AskHelp@protonmail.com Ransomware

It is very often that the same developers create several malware infections, and they get released in generations. AskHelp@protonmail.com Ransomware is one of those programs. It is not a stand-alone infection because we have dealt with its predecessor before. However, the problem with ransomware program families is that one remedy does not fit them all. Hence, even if you remove AskHelp@protonmail.com Ransomware from your computer, the decryption key that was designed for the previous programs will not fix anything this infection has done. It is one of the biggest disadvantages of dealing with ransomware programs, and users have to keep that in mind.

From what we have found, AskHelp@protonmail.com Ransomware is a new version of the Matrix Ransomware infection, also known as Matrix9643@yahoo.com Ransomware. It employs the same distribution methods, so it is very likely that this program entered your system through spam email attachments. If you have recently downloaded some file you received from an unfamiliar sender, the chances are that file carried the infection, and you opened it accidentally.

We would like to emphasize that it is strongly recommended to scan the newly received files with a security application before you open them. Although the chances of getting infected with ransomware are rather slim (only very small number of spam emails reach their target eventually), it is always a good idea to employ certain safety measures before you delve into something unknown. Prevention is always a far better choice than actually dealing with the consequences of a ransomware infection.

So, let’s say AskHelp@protonmail.com Ransomware enters your computer, what happens then? Based on our tests, when this program is launched, it displays a console window that shows the encryption progress. It encrypts most of the files in the %AppData% directory; although it will leave the Windows system files intact because this malware program still needs your system to function properly.

Aside from encrypting the files, AskHelp@protonmail.com Ransomware also drops log files that contain information about unsuccessful encryption on your Desktop. The log files are elog_.txt and bad_.txt. You will need to remove these files when you get down to removing this infection. The files do not do anything in particular, but there is no need to keep them on your computer.

AskHelp@protonmail.com Ransomware will also monitor your network shares and enumerate available disks. It means that it could encrypt files across several systems if they are connected into one network, and this is especially dangerous if the program accesses a corporate system. That is why ransomware programs are quite eager to affect not only individual computers but also small businesses. They act on the assumption that small businesses are less likely to invest in cyber security, but they are more willingly to pay the ransom because they might feel desperate about getting their data back.

What’s more, this infection makes sure that users wouldn’t be able to restore files from system backup because it drops random-named VBS and BAT format files in the %AppData%, and those files run in the startup to remove the Shadow Copies (if they were enabled in the first place). So when AskHelp@protonmail.com Ransomware is sure that you can no longer retrieve your files (unless you have them saved on an external hard drive), it displays the ransom note, which reads:

We are realy sorry to inform you that:
ALL YOUR FILES WERE ENCRYPTED with AES-128+RSA-2048 algorithms!
Without your personal key and special software data recovery is impossible!

To recover your files please write us to the e-mails:
<…>

Please don’t worry, we can help you to restore your server to original state and decrypt all your files quickly and safely!
Please write us and we will help you!!!

We can also see that the ransom note emphasizes the importance of reaching the developers through all three given emails, and this just proves how unstable the malware server is. Hence, there is also no guarantee that they would issue you the decryption key, and so you should never rely on these scammers.

Remove AskHelp@protonmail.com Ransomware immediately, and then check out all the options possible that would help you restore your files. Perhaps you are not aware of that, but you may have a lot of your files saved someplace else. It is especially common when you do a lot of work with your mobile device. So try everything to reverse the damage caused by this infection.

How to Delete AskHelp@protonmail.com Ransomware

1. Press Win+R and the Run prompt will open.
2. Type %AppData% into the Open box and click OK.
3. Remove the BMP, VBS, and BAT format random-name files.
4. Delete the ransomware log files from your Desktop.
5. Go to your Downloads folder.
6. Remove the most recently downloaded files.
7. Run a full system scan.