How to remove CTB Locker virus

CTB Locker virus – ransomware that has been targetting the USA, Germany, Italy, and the Netherlands mostly

CTB Locker virus (also found under a title of CTB-Locker ransomware) is a crypto-type ^[1] malware, which started attacking PC users in the middle of July 2014. According to research, this malware strain has been found targetting users in USA, Germany, Italy, and the Netherlands. It is almost identical to Cryptowall virus, Cryptolocker, Cryptorbit, Critroni, etc., so if you have ever heard about any of these parasites, you will know what this ransomware is used for. Basically, it is designed for encrypting specific data files and then making people pay for their decryption. In most cases, people who want to recover access to their photos, videos, and other files are asked to pay $300. Besides, CTB-Locker ransomware loads AllFilesAreLocked.bmp, DecryptAllFiles.txt, [seven random letters].html, or similar messages/files to report about the data encryption process.

CTB Locker virus, of course, demands a ransom price that should be paid in a form of Bitcoins ^[2]. If you think that your PC has already infected by this ransomware virus, the first thing that you should notice is that you cannot reach your files anymore. Also, you may start seeing a warning message explaining the whole thing and asking to pay a fine.

In this case, you should immediately scan your computer with a reputable anti-spyware program because the sooner you do that, the larger amount of files you could save. Unfortunately, this CTB Locker virus can hardly be noticed before it starts showing its notification that reports about encrypted data and asks to pay a ransom.

That's why you should always have an updated anti-spyware installed on your computer that could easily help you to prevent infections like this one. For that, we highly recommend using SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Also, this is a very beneficial program to search for malware traces when opting for automatic removal.

You need to remove the virus immediately after you spot files that are encrypted and do not load properly. This type of threat has been getting more and more advanced each year and targetting a bigger audience. Continue reading this article and find out all updates on this ransom-demanding threat.

Additionally, note that when infected with CTB Locker ransomware, you can lose files with such extensions:

3fr, accdb, ai, arw, bay, cdr, cer, cr2, crt, crw, dbf, dcr, der, dng, doc, docm, docx, dwg, dxf, dxg, eps, erf, indd, jpe, jpg, kdc, mdb, mdf, mef, mrw, nef, nrw, odb, odm, odp, ods, odt, orf, p12, p7b, p7c, pdd, pef, pem, pfx, ppt, pptm, pptx, psd, pst, ptx, r3d, raf, raw, rtf, rw2, rwl, srf, srw, wb2, wpd, wps, xlk, xls, xlsb, xlsm, xlsx, etc

The start of 2015: CTB-Locker starts urging for a ransom of 3 BTC 

CTB-Locker was renewed at the beginning of 2015. After this, the virus started asking to pay 3 BTC or about $2774 for giving people an opportunity to recover the connection to their files. Also, it includes “free decryption” service, an extended deadline (96 hours) to pay the fine, and an option that allows changing the language of the ransom message.

At the moment of writing, victims can switch from English to Dutch, German and Italian ^[3]. An interesting thing is that this new version of CTB Locker allows people to select 5 different files for free decryption. This option is called “Test Decryption” and is presumably given to convince users that this service is not invented.

Nevertheless, you should NEVER pay this ransom and support scammers. Just scan your computer with reliable anti-spyware and remove the virus. Then, you should download one of these programs that are given down below to recover the connection to your files.

2016 update: CTB-Locker ransomware starts attacking websites 

It seems that 2016 can be called the year of CTB Locker. According to the latest news, hackers have started using this virus to attack websites. Beware that “CTB Locker for websites” can easily replace your original index page to the affected webpage. Also, it can encrypt all scripts, documents, photos, databases, and other important files, and start displaying its warning on the main page of the affected website.

According to the latest reports, the CTB-Locker virus can hold the site for as long as it makes its owner pay a ransom. To unlock it and decrypt encrypted files, a victim of this ransomware has to pay a ransom of $150 or £100. Also, the virus lets its victim see how the decryption process works and provides 2 decryption keys to unlock two random files.

The latest victim is the British Association for Counseling & Psychotherapy website ^[4]. People can't reach this domain, which now shows a detailed guide explaining how the owner of this site has to pay the fine and get encrypted files back. Of course, money is what scammers are expecting to get. To avoid a need to pay a ransom for hackers, you should create A BACKUP for your OS and the most important data.

RAUM method helps to spread the virus

According to the latest news, CTB-Locker has started spreading with the help of a new system called RAUM. This newly presented strategy is used to infect the most popular torrent files with ransomware, an infamous Dridex, Pony, and similar malware that is launched right after the malicious torrent file is installed on the system.

If infected with CTB Locker, you will discover that your files with these extensions are encrypted: .ai, .cdr, .doc, .docx, .eps, .jpg, .xls, .ppt, .psd, .pdf, etc. RAUM ^[5] is believed to work as a pay-per-install system that tracks torrent users first to find out which torrent files are the most popular ones among them.

Next, it infects these files with malware and uses hacked accounts to upload malicious content on the system. Security researchers have already discovered that hackers have been using Pirate Bay and Extra Torrent sites. Make sure you stay away from these domains to protect yourself and your files.

The year 2017: Crooks released a fake version of CTB-Locker named CTB-Faker

CTB-Locker has become a target of amateur hackers who have made a version of CTB-Faker — a program that looks like CTB-Locker but is not the actual infection ^[6].

A ransom note that this fake ransomware drops on the infected computers looks identical to the original virus version and notifies the victim that his/her computer has been infected with CTB-Locker and they have to pay 50 USD to recover their files.

However, for the data encryption CTB-Faker utilizes WinRAR functionalities, which is an easier and simpler way to achieve file encryption. The targeted files are simply compressed and stored in an archive protected with a password that hackers have selected.

Luckily, experts have already managed to dig up a vulnerability in this virus and disclosed this password — the virus-generated archives can be unlocked using the p4w1q3x5y8z code. 

However, not all imposters can be decontaminated that easily. 2017 can bring programs that are equally dangerous to their malicious counterparts and may corrupt the system just as bad. So, we can only advise you to be careful out there!  

Ransomware infections reach their target via email spam

According to experts from Virusai,^[7] ransom-demanding threats are often injected into executables or Word documents that come attached to email messages. Email spam travels throughout the Internet sphere and reaches users frequently. The best way to protect yourself from malicious letters is NOT to open any questionable email received.

Additionally, if you are curious about opening an attachment, you should use an antivirus tool and scan the file/document before launching it. If something malicious is hiding there, you will be warned by your anti-malware and be able to delete the malware-laden content on time before anything bad occurs.

Nevertheless, you should always keep a distance from piracy networks, gambling, online dating, movie-streaming, game-playing, and adult-themed websites. Note that malicious payloads can come injected into hyperlinks, and suspicious-looking banner ads, pop-ups, pop-unders, and coupons.

CTB Locker removal guidelines on Windows system

If you are desperate, and you need a guide that could help you to remove virus from your computer, you are in the right place. If it has already hijacked your system, you should disconnect your computer from the Internet ASAP. Unfortunately, but we cannot give you a CTB Locker decrypter yet because it is just in the development stage. However, you should follow the step-by-step guide given below and finish the elimination of this ransomware.

Moreover, do not try to carry out the removal process on your own as even more damage might be caused! You might miss some malicious components and the infection might start running malicious processes right after the next computer boot. Note that anti-malware tools are more trustworthy at these tasks as they can complete multiple actions very fast: scan the system, detect malicious software, remove the threats.