest ransomware before proceeding with the recovery process – we explain how at the bottom of this post.

Name Avest ransomware
Type Cryptovirus – malware based on money extortion
Also known as This virus family is often called Pack14 ransomware due to the extension it appends to the hijacked data
File extension Avest ransomware appends .pack14 file extension at the very end, although the full appendix looks as follows: .ckey(random_ID).email(data1992@protonmail.com).pack.14
Related files The executable used by malware to start the infection process of the computer is usually called installer.exe, antimalware.exe, office64.exe or avst.exe, although a random name can be used as well
Ransom note  Malware drops !!!Readme!!!Help!!!.txt into each of the folders where the encrypted files are located
Contact To recover the all the locked personal files, users are asked to email crooks via data1992@protonmail.com
Peculiarities The name of the ransomware is identical to the one that a Belorussian IT company goes by – ZAO Avest
AV detections[2]
  • TR/Ransom.qqmqn
  • Trojan.MSIL.Encoder.j!c
  • Trojan.GenericKD.41643801 (B)
  • Ransom.FileCryptor
  • W32.Trojan.MSIL.Encoder
  • HEUR:Trojan-Ransom.MSIL.Encoder.gen
  • Mal/Generic-S, etc.
Removal While removing ransomware manually is possible, you should rely on automatic tools for the process. We suggest using Reimage, SpyHunter 5Combo Cleaner, Malwarebytes or another reputable anti-malware software that can detect and delete all the malicious components from the machine
Data recovery There is no point paying cybercriminals, as there is a working free decryptor offered by Emsisoft. If it does not work for some reason, try alternative methods for data recovery we provide in our recovery section below

The activity of Avest ransomware was first spotted in early September 2019. While this malware does not seem to have any similarities or connections to other ransomware strains, it tries to imitate the name of Belorussian IT company ZAO Avest which specializes in cryptographic software development. Nevertheless, it is highly unlikely that Pack14 ransomware developers have anything to do with the mentioned corporation.

It is not the first time, however, when ransomware developers used reputable names of companies or high-profile figures as the name of heir malicious software; for example, Spyhunter ransomwareCSGO ransomwareDonald Trump ransomware, and many others. In most of the cases, hackers most likely want to mock the person/company they are trying impersonate, or deliberately confuse victims – the latter is the most likely cause for the Avest ransomware name.

Pack14 ransomware
Avest ransomware is virus that is also known as Pack14 ransomware due to the extension it appends to encrypted files

Once inside the system, Avest ransomware performs a variety of system changes and deletes Shadow Volume Copies to complicate the recovery process. After that, the virus scans the machine for files to encrypt, and it targets the most common ones, such as .pdf, .docx, .html, .jpg, .mp4, and many others. Thus, it turns a picture.jpg into a picture.jpg.ckey(ubjjnsty).email(data1992@protonmail.com).pack14, and it can no longer be opened.

After the encryption, Pack14 ransomware drops a ransom note which is a brief message from hackers:

Problems with your data? Contact us: data1992@protonmail.com
key: ubjjnsty

As we previously mentioned, there is no need to contact cybercriminals behind Avest virus, as a free decryption tool exists. Besides, paying criminals would only fund their activities and prove to them that their illegal business model works.

Thus, check out a full guide on how to decrypt files in our recovery section below. However, make sure you initiate a full Avest ransomware removal first, otherwise, the decoding process will be useless. For that, you should employ anti-malware software and scan your system thoroughly. For the job, we suggest using Reimage, SpyHunter 5Combo Cleaner or Malwarebytes.

Avest ransomware encrypted files
Once the files are locked by Avest ransomware, they can no longer be opened

Most common ransomware distribution methods in the wild

In most of the cases, hackers employ multiple distribution tactics in order to infect as many victims as possible, as it increases the chances of payment in Bitcoin or another cryptocurrency. While some methods might be more sophisticated then the others, the main vector when it comes to computer infection is human – careless online behavior and inadequate protection measures can easily result in ransomware or other malware infection.

Because this ransomware version is decryptable, you can recover from it relatively easily. However, most of the other infected users are not so lucky, as crypto viruses rarely receive free decryption tools. Thus, if you get infected again with a treat such as .nesa, .nemty, .karl or similar, file recovery will most likely be impossible.

To prevent ransomware infections in the future, make sure you follow these simple tips provided by experts in the security field:[3]

  • Install comprehensive anti-malware software and keep it up to date;
  • Patch your operating system and all the installed programs with latest security updates immediately after they are released;
  • Do not open email spam – attachments that ask for a macro function to be enabled are the ones to stay away from;
  • Do not download cracks and pirated software, as the installers can be often ridden with malware;
  • Enable ad-block (although do not forget to add exceptions for sites you want to support);
  • When using Remote Desktop, protect it with a secure password and avoid the default port 3389;
  • Use strong passwords and for all your accounts and enable two-factor authentication where possible;
  • Do not ignore your anti-virus software warnings;
  • Backup your files to mitigate the damage done by ransomware.

Get rid of Pack14 ransomware using anti-malware software: access Safe Mode if required

As we previously mentioned, Pack14 ransomware removal is indeed possible to achieve manually. However, this action requires an extensive computer and IT knowledge, as malware makes significant changes to the infected systems. Therefore, you should rather employ professional anti-malware software and perform a full system scan – it should detect Avest ransomware and take care of its termination.

Avest ransomware mimics a company name

However, in some cases, Pack14 file virus might interfere with the correct operation of security software. In such a case, you should enter Safe Mode with Networking – please check step-by-step instructions below. After you remove Avest ransomware from your machine, download the decryption tool and recover all your files for free. 

Offer
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to remove virus damage. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with SpyHunter 5.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Combo Cleaner.

To remove Avest virus, follow these steps:

Remove Avest using Safe Mode with Networking

Safe Mode with Networking is a secure environment where malware termination is a much easier task. Thus, if Avest virus is causing you troubles, enter this environment by using the following guide:

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Avest

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Avest removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Avest using System Restore

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Avest. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that Avest removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Avest from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

If your files are encrypted by Avest, you can use several methods to restore them:

Make use of Data Recovery Pro

In some cases, Data Recovery Pro might be able to recover data from your hard drive if particular parts of it were not overwritten with new information.

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by Avest ransomware;
  • Restore them.

Windows Previous Versions might be useful when dealing with Pack14 infection

If you had System Restore enabled, go ahead and try Windows Previous Versions feature.

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

ShadowExplorer might be the answer to your problem

If Shadow Copy removal process failed, ShadowExplorer is one of the best tools to use for file recovery.

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

Use a a free decryption tool from Emsisoft

Luckily, a free decryptor from security researchers at Emsisoft is available – download it from here.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Avest and other ransomwares, use a reputable anti-spyware, such as Reimage, SpyHunter 5Combo Cleaner or Malwarebytes

About the author

Jake Doevan
Jake Doevan - Computer technology expert

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Jake Doevan
About the company Esolutions

References


Your opinion regarding Avest ransomware