How to remove Leon ransomware

Leon ransomware — the new version of Blind virus

Leon ransomware is a file-encrypting virus which corrupts the victim's data and demands to pay the ransom. Usually, it encrypts files using sophisticated algorithms and appends .leon extension. After encryption procedure, this malware creates How_Decrypt_Files.hta file, also known as the ransom note, and urges to contact atilla666@tutanota.com for the decryption tool.

According to the analysts, Leon ransomware is the newest variant of Blind ransomware which has emerged on the cyberspace in October 2017. Note that there are multiple versions of this malicious program, such as Napoleon ransomware, Skeleton ransomware, etc. 

All variants of this file-encrypting virus use How_Decrypt_Files.hta file as the ransom note. However, the content might differ, and the message of the Leon virus states the following:

All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail atilla666@tutanota.com. You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.

Note that the victims might be provided with different e-mail since the developers tend to update their malicious programs regularly. Thus, people report Leon indicating brons@airmail.cc and klint@cock.li addresses as well. Despite that, you should neither contact the criminals nor pay the ransom.

Additionally, the ransomware allows to send up to 3 files for free Leon decryption. However, this is just a trick to gain victim's trust and convince him/her to pay the ransom. In reality, hackers tend to manipulate their power and demand more money after the transaction. 

Likewise, we recommend you remove Leon virus instead of following the criminals' rules. You can use a powerful anti-malware software to help you get rid of this malicious program. Our top choice would be FortectIntego since it will quickly deal with the ransomware infection.

However, do NOT try to complete Leon removal without any assistance if you are not keen to download additional software. You are advised to use the elimination instruction below which will guide you through the complicated procedure. Make sure that you follow the steps attentively to avoid any further damage.

Spam e-mails and P2P networks might lead to ransomware infiltration

Usually, the file-encrypting viruses are not infused into your system remotely — they are put in the cyberspace with a deceptive appearance to lure inexperienced computer users into downloading the malicious program manually. According to NoVirus.uk^[1] team, the most common source of the ransomware is peer-to-peer networks^[2].

Once people head to get a cracking software or other illegal downloads, they always risk of getting infected with malware. Criminals design their bogus applications to look legitimate by disguising under well-known brands and names like Adobe Flash Player, etc^[3]. Likewise, naive users download the malicious program without even knowing it. 

Additionally, people can receive the ransomware right to their e-mail box. Hackers employ malspam campaigns and send thousands of letters holding the infected attachments worldwide. The e-mail can look like a valid invoice or another important document. Thus, people are tricked to open the malicious attachment and infiltrate ransomware.

Leon ransomware virus removal procedure

If you want to recover files with .leon extension, you should first get rid of Leon ransomware. Since this is a complicated process which requires specific IT skills, you are advised to either get a professional antivirus tool or employ an IT expert. However, the former option is far more convenient.

You can download FortectIntego, SpyHunterCombo Cleaner, or MalwarebytesMalwarebytes to remove Leon virus within several minutes. Just install the security software and let it scan your computer thoroughly. Shortly after it should detect the malicious program and eliminate it from your system. Note that it will also protect your PC from infections in the future.

Start Leon removal by rebooting your computer to Safe Mode. Computer users who are not experienced enough can use the guidelines below and learn how to terminate the ransomware-type program safely. However, it is important not to skip steps during the procedure.