Ims00ry Ransomware

Ims00ry Ransomware is one of those ransomware infections that surely can scare you. Unlike some programs that only pretend to encrypt your files, this one CAN and DOES encrypt them, and then tells you to pay for the decryption key. Luckily, it is possible to decrypt the files for free because a public decryption tool is available. Thus, you just need to focus on removing Ims00ry Ransomware, as you can restore your files later. Nevertheless, just because it is relatively easy to deal with this infection, you should not take it lightly. What’s more, you should be ready to take down other similar infections, too.

Like most of the other ransomware infections, this one also displays a ransom note once the encryption is complete. Let’s take a look at what this ransom note has to say:

I am sorry!!!
All your files photos, databases, documents and other important are encrypted with strongest encryption and algorithms RSA 4096, AES-256.
If you want to restore your files payment.
Price decrypt software is $50.
Attention!!!
Do not rename or move the encryption files.

Although the English in the ransom note is quite dusty, it is definitely clear that you are expected to pay $50 worth of Bitcoins to the given Bitcoin wallet in order to get the decryption key. As mentioned, there is no need to purchase this decryption key from the criminals as a public decryption key is available. Thus, you should just focus on removing Ims00ry Ransomware from your system. In other words, please close this ransom note immediately.

You will see that the ransom note appears as a pop-up on your screen, and there is also a separate TXT file for it, too. The TXT file that carries the ransom note is named README. You will find it on your desktop.

Research says that this infection comes as a self-extracting archive file. It means that users download Ims00ry Ransomware accidentally, and the moment they try opening the file, it extracts itself automatically and then launches the infection.

After execution, all the files are automatically extracted to the %AppData% directory. However, this program doesn’t create a Point of Execution, so there are no additional registry entries to edit. There are several files that Ims00ry Ransomware extracts and then uses. It executes the desk.bat file, and this file performs several commands. The file adds several registry entries, but most of them are for the desktop background that Ims00ry Ransomware automatically changes to the ransom note.

The infection also tries to locate popular antivirus products on the affected system, and kill their processes. If the Shadow volume copies are enabled, Ims00ry Ransomware automatically disables file recovery from the Shadow volume. While not every single ransomware program deletes the Shadow volume copies, it is a rather common practice, which is employed with the intention to prevent a user from restoring their files.

To avoid such infections, you clearly need to be careful about what files you download from the web. It is common for ransomware infections to travel via spam email attachments. So do not be so hasty as to open every single attachment. Ask yourself whether you were really looking forward to this email, or if you really know the sender.

Sometimes ransomware installer files come through corrupted RDP connections, too. Thus, it would be a good idea to scan every single file you receive with a reliable antispyware tool. It is always better to be safe than sorry. Finally, do not hesitate to back up your files on an external hard drive. If you have a spacious cloud drive, you can back up your files there, too.

Just because it is possible to decrypt the files affected by Ims00ry Ransomware, it doesn’t mean you should refrain from employing all the possible security measures. After all, another ransomware program could enter your computer again, and then you would be forced to rely on a data backup if a public decryption tool is unavailable.

When you remove Ims00ry Ransomware, do not forget to scan your computer with a security tool. There might be more unwanted files or dangerous applications installed. You have to make sure that your system is absolutely clean before you set out to restore your files.

How to Remove Ims00ry Ransomware

1. Press Win+R and type %AppData%. Click OK.
2. Delete the following files from the directory:
   svchost_.exe
   desk1.jpg
   desk.bat
3. Scan your PC with SpyHunter.