DCRTR Ransomware

DCRTR Ransomware is used by hackers who seek to extort money from their unfortunate victims by convincing them to purchase a decryption tool. It is said such a tool would be able to unlock all files damaged by this malicious application and unfortunately it can lock a lot of precious data kept on the infected device, for example, photographs, videos, pictures, various documents, and so on. Nonetheless, we are against paying a ransom since there is a chance the hackers may not deliver the promised decryption tool even if the user complies with all their demands. What we mean, by dealing with such people you would risk your savings as they could be lost in vain. Provided, you do not want to risk it, we advise you not to pay any attention to the provided ransom notes and focus on how to get rid of DCRTR Ransomware. One of the ways to do so will be explained in the instructions located below this text.

Further, in this article, we will tell more about the malicious application. To begin with, users should know how DCRTR Ransomware could enter their systems. Usually, similar infections travel with harmful email attachments that victims receive with Spam, from unknown senders, and so on. Therefore, the user can easily allow the malware settle in unknowingly if he carelessly opens such files. Instead of launching suspicious data right away we would recommend inspecting it for a bit, for example, you could check it with a reliable antimalware tool. However, if you do not have the means to check it, you should just avoid opening it or even erase it if the attachment raises any suspicion. Besides Spam emails infections like DCRTR Ransomware can be distributed with various harmful data presented to the victim through annoying pop-up ads, doubtful file-sharing web pages, etc. Consequently, it is also advisable to stay away from suspicious ads and potentially malicious web pages.

If DCRTR Ransomware manages to get in, the threat should create a copy of itself titled msshost.exe in the %APPDATA% location. Plus, the malicious application could create a couple of registry entries in the HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run directories so it could launch the malware automatically after each system restart. Then the infection might start encrypting the victim’s data with both AES and RSA cryptosystems. At the time of the encryption, each file should be marked with a second extension called .[decryptor@cock.li].dcrtr, for example, clouds.jpg.[decryptor@cock.li].dcrtr, and so on. Obviously, after this, all of the files with this extension become unusable as the system becomes unable to recognize them. Moreover, in each directory containing encrypted files, the infection may create a text document called ReadMe_Decryptor.txt; it is no doubt the hackers’ ransom note.

According to the malware’s ransom note, the victim should contact DCRTR Ransomware’s creators as fast as possible since the price for mentioned decryption tool depends on it. To make sure the user can get in touch with the malicious application’s creators they give two separate email addresses: decryptor@cock.li and masterdecrypt@openmailbox.org. It is also mentioned the ransom should be paid in Bitcoins and it looks like the user can choose up to 5 worthless files for free decryption to confirm the hackers can provide the decryption tool. Even so, we would not recommend dealing with them because in the end there is not knowing if they will bother to help you when they get the payment. On the contrary, they could start asking for more money instead.

Those of you who do not want to gamble with your savings we would recommend erasing DCRTR Ransomware with no hesitation. To help remove it manually, we prepared step by step deletion instructions you should be able to find a bit below this article. The other way to get rid of the malware is to acquire a reliable antimalware tool, scan the computer with it, and use the provided removal button to erase the ransomware with other possible threats at the same time.

Eliminate DCRTR Ransomware

1. Press Ctrl+Alt+Delete.
2. Go to the Task Manager.
3. Find the malware’s process.
4. Mark this process and click End Task.
5. Exit Task Manager.
6. Tap Win+E.
7. Navigate to:
   %TEMP%
   %USERPROFILE%\desktop
   %USERPROFILE%\downloads
8. See if you can find the malicious file launched when the computer got infected.
9. Right-click the suspicious file and press Delete.
10. Navigate to %APPDATA%
11. Right-click a file called msshost.exe and select Delete.
12. Then find and erase files titled ReadMe_Decryptor.txt.
13. Close File Explorer.
14. Press Win+R.
15. Type Regedit and click Enter.
16. Go to:
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
17. Look for value names called MssHostEngine, right-click them and press Delete.
18. Close Registry Editor.
19. Empty your Recycle bin.
20. Reboot the system.