Dedcryptor Ransomware

It was determined that Dedcryptor Ransomware locks user’s data with the AES-256 cryptosystem. Sadly, no one has created a decryptor yet, so users are still unable to unlock their files. As for the ransomware’s creators they demand users to pay 2 BTC for the decryption of their data. However, transferring around $1.487 without any reassurances is a big risk, and not every user is willing to take it. If you do not wish to give up your savings too, we urge you not hesitate and delete the malware. It might be useful to read the whole article, but if you are here only for the removal instructions, scroll below the text and get rid of Dedcryptor Ransomware.

Dedcryptor Ransomware should be spread with malicious files that are distributed through email. What’s more, it was noticed that some variants of the infection are spread through executable files, which are titled as “Kaspersky antivirus” or similarly. If your computer is not protected by a trustworthy security tool, you can download such file without even realizing that it is malicious. As a consequence, there is nothing that could protect your system from the ransomware too. The malware can decrypt all personal data in a rather short amount of time. Thus, users may not notice what is happening until it is too late.

This infection can encrypt various personal files, such as pictures, documents, videos, etc. For example, it could lock data with the following extensions: .txt, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .odt, .jpg, .png, .csv, .sql, .mdb, .sln, .php, .asp, .aspx, .html, .xml, .psd, .dll, .lnk, .pdf. The encrypted files can be easily separated by additional .ded extension. As you realize, they remain on your computer, but you are no longer able to open or modify data that got encrypted. The only way to unlock such files is to get the decryption key from the malware’s developers or use a decryptor created by volunteers, but our researchers say that no one has created it so far.

What’s more, we also noticed that Dedcryptor Ransomware places ded.png file in the %USERPROFILE% location. Unlike other ransomware applications, this one does not leave .html or .txt files that contain detailed instructions or links to more information. Instead, it changes your background picture with the same ded.png file. The image contains only a short instructions that demand users to write an email to the ransomware’s creators and pay the ransom in twenty-four hours.

To be more precise, it says that “the decryption key is valid for 24 hours!” This might mean that if users do not pay on time, the decryption key could be deleted. The intention behind these threats might be to give you less time to think or scare you into making a rash decision. Before you make your choice, you should be aware that there are two possible outcomes. Either you pay the ransom and get the decryption key, or you do not get it at all and lose all the money that you paid. Naturally, under such circumstances, paying the ransom is not advisable.

If you choose to erase the malware, we can help you with that although the removal part is not that difficult. Unless, you do not remember where you saved the malicious file that belongs to Dedcryptor Ransomware. In that case, take a look at the locations that we listed in the removal instructions. Users commonly use these directories for data downloads. If you do not remember what the file was named like, or you simply cannot find it on your PC, try to install a reputable antimalware tool. Such software can locate data that might be harmful or malicious. Use the scanning tool that will check your whole system and find the ransomware. The security tool could find other detections besides the malware, but once the scanning process is over you should be able to erase all threats at the same time. If you have troubles while deleting Dedcryptor Ransomware, feel free to write us via social media or leave a comment here, and we will try to reply you as soon as possible.

Remove Dedcryptor Ransomware

1. Open the Explorer (Win+E).
2. Locate the malicious file (it could be in the Desktop, Downloads, or Temporary Files folders).
3. Select the infected file, right-click it press Delete.
4. Go to the %USERPROFILE% directory.
5. Find the ded.png file and right-click to delete it.
6. Close the Explorer.
7. Empty Recycle bin.