Severity scale:  
  (85/100)

Phoenix ransomware virus. How to remove? (Uninstall guide)

removal by Olivia Morelli - - | Type: Ransomware
12

Current state of Phoenix virus: can your files be decrypted?

In-development ransomware dubbed Phoenix virus has been discovered, and reportedly it hasn’t reached a large number of computer users yet. The virus is buggy and currently not very dangerous, but it is likely to be improved anytime soon and distributed to a larger number of computer users. At the moment, Phoenix malware doesn’t encrypt files stored on all system folders but only those who are saved on the desktop. The virus is based on HiddenTear ransomware[1], uses AES-256 cipher to encrypt files, so anyone infected with the virus can decrypt their files for free. It is not the first virus that has been created using the educational open-source ransomware code; sadly, many versions of HiddenTear are used for malicious purposes[2], and Phoenix is yet another one. To recognize the virus, we suggest looking at the extensions of encrypted files – Phoenix malware appends .R.i.P file extensions to them.

Later on, this software crafts a ransom note text, saves it into Important!.txt file and saves it on victim’s desktop. The ransom note suggests writing to dj.elton@hotmail.co.uk to get file recovery software. Of course, this software cannot be obtained charge-free. Virus’ authors want 0.2 BTC for it, which is more or less 152 USD. The virus wants to receive the ransom payment in Bitcoins via the wallet address that is provided in the ransom note. We do not advise you to do so, because this virus is not worth a single penny that you’ve earned in your life. Just use HiddenTear decryptor to restore your files (full instructions on how to do it are given below Phoenix removal tutorial). You should remove Phoenix virus before taking any data recovery measures. As long as the virus stays in the computer system, you’re not safe, so uninstall it as quickly as you can. You can use tools like Reimage for that.

Image representing Phoenix malware

How to recognize malicious content online and protect your PC from it?

Malware is mainly spread using techniques that allow to mask it and present it to the victim as a safe-looking file, program, or browser extension.[3] Some malware examples do not drop executive files directly – they might redirect you to a malicious website and ask you to install a hideous browser extension, which is meant to connect to malicious server online and download ransomware from there; the same can happen with infectious Word files, too. Ransomware also hides in JavaScript files and even .vbs files, besides, future malware distribution predictions promise even more[4]. However, these techniques require additional effort, so we believe that Phoenix virus’ authors do not use them. Most likely this virus is distributed via email in a .exe file, so we suggest you avoid emails sent by unknown people. Just resist the urge to explore contents of interesting-looking links or attachments, and you will be fine. For extra protection, install anti-malware software to your computer.

How can you free your PC of Phoenix virus?

In case you have been accidentally hit by Phoenix ransomware virus, do not be scared. Consider this accident a good lesson, and never make same mistake again. However, since there are loads of more dangerous ransomware viruses that damage the computer so badly that files and settings cannot be restored[5]. You should definitely take actions to avoid such dangers.

To remove Phoenix virus, use anti-malware program, because despite the fact that this virus is not the most dangerous one, it still poses a big threat to the computer system and leaving one or two components of it can lead to sad consequences later on. If you’re ready to start the Phoenix removal, read instructions provided below.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Phoenix ransomware virus you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Phoenix ransomware virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
More information about this program can be found in Reimage review.
Press mentions on Reimage

Manual Phoenix virus Removal Guide:

Remove Phoenix using Safe Mode with Networking

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Phoenix

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Phoenix removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Phoenix using System Restore

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Phoenix. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that Phoenix removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Phoenix from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

If your files are encrypted by Phoenix, you can use several methods to restore them:

Decrypt with HiddenTear decryptor

1. Download HiddenTear bruteforcer, which will find your decryption key. Extract the .zip file and run the bruteforcer. Choose mode (ransomware name). Select a sample file (encrypted one) and run the bruteforcer. Wait.

2. Once you have the decryption key, use it to decrypt your files. Download this HiddenTear decryptor for that and follow what it tells you to do.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Phoenix and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Olivia Morelli
Olivia Morelli - Ransomware analyst

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Olivia Morelli
About the company Esolutions

References


  • Fredo

    I could not recover files… It is so frustrayting… I need them back, I really need, I know how desperate I sound, but can somebody help me///

  • Kentucky

    hideous, hideous ransomware creators! why do they do that and why legal authorities cannot punish them! This is ridiculous! how do police manage to find child exploitaters on Tor but cannot track ransom transactions…. I just simply cannot understand

  • Jimmy

    how about we spam that ransomware email with letters saying hes a noob?

    • Patrize

      not gonna help at all. dont be childish