Pponce.lorena@aol.com Ransomware

Do you know why Pponce.lorena@aol.com Ransomware slithered into your operating system? Most likely, that is because the conditions for that were right. The infection could be attached to an unreliable software bundle, or it could be sent as a harmless-looking file attached to spam emails. Both bundles and spam emails are distributed randomly to as many people as possible. That means that, for example, the bundle could be presented via commonly visited file-sharing websites and that the spam email could be sent to thousands of people at once. The goal is not to hit someone specifically but to fish for potential victims. Unfortunately, despite the fact that hundreds of file-encrypting ransomware threats exist, Windows users continue to be careless, and that is what makes it possible for malware to invade systems successfully. If you do not remove Pponce.lorena@aol.com Ransomware immediately, this malware encrypts personal files, after which, these files become unreadable.

Our research team has found that Pponce.lorena@aol.com Ransomware is a new variant of the infamous GlobeImposter Ransomware. There are several different versions of this threat, and they are usually distinguished by the extensions that are added to the corrupted files. The “.[ponce.lorena@aol.com]” extension is added by Pponce.lorena@aol.com Ransomware. This extension only indicates that a file was encrypted, but if you delete it, the file will not be magically restored. To restore it, you need to change the data within the file, and that is impossible to do manually, unless you are an expert who has extensive experience with file-encryptors. The good news is that malware experts have been able to build a GlobeImposter Decryptor, and, perhaps, it will be able to assist you as well. At the time of research, the new variant was not yet decryptable, but we have hope that the tool will be able to assist in the future. Unfortunately, not all victims understand this, and if they do not have backup copies of their personal files, they might think that they are out of options. This is what the attackers want.

After Pponce.lorena@aol.com Ransomware encrypts files, “HOW_RECOVER.html” is dropped in every folder that contains damaged data. If you open this file, you are introduced to a message suggesting that you need to obtain a “decryptor” to get the files restored. The message informs that you can send one file to ponce.lorena@aol.com along with an ID number included so that the attackers could prove that full decryption is possible. Of course, if you do as told, the attackers send additional information that is meant to help you pay money in return for the decryptor. Does this tool exist? Will it decrypt all files? Will you get the tool after paying the ransom? These questions cannot be answered, but we do not advise communicating with cybercriminals or paying the ransom because even if the decryptor offered via the ransom note is real, you are unlikely to obtain in. Hopefully, you can employ a free decryptor or use your own backups to get your files back. Once you have this part figured out, you need to delete Pponce.lorena@aol.com Ransomware from your operating system. Note that this malware auto-starts with Windows, and so it could re-encrypt files after a restart. Therefore, we suggest that you remove the infection before you attempt to get your files back.

According to our research team, Pponce.lorena@aol.com Ransomware is dropped to %LOCALAPPDATA% as a file with a random name, and the instructions below show how to reach and delete this file. Of course, you should go through the recently downloaded files to check if there is anything malicious that you need to delete as well. It is also important that you implement a malware scanner to inspect your system and warn you about any leftovers that could remain active. You do not need to worry about any of this if you choose to employ an anti-malware program. This tool can automatically remove Pponce.lorena@aol.com Ransomware without leaving any components behind, and it can also protect your operating system, which is what you need to ensure that new threats cannot attack you. Also, do not forget to be cautious about spam emails and bundled downloaders, as well as to backup all personal files outside the computer to ensure that you always have copies that could be used to replace lost or corrupted files.

Pponce.lorena@aol.com Ransomware Removal

1. Right-click and Delete a file named HOW_RECOVER.html from all affected folders.
2. Tap Win+E keys at the same time to access Windows Explorer.
3. Enter %LOCALAPPDATA% into the field at the top of Explorer to access the folder.
4. Right-click and Delete a malicious [random name].exe file controlling the ransomware.
5. Tap Win+R keys at the same time to access Run.
6. Enter regedit into the dialog box and click OK to access Registry Editor.
7. Move to HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce.
8. Right-click and Delete the value named BrowserUpdateCheck.
9. Empty Recycle Bin, install a trusted malware scanner, and run a system scan to check for leftovers.