Severity scale:  
  (85/100)

SuperB ransomware virus. How to remove? (Uninstall guide)

removal by Gabriel E. Hall - - | Type: Ransomware
12

SuperB appends new file-extension – .enc

The image of SuperB payement site

SuperB is a file-encrypting virus[1] that is designed to take user’s files to hostage and swindle the money from the users. Originally, the ransomware appends .superB file extension. However, since September 2017, the malware also adds the .enc suffix to the targeted files.

However, there is still a veil of mystery enshrouding this malware. There is no information whether it deletes shadow volume copies. Most likely it uses RSA-2048 or AES-256 algorithms to encode data.

The SuperB virus has its own website. The payment site has three sections. “pay by BTC” instructs how to purchase bitcoins. In exchange to the affected files, the perpetrators ask to buy $300 worth-bitcoins and transfer the files to the specified bitcoin address.

SuperB ransomware payment site includes several links to wikiHow to help users buy bitcoins. Interestingly, the infection also offers a video about the decrypter. However, the link redirects to a questionable YouTube site with a short message that the video is unavailable. Thus, it raises assumptions that the crypto-virus might be still under development.

In case victims run into technical difficulties, they should use the indicated form below the support section. Besides entering the ID (which is displayed in a ransom note), affected users should also disclose email address and confirm it with a captcha code.

Cyber criminals claim to contact victims within 24 hours. According to them, if the transaction is completed without any problems, users’ files, which bear .superB file extension, should be decrypted. However, in case of ransomware, it is never recommended to pay the ransom as the probability of data retrieval is always very small. Thus, it would be better to remove SuperB malware. Reimage or Malwarebytes Anti Malware will help you delete the infection.

Criminals presented a new version of SuperB virus

The new version of SuperB ransomware has been detected at the end of September 2017. The virus is written in Python. During data encryption, it overwrites the files with the ransom note. It also creates copies of the original files and appends .enc file extension. It aims at pictures, videos, documents and other files stored on the targeted device.

The virus spreads as a test.exe file which is most likely to be obfuscated and attached to the email. Once users open it, the executable is dropped and loaded on the system. Once data encryption is over, users are delivered a ransom note in Word document which contains links to the payment website.

The payment website offers to obtain the SuperB decryptor. Victims are asked to transfer $300 in Bitcoins. However, doing that is not recommended because there’s no guarantee that you will be able to get access to your data.

Malware might attack computers using different strategies

Most likely, this version of crypto-virus is used to spread via corrupted sites or torrent files. There are chances that corrupted apps[2] might facilitate SuperB hijack.

In addition, the malware may also hide in spam emails supposedly sent from official institutions. Since it functions via a trojan, bear in mind that cyber protection is vital. Besides vigilance, update security tools.

Instructions for SuperB elimination

Since the virus is still likely to be under development, SuperB removal should not cause much trouble. Nonetheless, if you cannot launch malware elimination tool (e.g., [d]1, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus), take a look at the below instructions. 

If you reboot the system in Safe Mode or perform System Restore, you will be able to remove SuperB virus. Note that data recovery should be performed after you eliminate the threat completely. Due to low activity of the malware, it is likely to target only specific, for instance, British[3] users. Finally, it is recommended to uninstall the decrypter, if you already installed it. Even if it decrypts files, it may leave malicious files which will benefit future hijack.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove SuperB ransomware virus you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall SuperB ransomware virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.

Manual SuperB virus Removal Guide:

Remove SuperB using Safe Mode with Networking

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove SuperB

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete SuperB removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove SuperB using System Restore

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

In case the first method did not help, System Restore should help you access the security tool.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of SuperB. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that SuperB removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove SuperB from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

If your files are encrypted by SuperB, you can use several methods to restore them:

What is Data Recovery Pro?

This program helps you recover damaged files and documents after a system crash. Nonetheless, it might come in handy in this situation as well.

Make use of Shadow Explorer

As there is no information whether the virus deletes shadow volume copies in advance, you might have another chance to recover the files.

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

SuperB Decrypter

It is not recommended to use the decryption software offered by the malware developers as it may only create more system vulnerabilities.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from SuperB and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Gabriel E. Hall
Gabriel E. Hall - Passionate web researcher

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Gabriel E. Hall
About the company Esolutions

References