How to remove SkyName ransomware virus

SkyName a fake-crypter that demands money for data “decryption”

SkyName virus is another HiddenTear follow-up ^[1] that uses the open source code of this educational program to infect computers for the money-making purposes. Unfortunately, the good intentions of HiddenTear creators have turned upside down when the hackers have found a way to use this code for their malicious purposes. In a sense, the hackers have been gifted a free ransomware building kit ^[2], so it only natural that they took the chance to try it out. The good thing about SkyName malware is that it is a fake-crypter ^[3]. This means that the program does not have malicious encryption algorithm implemented. Thus, it does not lock files. Nevertheless, the extortionists rely on well-developed scare tactics ^[4] and employ social engineering tricks to get the users to pay for the files without even trying to look for other alternatives. SkyName is not the most destructive creation out there, but other HiddenTear spin-offs might not be as merciful. These parasites may actually encrypt your files damaging them for good. Hence, we want to urge you to take precautions against ransomware attack and invest some time and resources in proper data protection ^[5]. If the virus is already on your computer, you should reject any payment requests and remove SkyName unhesitatingly. We recommend using FortectIntego for the virus removal.

SkyName is a ransomware primarily oriented towards the Czech-speaking computer users. The virus not only spreads within the Czech Republic but features ransom note in this language as well. In that sense it is similar to our recently discussed Czech ransomware. The contents of SkyName ransom note are presented in the picture above and in English they roughly translates as:

Your computer was hacked and your files are encrypted so you can access them and did not have access!
Send 1,000 CZK Koruna in Bitcoin address
18DHHw4ko23HNm5GRXVZM7XLeFXX2sgSPj
Then you and your e-mail address:
jschweiz@protonmail.ch to e – mail ID specified:
*****
and get a decryption key and program, which in turn unlock files.
The report is available on the desktop file INFOK1.txt

Though the demanded amount of ransom is not large (1,000 CZK Koruna equals around 40 USD) there is no reason to pay it since the files are not actually encrypted. You should better start looking for some effective SkyName removal options and banish this virus from your computer right away.

How to protect files from ransomware infection?

SkyName infection is linked to Blablabla.exe file which is usually detected on the computers when this fake-crypter is installed. This file may get installed via infected social media links or software sharing sites. The latter is more common since the malicious payload can infect devices with minimal interaction from the user. In other words, the victim has to accept the installation of a software package that secretly carries SkyName payload and the virus will do the rest itself. Though this virus is not a file-locking infection, its malicious counterparts spread almost identically. Thus, you must always check whether the content you are installing on your PC is actually safe.

Remove SkyName and recover your files:

Luckily, with this virus, you simply have to remove SkyName to reclaim your personal data. Antivirus software is designed specifically for this purpose, so the virus extermination will not take long. Of course, the duration of SkyName removal procedure depends on the type of software you use for the removal. If you use heavier antivirus suite — it might take a little longer. However, lightweight anti-malware utilities can be just as successful with the SkyName virus.