Bestdecoding@cock.li Ransomware

Posted by Max Lehmann on March 7, 2019

What is Bestdecoding@cock.li Ransomware?

If we had to name one threat that Windows users need to avoid, Bestdecoding@cock.li Ransomware could be it. Although it is pretty unoriginal, it is a file-encrypting threat, which makes it very dangerous. Every file affected by this infection is modified to ensure that it can be read only using a special decryptor. Where is it? We do not know if it is a real thing at all, but if it is, cyber criminals must have it hidden somewhere out of research. If you were able to obtain the decryptor for free, there would not reason for malware attackers to create ransomware and communicate with victims. The attackers are using email as the main mean of communication, and if you initiate a conversation after your files are corrupted, they can demand a ransom payment from you. Even if your files are destroyed permanently, and you do not have backups that you could fall back onto, you still do not want to pay the ransom or even email the criminals in the first place. We discuss that and the removal of the threat in this report, and if you want to learn how to delete Bestdecoding@cock.li Ransomware too, keep reading.

If you have any knowledge of ransomware, you might know about the Crysis/Dharma ransomware family. It consists of numerous identical infections that must have been created using the same malware code. Bestdecoding@cock.li Ransomware works just like Newsantaclaus@aol.com Ransomware, Backdata@qq.com Ransomware, Skynet45@tutanota.com Ransomware, and many other threats alike. As you can see, the only thing that is different is the email addresses that their creators use for the purpose of communication. Because of that, the extensions appended to the corrupted files change too. In the case of Bestdecoding@cock.li Ransomware, the extension is “id-[ID].[bestdecoding@cock.li].best,” and it includes your unique ID that you are meant to send to the attackers so that they, presumably, could identify you as a real victim. These instructions are presented via the bestdecoding@cock.li window that is launched after the files are encrypted. Besides the main email address, the message in the file, also lists best@decoding.biz. We do not recommend sending messages to either of these addresses.

Can you see a file named “FILES ENCRYPTED.txt” on the Desktop? It is safe to open, as it is just a text file. It is created by Bestdecoding@cock.li Ransomware too to introduce you to the same two email addresses. Since we do not recommend contacting the attackers, it is best if you just delete the file and move on to more pressing matters, like deleting the infection itself. “But what about the files?,” you may ask. Well, if they were encrypted, you might as well just remove them too because you are unlikely to recover them. You are unlikely to see the decryption tool that the attackers promise you either; even if you do as told and pay the ransom in Bitcoins. We do not know how much would be asked from you, but even if the ransom was small, paying it would be a waste of money. If you want to protect your files from loss or damage – and that can be caused by other things, not just malware – you want to back them up. If you have backups already, what are you waiting for? Remove the threat and devise a better security plan.

Did you know that you can solve security-related and malware-removal issues at once? You can do that using the help of an anti-malware program. Simultaneously, it will remove Bestdecoding@cock.li Ransomware and reinstate full protection against all infections. You will not achieve that if you decide to eliminate the file-encryptor manually. You can erase the threat yourself using the instructions below, but remember that you will need to take care of your system’s and files’ security separately. We also recommend that you find the .exe file that launched the infection before you begin manual removal because most victims are not able to identify and remove this file, and, in this case, following the steps below is a waste of time. In the future, remind yourself to back up files to keep them safe.

How to delete Bestdecoding@cock.li Ransomware

Find and Delete the launcher .exe file.
Delete all copies of the FILES ENCRYPTED.txt file (check the Desktop and the local drive).
Launch Explorer (tap Win+E keys at the same time).
Enter these directories into the quick access box to find and Delete the [random].exe and Info.htafiles:
- %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\
- %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
- %APPDATA%\
- %WINDIR%\System32\
Exit Explorer and then launch RUN (tap Win+R keys at the same time).
Type regedit.exe and click OK to open the Registry Editor menu.
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run on the left.
Delete the values whose value data points to %APPDATA%\Info.hta, %WINDIR%\System32\Info.hta, and %WINDIR%\System32\[random].exe files.
Exit Registry Editor and immediately Empty Recycle Bin to complete the removal operation.
Run a complete system scan using a reliable malware scanner, and if leftovers exist, get rid of them ASAP