How to remove EMPg296LCK ransomware

EMPg296LCK ransomware is a dangerous malware that attempts to extort money from users

EMPg296LCK is a ransomware-type program, which means that it encrypts all files located on the target machine. The main goal of the attackers is to hold the files hostage so that victims would pay them money to retrieve the important data. Affected files range from pictures to databases – everything that can be useful to users.

This malware was first spotted in early June 2022, and it was immediately determined that it stems from MedusaLocker – a family that has been around for at least three years at the time of the writing. It is rather expansive and we have already covered several of its variants, including Marlock and Ako.

This version doesn't differ much from its predecessors – it encrypts files with AES + RSA encryption^[1] algorithms and appends .EMPg296LCK extension to each of them. This results in users not being able to open or modify their files – they require a unique key accessible only to the attackers.

According to the ransom note !_HOW_RECOVERY_FILES_!.HTML, users are meant to send an email to assist1122@protonmail.com or assist112233@cock.li to communicate the price.

The ransom note analysis

The main goal of ransomware is not to harm the system but rather to affect user files in a way that they wouldn't be recoverable. With the help of this process, hackers can then demand money from victims – ransomware became a very profitable business,^[2] with thousands of strains luring on the web.

Ransom note serves a vital role when it comes to monetization, as users wouldn't know who or how to contact. The note provides initial explanations of what happened to user files and how to retrieve them and, most importantly for cybercriminals – provides contact details:

Your files are encrypted!

What happened?

Your files are encrypted, and currently unavailable.
You can check it: all files on you computer has new expansion.
By the way, everything is possible to recover (restore), but you need to buy a unique decryptor.
Otherwise, you never cant return your data.

For purchasing a decryptor contact us by email:

assist1122@protonmail.com
If you will get no answer within 24 hours contact us by our alternate emails:
assist112233@cock.li

What guarantees?

Its just a business. If we do not do our work and liabilities – nobody will not cooperate with us.
To verify the possibility of the recovery of your files we can decrypted 1 file for free.
Attach 1 file to the letter (no more than 10Mb). Indicate your personal ID on the letter:

Attention!

• Attempts of change files by yourself will result in a loose of data.
• Our e-mail can be blocked over time. Write now, loss of contact with us will result in a loose of data.
• Use any third party software for restoring your data or antivirus solutions will result in a loose of data.
• Decryptors of other users are unique and will not fit your files and use of those will result in a loose of data.
• If you will not cooperate with our service – for us, its does not matter. But you will lose your time and data, cause just we have the private key. •Otherwise, they will fall into the open access of the Internet! Use any third party software for restoring your data or antivirus solutions will result in a loose of data.
• Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.
•Check the spam folder in the mail !!!

We do not recommend negotiating or even contacting malware authors. There is no guarantee that they would provide a decryption tool, even if you pay the requested money. Besides, paying the ransom only signifies that the illegal business scheme works well – it will only encourage crooks to develop ransomware further and infect more people.

Remove the virus

In order to prevent the attackers from communicating with EMPg296LCK ransomware via the network, you should disconnect the computer(s) from it. Malware authors could send additional payloads or update ransomware with new code through it. While you can simply plug out the internet cable, it might not always be convenient, so you should proceed with the following steps instead:

• Type in Control Panel in Windows search and press Enter
• Go to Network and Internet
• Click Network and Sharing Center
• On the left, pick Change adapter settings
• Right-click on your connection (for example, Ethernet), and select Disable
• Confirm with Yes.

The only secure way to remove an infection as serious as ransomware from the system is by scanning it with SpyHunterCombo Cleaner, MalwarebytesMalwarebytes, or another powerful anti-malware. While some malware of this type removes themselves after data encryption, it is unlikely to be the case with Spark ransomware due to their threats of corrupting data.

Since crooks threatened to corrupt data, we recommend performing a scan in Safe Mode, which you can access by following these steps:

Windows 7 / Vista / XP

1. Click Start > Shutdown > Restart > OK.
2. When your computer becomes active, start pressing the F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
3. Select Safe Mode with Networking from the list.

Windows 10 / Windows 8

1. Right-click on the Start button and select Settings.
   
2. Scroll down to pick Update & Security.
3. On the left side of the window, pick Recovery.
4. Now scroll down to find the Advanced Startup section.
5. Click Restart now.
6. Select Troubleshoot.
7. Go to Advanced options.
8. Select Startup Settings.
9. Click Restart.
10. Press 5 or click 5) Enable Safe Mode with Networking.

Fix the operating system

After the malware is deleted from your system, it is time to take care of its health. Once installed, it can seriously tamper with various files and corrupt them in the process – this damage can't be removed by anti-malware software. As a result, those affected start experiencing crashes, BSODs,^[3] errors, and other stability issues, which can significantly diminish the usability of the device.

Thus, we recommend using specialized software capable of fixing these issues easily, without you having to reinstall your operating system after a malware attack.

• Download FortectIntego
• Click on the ReimageRepair.exe
  
  
• If User Account Control (UAC) shows up, select Yes
• Press Install and wait till the program finishes the installation process
• The analysis of your machine will begin immediately
• Once complete, check the results – they will be listed in the Summary
• You can now click on each of the issues and fix them manually
• If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.

Data recovery

As soon as ransomware breaks into the device, it encrypts all the eligible files, excluding the system and some other file types. This is done to cause maximum damage to the user so that they would be more inclined to pay. File encryption uses a unique, alphanumeric string of characters as a decryption key – it's like a password that's unique for every victim.

This is why ransomware infection can be so devastating – even if EMPg296LCK ransomware removal is performed, the files would remain unusable. Paying criminals is risky, as they might never fulfill their promises, making users risk their money along with files.

Thus, we recommend you take an alternative route. Before you proceed with alternative solutions for data recovery, make sure you make backups of the encrypted data, as, otherwise, it might be permanently damaged in the process.