Manifestus Ransomware

Manifestus Ransomware is a frustrating infection that will encrypt your files and will tell you to restore your data by paying the ransom fee. Supposedly, if you pay the fee, you will be able to get your files back immediately. However, computer security experts say that paying the ransom fee is never the option. There is another way to get your files back, and you should not succumb to this ransomware program’s requirements. Please remove Manifestus Ransomware from your system and then make sure that you do not get infected with similar intruders again. For that, you can use a licensed antispyware tool to protect your PC.

The distribution and the infection rate of this program are not too high, so it is not that easy to determine how Manifestus Ransomware spreads around. On the other hand, our security specialists suggest that this program probably comes via spam email attachments. You receive a lot of spam messages every single day, but you probably do not see most of them because they get filtered into the Junk folder. On the other hand, the spam that carries this ransomware infection will land in your main inbox because it will be disguised as legitimate messages from various companies or online stores.

If you are used to such notifications, you will soon notice that there is something fishy about it because normally invoices and other necessary information seldom come in email attachments. If you feel that you simply must open a particular attachment, perhaps it would be for the best if you scanned it with a security application first. Then, you would know for sure whether the attached file is safe or not. However, if you have already launched the malicious file, then Manifestus Ransomware has taken over your files and desktop already.

It is rather easy to see which files are affected by this program. Every single encrypted file will have a “.fucked” extension added to their original extension. Needless to say, the system will be no longer able to read those files, and the infection will try to convince you that the only way to get your files back is to pay the ransom fee. Check out an extract from the ransom note below:

Your personal files are encrypted by Manifestus

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer.
<…>
To obtain the private key for this computer, which will automatically decrypt files, you need to pay 0,2 bitcoins or 160 USD Dollars to the bitcoin adress specified below with your email address to send you the decryption key.

The people behind this infection clearly did not use a spell check, but then again, grammar and spelling accuracy is not their main objective. They want to scare you into thinking that you are out of options, and you need to pay right now. Of course, computer security experts point out that paying is never a good option because there is no guarantee the criminals would really issue the decryption key for you. For all its worth, you might just lose your money, and your files would still remain encrypted. Luckily, there is a public decryption code available for this infection.

Public Decryption Code: Cq0ltoI7EkOa

However, our researchers point out that the decryption tool might be broken because the entire program is fishy. It could be based on Detox (@demonslay335), and one of its most annoying features is the ransom note that pops up on your screen and does not seem to disappear no matter what you do.

Nevertheless, you can get rid of the ransom note by killing its process via Task Manager. Also, at the bottom of this description, you can find the manual removal instructions for Manifestus Ransomware. As mentioned, it should be possible to restore your files with the decryption code, but if it does not work, then delete the infection and then transfer healthy copies of your files back to your system from an external backup.

You should also consider investing in a licensed antispyware application that would protect your PC from similar intruders in the future. Although your web browsing habits are very important if you want to protect your system from harm, having a powerful antispyware tool would also help you a lot with that.

How to Delete Manifestus Ransomware

1. Press Ctrl+Shift+Esc to open Task Manager.
2. Click the Processes tab and highlight the Form2 process.
3. Press the End Process button and close Task Manager.
4. Open the Downloads folder and delete all recently downloaded files.
5. Press Win+R and the Run prompt will open.
6. Type regedit into the Open box and click OK.
7. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run.
8. Right-click and delete the DO NOT OPEN THE FUCKIN RANSOMWARE value on the right.
9. Close Registry Editor.