Genocheats Ransomware

What is Genocheats Ransomware?

Genocheats Ransomware seems to be a malicious file-encrypting program based on open-source ransomware called Hidden Tear. Because of this, there is some hope the decryption tool created by volunteer computer security specialists for Hidden Tear’s encrypted files could work on data damaged by this newly created threat. Thus, instead of rushing to pay a ransom, we urge you to try other possible options first. Further, in this report, we will reveal more details about the malicious program, so if you came across this malware, it would be advisable to get to know it better, especially if this is the first time you are dealing with an infection capable of encrypting files. Slightly below the text, we will present a deletion guide prepared by our specialists at Anti-spyware-101.com, so if you need any assistance with Genocheats Ransomware removal, we urge you to check these steps.

Where does Genocheats Ransomware come from?

The malicious program could be spread through various channels; however, our researchers report, the most popular ways of distributing threats like Genocheats Ransomware is sending victims infected email attachments. In other words, the computer gets infected by the user himself who unknowingly opens the malware’s installer. Even though it might be difficult to identify such files, users could still protect their systems if they would be more cautious. The most important thing is not to make any rash decisions and inspect questionable data before opening it. Any file delivered by someone you do not know and for the unknown purpose should be considered to be suspicious. Moreover, if the user has any doubts, he could simply check the attachment in question with a legitimate security tool and only then try to open it.

How does Genocheats Ransomware work?

There are a few things that should happen once the user opens a file carrying the Genocheats Ransomware’s installer. First of all, the malware may try to settle in by creating a copy of itself and some other data needed for it to work correctly. Next, the threat might immediately start enciphering user’s files. During this process, the affected files could be marked with an additional extension, e.g., sunrise.jpg.encrypted, festival_moments.avi.encrypted, and so on. It is crucial to mention the threat might be only after data in specific locations. To be more precise, our researchers say it should look for files to encrypt in the %USERPROFILE% directory, including all of its subfolders.

Soon after, Genocheats Ransomware encrypts the victim’s files it should place a picture with a message from its creators on the computer’s screen or in other words it may replace your background image with a ransom note. The message should carry short instructions explaining how to make the payment and receive the decryption key with which the user could decipher all affected files. Sadly, there is a possibility the promised password will never arrive as the malware’s creators may appear to be less willing to help you once you pay the ransom. Because of this, we advise against paying the ransom, especially if you do not want to risk your money.

How to erase Genocheats Ransomware?

It is essential to understand that keeping Genocheats Ransomware on the system could still be dangerous even if the malicious program already encrypted your data, so if you decide not to pay the ransom, we strongly advise removing the malware. This you can do manually if you follow the deletion guide added at the end of the report. For those who do not think they can handle such a task, we would advise installing a legitimate antimalware tool and scan the system with it.

Get rid of Genocheats Ransomware

1. Tap Ctrl+Alt+Delete.
2. Launch Task Manager and go to Processes.
3. Search for a process related to the malware.
4. Mark the suspicious process and click End Task.
5. Press Win+E.
6. Check the following paths:
   %USERPROFILE%Desktop
   %USERPROFILE%Downloads
   %TEMP%
7. Locate the infection’s installer, right-click the suspicious file and press Delete.
8. Find this path: %HOMEDRIVE%\{user name}
9. Look for a file called local.exe, right-click it and choose Delete.
10. Find the provided location: %HOMEDRIVE%\user
11. Search for a folder titled Rand123; it should have a file named lsass.exe inside of it.
12. Right-click Rand123 and press Delete.
13. Go to %HOMEDRIVE%\user again.
14. Locate a picture ransom.jpg, right-click it and choose Delete.
15. Leave File Explorer.
16. Empty Recycle bin.
17. Restart your system. Download Removal Tool100% FREE spyware scan and
    tested removal of Genocheats Ransomware*

Stop these Genocheats Ransomware Processes: