May Ransomware

No one wants to get infected with the likes of May Ransomware. This malicious infection is there to swindle you out of your money, and it is very likely that it does not live up to its promises. What we mean is that the ransomware program will tell you it will decrypt your files if you pay the ransom fee, but there is no guarantee it would do so. Thus, you should focus on removing May Ransomware from your system instead. You can find the removal instructions at the bottom of this description, and for more information, you can always leave us a comment.

As far as the infection symptoms are concerned, this program behaves like most of the other ransomware applications out there. The moment it enters your computer, it scans your system looking for the files it can encrypt. Luckily, it does not encrypt every single file on your system. In fact, almost none of the ransomware applications do that. If they were to encrypt your system files, you would not be able to operate your computer at all and, consequently, you would not be able to transfer the ransom. So the people behind these infections do not want that.

Instead, May Ransomware encrypts all of your document and picture files. Thus, it is highly probable that the files affected by this program are the ones you use the most often. It means you need those files, and if the program takes away something that you really need, you might be more eager to pay the money to get it back. This is the logic that the infection uses. But computer security experts point out that the moment a ransomware program enters a target system, it would be good to simply give up on your files, unless you have a backup somewhere.

When you think about it, your picture files, especially if those are photos, should be stored on your mobile device as well. Or perhaps you keep them backed up on an external hard drive. If that is really the case, you should not worry about losing them for good. Also, for the document files, you can most probably find them in your inbox or outbox, especially if the files are recent. If not, from the security industry’s point of view, it is still better to lose the files than pay the ransom. Because if you do pay, you will give the criminals an incentive to continue with whatever they are doing.

Once May Ransomware encrypts your files, it displays this notification without locking up your screen:

You have 5 days for decrypt your files.

All your files have been encrypted with May Ransomware.

For encrypt we use AES256+RSA4096.

Don`t try recover your files.
<…>
YOU MIGHT DEVRYPT 2 FILES FOR FREE. Send it to email decrypt@mayofware.solutions .In Subject ,write your UNIQUE Identificator.

As you can see, the infection supposedly gives you five days to transfer the payment. We can only assume that if the infected user does not pay the ransom, the infection might delete the decryption key, thus making it virtually impossible to decrypt the files. Unfortunately, there is no public decryption tool available at the moment, but if you do not have a file backup, you could save the decrypted files somewhere, as you wait for the decryption tool to come up. Please note that not all programs get their decryption tools. Security specialists mostly focus on highly prevalent infections that affect thousands of innocent computer users.

Whether you have the file backup or not, it is important that you remove May Ransomware at once. You can do it either manually or automatically. Please note that manual removal might prove to be somewhat tedious, especially if you are not used to working with Registry Editor. You would have to hunt for executable files without even knowing their filenames. Ransomware programs often drop files on the target system, generating their filenames at random, so the same infection could have different files across separately infected systems.

That is why automatic malware removal with a security tool of your choice is a lot more efficient option. You simply launch the program, and it takes care of May Ransomware for you immediately. Do what is best for you and your system by terminating this infection today.

How to Delete May Ransomware

1. Press Win+R and the Run prompt will open.
2. Use the Run prompt to open these directories:
   %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
   %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
3. Remove a random named executable file from those folders.
4. Press Win+R and enter %WinDir%. Click OK.
5. Look for the same file in the Syswow64 and System32 folders.
6. Delete the files if present.
7. Press Win+R and type regedit. Press Enter.
8. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
9. On the right pane, right-click and remove entries with the following value data:
   %WINDIR%\Syswow64\*.exe
   %WINDIR%\System32\*.exe
10. Run a full system scan with the SpyHunter free scanner.