SUMMON ransomware (Virus Removal Instructions) - Easy Removal Guide
SUMMON virus Removal Guide
What is SUMMON ransomware?
SUMMON ransomware – a cryptovirus developed for Bitcoin extortion
SUMMON ransomware is a file-locking virus that encrypts all personal victim data and generates ransom notes which demand to forward Bitcoins to the assailants for a decryption tool. Also, encrypted files are renamed in a complex manner. Original filenames are prepended with one of the attackers' email addresses summonunlock@gmail.com along with an appointed victim ID (both in brackets) and then appended with a .SUMMON extension.
If a victim had a file named a.pdf, it would now look like [SummonunLock@gmail.com][id=XXXXXXXX]a.pdf.SUMMON (Xs' stand for user ID). Two ransom notes appear when that's finished, one as a text file #ReadThis.TXT, and one as an HTML document, #ReadThis.HTA.
If you see any symptoms that your device might be infected with SUMMON ransomware virus, please don't panic and make rash decisions. It's not the end of the world. We have searched into the activity of the ransomware and other cybersecurity specialists' research shows that it is possible to remove the threat. This article contains a summary, distribution methods, data recovery options, and removal methods of this computer infection.
| name | SUMMON ransomware |
|---|---|
| type | Ransomware, cryptovirus, file-locker |
| Distribution | Spam emails, file-sharing platforms, RDP attacks |
| Appended file extension | Renamed files look like this – [SummonunLock@gmail.com][id=XXXXXXXX]original_filename.SUMMON |
| Ransom note | #ReadThis.HTA, #ReadThis.TXT |
| Criminal contact details | summonunlock@gmail.com, summonunlock@mailfence.com. Two more possible addresses – Dude@mailfence.com, Summon@nuke.africa |
| Malware removal | Use dependable anti-malware software to remove SUMMON ransomware virus from all infected devices |
| System repair | Powerful tools like the FortectIntego app should be used to repair any and all system damage that was caused during the encryption |
Ransomware has been lurking in the shadows of the internet for a long time now, and it won't stop spreading any time soon. There are ransomware families and rogue ransomware. It can target regular people as well as big corporations. New versions are developed daily. Here are a few examples of the latest ones:
All of them might use different encryption techniques,[1] distinct ransom notes, various appending methods, and extensions. Still, all of their goals are the same – frightening their victims into submitting to the assailants' demands. That's done by using various scare tactics in the ransom notes.
Here's what message developers of SUMMON ransomware send to their victims:
Your SERVER/COMPUTER is encrypted by us !_
Hello Admin/Guest![ENCRYPTER] => All your data is encrypted by us ..
[ENCRYPTER] => Your Server Unique ID : [-]
[ENCRYPTER] => Do you want to decrypt your data?
[ENCRYPTER] => To trust us, first send us a 100-200 KB file,
we will decrypt it to build trust for you.[AFTERTRUST] => What should you do after building trust?
Help
(
All your data is encrypted,
If your data is important and you want to decrypt it,
You must pay the bitcoin amount set by us,
Send a message to our emails first, after pricing, us and your trust,
Do a Google search to buy bitcoins,
For example: “Buy bitcoins in rubles”.
After purchasing Bitcoin, you must
transfer the Bitcoin to our wallet,
After payment, the decryption tool will be sent to you
along with how to execute it properly
)ENCRYPTER@server ~ $ To contact us, first send a message to our first email.
[FiRsT Email:] SummonunLock@gmail.com
ENCRYPTER@server # If your email is not answered after 24 hours, our email may be blocked.
So send a message to our second email.
[SeCoNd email:] SummonunLock@mailfence.comKing Of Ransom
SUMMON Ran$omW4rE
Usually, a few files' free decryption is guaranteed to prove that a necessary decryption tool exists (including SUMMON ransomware virus). Sometimes a video of the decryptor in action is added. Victims are urged not to use any third-party software to unlock the files, as the only way to do that rests in the cybercriminals' hands.
In many cases, that might be true, but agreeing with the assailants' demands is the worse thing any SUMMON ransomware victim can do. The send money motives the cybercriminals to expand their whole illegal operation and funds their research and development. The only way to stop ransomware from spreading is if victims stop paying the ransom.
Therefore, remove SUMMON ransomware from your devices. If you don't have the required tools, we recommend using either SpyHunter 5Combo Cleaner or Malwarebytes to automatically finish this task. Please remember to keep the virus databases of either of these apps updated, and they might prevent such mishaps in the future.
Ransomware-type viruses tend to mess with system files and settings, that could lead to various abnormal system behavior. So to finish SUMMON ransomware removal, users will have to use another tool. IT experts from Virusai.lt[2] recommend entrusting this task to the powerful FortectIntego system repair tool.
Watch out for unsolicited attachments, and hyperlinks in emails
threat actors behind ransomware have many spreading options, including Remote Desktop Protocol attacks, deceptive ads, file-sharing platforms, and so on. Although, our research suggests that one of the most popular ransomware distribution options is spam emails.
Ransomware payload files can be hidden in either infected email attachments or hyperlinks. Cryptoviruses might be hidden as practically any file type, including .zip, .rar, .xlsm, .exe, .docx, .pdf, etc. As soon as either of the two options are clicked and opened, a virus might find its way onto the device and start encryption.
Users have to be aware that cybercriminals are always on the hunt. Emails that urge users to install software updates, or download a crucial document, are most likely phishing emails. Watch for grammatical mistakes, strange domains, and other irregularities to identify a spam email.
Instructions for SUMMON file virus removal from Windows computers
If you got your device infected with SUMMON ransomware virus, it's your anti-malware software fault, not yours. The main thing is not to panic. Don't even look at the ransom note. Download and install professional anti-malware tools such as SpyHunter 5Combo Cleaner and Malwarebytes that will help you eliminate this threat.
It's worth mentioning that SUMMON ransomware removal won't decrypt your files. There could be third-party tools that you could try (displayed at the bottom of this page). If none of them work, extract all essential files to an external storage device and wait for a public decryption key or tool to be made available.
Use the aforementioned tools to remove SUMMON ransomware from the infected device automatically. Once that's done, run a full system scan with the FortectIntego app to fix any system irregularities, such as corrupted registry and other core settings/files. If left unattended, these changes might result in crashes, freezes, BSoD,[3] and other system issues.
Getting rid of SUMMON virus. Follow these steps
Manual removal using Safe Mode
If virus prevents from opening anti-malware solutions, you can do that in Safe Mode with Networking
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Remove SUMMON using System Restore
Removing file-locking parasites with System Restore
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of SUMMON. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Bonus: Recover your data
Guide which is presented above is supposed to help you remove SUMMON from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.If your files are encrypted by SUMMON, you can use several methods to restore them:
Regain your files with Data Recovery Pro
This app might help restore .SUMMON extension files.
- Download Data Recovery Pro;
- Follow the steps of Data Recovery Setup and install the program on your computer;
- Launch it and scan your computer for files encrypted by SUMMON ransomware;
- Restore them.
Restoring files with Windows Previous Version
This powerful feature might allow victims to recover .SUMMON extension files one at a time.
- Find an encrypted file you need to restore and right-click on it;
- Select “Properties” and go to “Previous versions” tab;
- Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.
Using Shadow Explorer to retrieve old files
- Download Shadow Explorer (http://shadowexplorer.com/);
- Follow a Shadow Explorer Setup Wizard and install this application on your computer;
- Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
- Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.
Decryption for SUMMON ransomware is not created
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from SUMMON and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Access your website securely from any location
When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.
If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like Private Internet Access can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.
Recover files after data-affecting malware attacks
While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files. More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.
Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, Data Recovery Pro can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
- ^ Tarcísio Marinho. Ransomware encryption techniques. Medium. American online publishing platform.
- ^ Virusai. Virusai. Spyware news and security.
- ^ Blue Screen of Death (BSoD). Techopedia. Professional it insights.