How to remove Phoenix ransomware virus

Current state of Phoenix virus: can your files be decrypted?

In-development ransomware dubbed Phoenix virus has been discovered, and reportedly it hasn’t reached a large number of computer users yet. The virus is buggy and currently not very dangerous, but it is likely to be improved anytime soon and distributed to a larger number of computer users. At the moment, Phoenix malware doesn’t encrypt files stored on all system folders but only those who are saved on the desktop. The virus is based on HiddenTear ransomware^[1], uses AES-256 cipher to encrypt files, so anyone infected with the virus can decrypt their files for free. It is not the first virus that has been created using the educational open-source ransomware code; sadly, many versions of HiddenTear are used for malicious purposes^[2], and Phoenix is yet another one. To recognize the virus, we suggest looking at the extensions of encrypted files – Phoenix malware appends .R.i.P file extensions to them.

Later on, this software crafts a ransom note text, saves it into Important!.txt file and saves it on victim’s desktop. The ransom note suggests writing to dj.elton@hotmail.co.uk to get file recovery software. Of course, this software cannot be obtained charge-free. Virus’ authors want 0.2 BTC for it, which is more or less 152 USD. The virus wants to receive the ransom payment in Bitcoins via the wallet address that is provided in the ransom note. We do not advise you to do so, because this virus is not worth a single penny that you’ve earned in your life. Just use HiddenTear decryptor to restore your files (full instructions on how to do it are given below Phoenix removal tutorial). You should remove Phoenix virus before taking any data recovery measures. As long as the virus stays in the computer system, you’re not safe, so uninstall it as quickly as you can. You can use tools like FortectIntego for that.

How to recognize malicious content online and protect your PC from it?

Malware is mainly spread using techniques that allow to mask it and present it to the victim as a safe-looking file, program, or browser extension.^[3] Some malware examples do not drop executive files directly – they might redirect you to a malicious website and ask you to install a hideous browser extension, which is meant to connect to malicious server online and download ransomware from there; the same can happen with infectious Word files, too. Ransomware also hides in JavaScript files and even .vbs files, besides, future malware distribution predictions promise even more^[4]. However, these techniques require additional effort, so we believe that Phoenix virus’ authors do not use them. Most likely this virus is distributed via email in a .exe file, so we suggest you avoid emails sent by unknown people. Just resist the urge to explore contents of interesting-looking links or attachments, and you will be fine. For extra protection, install anti-malware software to your computer.

How can you free your PC of Phoenix virus?

In case you have been accidentally hit by Phoenix ransomware virus, do not be scared. Consider this accident a good lesson, and never make same mistake again. However, since there are loads of more dangerous ransomware viruses that damage the computer so badly that files and settings cannot be restored^[5]. You should definitely take actions to avoid such dangers.

To remove Phoenix virus, use anti-malware program, because despite the fact that this virus is not the most dangerous one, it still poses a big threat to the computer system and leaving one or two components of it can lead to sad consequences later on. If you’re ready to start the Phoenix removal, read instructions provided below.