Marlboro Ransomware

Malware researchers have recently detected a new dangerous computer threat. Its name is Marlboro Ransomware, and it is known to be an infection encrypting users’ personal files. Consequently, users discover a number of files having such filename extensions as .docx, .gif, .xlsm, .zip, .tif, .dif, .ibd, .java, .bmp, .mdb, .txt, .mp3, .ms11, .bak, .bat, .class, .paq, .asc, .stw, .pdf, .pem, .jpeg, and others locked after the successful entrance of Marlboro Ransomware. Ransomware infections do not encrypt users’ files for no reason. It is already clear that they all do that to get money from victims. Marlboro Ransomware acts the same. Users discover a file dropped on their computers with a piece of information telling users that their files have been encrypted and asking them to send a certain amount of money to get them all decrypted. Specialists at pcthreat.com suggest ignoring the message left by cyber criminals because making a payment, unfortunately, does not guarantee that files will be unlocked. Also, a ransomware infection will not be deleted from the computer, so its file might be accidentally launched by a user again. If this happens, files will be encrypted one more time. If this is not what you want, go to fully delete Marlboro Ransomware from your computer first. After getting rid of this malicious application, you could decrypt your files using a free decryption tool. See, there is no point in transferring money to cyber criminals when it is possible to decrypt files without the decryptor bad people behind this ransomware infection claim to have.

It has been confirmed that Marlboro Ransomware enters computers without permission. Specialists have found that this infection appears on computers after users download a malicious Word (.docx) document from a spam email they receive. When this file is opened, this ransomware infection is then downloaded from http://mhustler2018.000webhostapp.com/. The malicious file dropped on the system might have a name borrowed from an application that is not associated with malware by any means: SimpleMalwareProtectorSetup.exe. It should also be noted that there are two separate versions of ransomware executables for different architectures (64-bit and 32-bit). Only one version, depending on the target’s architecture, should be dropped.

Once Marlboro Ransomware has successfully entered the system, it immediately starts encrypting users’ files using a simple XOR encryption. Luckily, it does not encrypt .exe and system files, so system utilities will continue working, meaning that it should not be extremely hard to erase this file-encrypting threat from the computer. Actually, files encrypted by this malicious application can be easily recognized because they all get a new filename extension .oops after the encryption. The ransomware infection we are focusing on in this article not only performs the encryption process, but also drops a file, the so-called ransom note (_HELP_Recover_Files_.html), on the affected computer. Users find instructions telling them to purchase Bitcoins and then transfer 0.2 BTC (~ 170 USD) to the Bitcoin address 1FjhBs6VN5hX957yem4QPRoTuDdUxQC2BC when they open this file. As it is told there, the decryption program has to be run (it has been placed on Desktop by the ransomware infection) after doing that. Even though paying the required money might seem to be the quickest way to get files back, you should not transfer money to cyber criminals because a free decryption tool exists (it can be downloaded from the Internet). Also, supporting bad people developing malicious software is not a good idea also because they will never stop doing their job, i.e. creating threats. It is highly recommended to go to decrypt files after the full removal of Marlboro Ransomware only because files might be encrypted again if this infection is not removed from the system.

Luckily, Marlboro Ransomware does not make changes in the system registry and does not drop too many files on the computer, so you should be able to erase this computer infection from your PC manually. If you feel that you need some help with that, feel free to use the manual removal instructions prepared for you by specialists working at pcthreat.com. You will find files you need to delete from your computer listed there and where to look for them. The manual removal of malware is not an easy process and takes some time, so users who wish to delete this ransomware infection quicker and be sure that it is really gone should use an automatic tool, e.g. SpyHunter. Only one scan with a right tool will make your system clean.

Delete Marlboro Ransomware manually

1. Press Ctrl+Shift+ESC.
2. Open the Processes tab and kill the malicious process.
3. Open the Windows Explorer.
4. Find the malicious file in %TEMP%, %USERPROFILE%\Desktop or %USERPROFILE%\Downloads.
5. Delete it.
6. Remove _HELP_Recover_Files_.html from Desktop.
7. Find and delete the decryption tool used by ransomware (it might have a name DecryptFiles or deMarlboro) from your computer.
8. Clear the Recycle bin.
9. Go to download a free decryptor created by specialists from the Internet and then unlock your files with its help.