Better_call_saul Ransomware

Better_call_saul Ransomware is not a fun infection to deal with, despite the fact that it has employed the name of a popular TV series called “Better Call Saul.” We call this ransomware by this name because of the extension that is added to the encrypted files, ".better_call_saul". The reason this name is used is unknown, but you do not need to focus on that because it is most likely that the creators of this ransomware have used the first thing that came to mind. This malicious infection encrypts your personal files – which is done using an RSA-3072 algorithm – so that it could demand a ransom payment from you. The bad news is that you might have no other way to decrypt your files once they are encrypted. You can learn more about this devious threat in our report, but we want to warn you right away that you will need to remove Better_call_saul Ransomware no matter what happens to your files.

According to our research, Better_call_saul Ransomware is most likely to slither in via a corrupted spam email attachment. It was found that this threat can hide in malicious MS Office Word documents, and it is unleashed when users open these corrupted files. Needless to say, users do not see the ransomware slithering in, which is why they do not take any measures to stop the encryption process. Immediately after your files get encrypted, you will notice the ".better_call_saul" extension attached to them. What is more, you will be informed about what has happened in several different ways. First of all, you are likely to find that your Desktop background has been changed. This ransomware kills explorer.exe and changes your regular Desktop picture with a BMP file that represents the demands shown below. Besides this, the ransomware also creates TXT files that are placed everywhere where encrypted files are. These TXT files are numbered (e.g., readme1.txt, readme9.txt), and they provide further instructions.

ATTENTION!
All the important files on your disks were encrypted.
The details can be found in README.txt files which you can find on any of your disks.

The TXT file of the malicious Better_call_saul Ransomware provides a unique code that you supposedly need to send to post77999@gmail.com or post7799@yahoo.com. Allegedly, further instructions will be provided to you once you contact cyber criminals. Additional steps are provided to those who do not get a response within 48 hours, which includes downloading a Tor browser and visiting websites that supposedly should provide you with “reserve emails.” The sum of the ransom is not provided, which means that you might receive it only after you fulfill all of the initial demands. This also means that the ransom might be adjusted in every case, which makes this ransomware completely unpredictable. As you might know already, you need a decryption key to decrypt the data corrupted by this ransomware. This key is stored on a secret server, and this is the leverage that the creator of Better_call_saul Ransomware has to force you into paying the ransom. Unfortunately, unless your files are backed up in a different location, this might be your only option to restore your files.

Hundreds of different types of files can be affected by Better_call_saul Ransomware. DOC, JPG, WMV, GIF, MOV, and MP4 are just a few of the many types of files that might be encrypted by this infection. The structure of these files is modified (bytes are added) to make it impossible for you to open them. If you remove the ransomware, these files will remain encrypted. Changing the extension will not solve anything either. Obviously, if your files are backed up, you do not need to worry about their encrypted versions. In this case, you should delete Better_call_saul Ransomware as well as the files encrypted by it. In either case, whether or not you pay the ransom, you need to eliminate this infection, and we suggest doing that with the help of anti-malware software. Because malicious programs often travel packaged together, it is possible that you will find more threats, and a reliable anti-malware tool can erase them all simultaneously. Note that the manual removal is not easy at all because some of the files of this ransomware have random names and can be hidden in an unexpected location.

Better_call_saul Ransomware Removal

1. Delete the malicious executable (e.g., malicious MS Office Word file).
2. Launch Explorer (simultaneously tap Win+E).
3. Enter %ALLUSERSPROFILE%\Windows or %ALLUSERSPROFILE%\Application Data\Windows into the address bar.
4. Right-click and Delete the malicious csrss.exe file.