Avest ransomware (Virus Removal Guide) - Recovery Instructions Included

What is Avest ransomware?

Avest ransomware is a decryptable crypto-malware that appends .Pack14 marking after file locking process

Avest ransomware is a type of malware that focuses on encrypting all personal files on the machine and then asking for ransom to be paid for their release

Avest ransomware (also known as Pack14 ransomware) is a computer virus that sneaks into the machine via spam email attachments, software cracks, unprotected Remote Desktop connection, software vulnerabilities,^[1] fake updates, and other deceptive methods. Once inside, the malware uses a taskkill.exe command to shut down MS Office, Notepad and other files that might be running on the system, and then begins the encryption process. In this way, picture, document, database, image, PDF, and other commonly used files can no longer be accessed, and also receive an extension .pack14 at the end.

Besides triggering the encryption process, Avest ransomware also contacts a remote server to send the key that is required for file retrieval process and drops a ransom note !!!Readme!!!Help!!!.txt which asks users to contact hackers via data1992@protonmail.com and send the provided ID.

While it is unknown what sum of money Avest virus developers ask for, paying them would be an enormous waste of money, as the security team at Emsisoft released a working free decryption tool that can recover all the encrypted data for free. However, be sure to remove Avest ransomware before proceeding with the recovery process – we explain how at the bottom of this post.

The activity of Avest ransomware was first spotted in early September 2019. While this malware does not seem to have any similarities or connections to other ransomware strains, it tries to imitate the name of Belorussian IT company ZAO Avest which specializes in cryptographic software development. Nevertheless, it is highly unlikely that Pack14 ransomware developers have anything to do with the mentioned corporation.

It is not the first time, however, when ransomware developers used reputable names of companies or high-profile figures as the name of heir malicious software; for example, Spyhunter ransomware, CSGO ransomware, Donald Trump ransomware, and many others. In most of the cases, hackers most likely want to mock the person/company they are trying impersonate, or deliberately confuse victims – the latter is the most likely cause for the Avest ransomware name.

Avest ransomware is virus that is also known as Pack14 ransomware due to the extension it appends to encrypted files

Once inside the system, Avest ransomware performs a variety of system changes and deletes Shadow Volume Copies to complicate the recovery process. After that, the virus scans the machine for files to encrypt, and it targets the most common ones, such as .pdf, .docx, .html, .jpg, .mp4, and many others. Thus, it turns a picture.jpg into a picture.jpg.ckey(ubjjnsty).email(data1992@protonmail.com).pack14, and it can no longer be opened.

After the encryption, Pack14 ransomware drops a ransom note which is a brief message from hackers:

Problems with your data? Contact us: data1992@protonmail.com
key: ubjjnsty

As we previously mentioned, there is no need to contact cybercriminals behind Avest virus, as a free decryption tool exists. Besides, paying criminals would only fund their activities and prove to them that their illegal business model works.

Thus, check out a full guide on how to decrypt files in our recovery section below. However, make sure you initiate a full Avest ransomware removal first, otherwise, the decoding process will be useless. For that, you should employ anti-malware software and scan your system thoroughly. For the job, we suggest using FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes.

Once the files are locked by Avest ransomware, they can no longer be opened

Most common ransomware distribution methods in the wild

In most of the cases, hackers employ multiple distribution tactics in order to infect as many victims as possible, as it increases the chances of payment in Bitcoin or another cryptocurrency. While some methods might be more sophisticated then the others, the main vector when it comes to computer infection is human – careless online behavior and inadequate protection measures can easily result in ransomware or other malware infection.

Because this ransomware version is decryptable, you can recover from it relatively easily. However, most of the other infected users are not so lucky, as crypto viruses rarely receive free decryption tools. Thus, if you get infected again with a treat such as .nesa, .nemty, .karl or similar, file recovery will most likely be impossible.

To prevent ransomware infections in the future, make sure you follow these simple tips provided by experts in the security field:^[3]

• Install comprehensive anti-malware software and keep it up to date;
• Patch your operating system and all the installed programs with latest security updates immediately after they are released;
• Do not open email spam – attachments that ask for a macro function to be enabled are the ones to stay away from;
• Do not download cracks and pirated software, as the installers can be often ridden with malware;
• Enable ad-block (although do not forget to add exceptions for sites you want to support);
• When using Remote Desktop, protect it with a secure password and avoid the default port 3389;
• Use strong passwords and for all your accounts and enable two-factor authentication where possible;
• Do not ignore your anti-virus software warnings;
• Backup your files to mitigate the damage done by ransomware.

Get rid of Pack14 ransomware using anti-malware software: access Safe Mode if required

As we previously mentioned, Pack14 ransomware removal is indeed possible to achieve manually. However, this action requires an extensive computer and IT knowledge, as malware makes significant changes to the infected systems. Therefore, you should rather employ professional anti-malware software and perform a full system scan – it should detect Avest ransomware and take care of its termination.

Avest ransomware is known to mimic the name of an IT company from Belarus

However, in some cases, Pack14 file virus might interfere with the correct operation of security software. In such a case, you should enter Safe Mode with Networking – please check step-by-step instructions below. After you remove Avest ransomware from your machine, download the decryption tool and recover all your files for free.