Decryption Assistant Ransomware

A new HiddenTear-based ransomware infection has been discovered by researchers working in the cyber security department. Decryption Assistant Ransomware is its name. Although it has already been detected by specialists, it seems that its final version has not been developed yet. It is believed that it is still in development because it does not encrypt any files yet, and two buttons users see on a window opened by ransomware do not work either. It does not mean that this infection is harmless and you can do nothing about its presence. Specialists say that it is a must to remove Decryption Assistant Ransomware completely even if it does not work properly and has not encrypted any of your files because it might be updated one day and start working harshly. Its removal should not be an enormous task that is impossible to accomplish because Decryption Assistant Ransomware, unlike other threats that have been categorized as ransomware, does not make any changes in the system registry, it does not drop any executable files, and it does not block any system utilities. You will find even more about its deletion at the end of this article.

At present, Decryption Assistant Ransomware does not encrypt files, but there is a very huge possibility that its final version will work in full. It will encrypt files by appending a new filename extension .pwned, for example, picture.jpg.pwned and then a window on Desktop will be opened. The message available on this window tells users that their operating systems have been compromised and, as a consequence, personal files, including pictures, music, videos, and documents have all been encrypted. On top of that, users are told that they could unlock their files with a private decryption key only. Since the Decrypt Files button does not work at the time of writing, it is impossible to purchase a decryption key. Luckily, this version does not encrypt any files, so there is no need to transfer money to cyber criminals either. Of course, everything can change in the future. Have you encountered a fully working version of Decryption Assistant Ransomware? If so, you should not rush to send money to cyber criminals because there are no guarantees that you will get a decryption key. Without it, it might be impossible to recover files, but you should try out all data recovery methods that do not require having a private key. For example, you can restore your corrupted data from a backup.

Decryption Assistant Ransomware is not prevalent if compared to other popular ransomware infections, so it is not easy to talk about its distribution either. Most probably, good old methods are used to spread it, specialists working at pcthreat.com believe. They say that spam emails are, most likely, used to disseminate Decryption Assistant Ransomware, but other methods might be employed too. For example, specialists believe that this ransomware infection might be available for download on some kind of untrustworthy page on the web too. In addition, actively working malware on a user’s computer might help ransomware to enter the system unnoticed as well. As you already know, Decryption Assistant Ransomware should start encrypting .doc, .docx, .php, .png, .ppt, .pptx, .psd, .xls, .xml, and .sln files after the successful infiltration, but it does not do that at the time of writing, so specialists believe that it is still in development. Ransomware infections are threats that are not easy to prevent from entering the system, but there is still one thing every user can do – install reputable security software and keep it active. Last but not least, users should be more careful too so that they could avoid malware.

If you use our manual removal instructions, it will not be that hard to delete Decryption Assistant Ransomware. The most complicated part of its removal process is finding a malicious file – it needs to be found and deleted fully. If you cannot find it anywhere on your computer, scan your system with an automatic scanner. It will not only find all active malicious components, but it will also delete them all within seconds. Unfortunately, an automatic tool will not decrypt locked files, so do not expect that you could access them again after scanning your PC with it. The version of Decryption Assistant Ransomware encrypting files might never be released, of course, so you might not need to unlock anything.

Delete Decryption Assistant Ransomware

1. Open the Windows Explorer (tap Win+E).
2. Go to these directories: %APPDATA%, %TEMP%, %USERPROFILE%\Downloads, and %USERPROFILE%\Desktop.
3. Delete recently downloaded/suspicious files from these locations.
4. Empty the Recycle bin.