Cyborg Ransomware

What is Cyborg Ransomware?

Cyborg Ransomware is a threat that encrypts your files and changes your Desktop picture. Files that become encrypted become unusable as your system should no longer recognize them. The worst part is that while decryption tools might exist, it might be impossible to get them. The only good news is that the malicious application seems to be targeting files located in specific directories only, which means it might not encrypt all of your data found on your computer. If you keep reading our article, you can learn more about this malware. Also, we advise checking our removal instructions available at the end of the text. They can help you remove Cyborg Ransomware manually if you feel up to such a task. Should you need more assistance or have questions about the malicious application, do not hesitate to use our comments section.

Where does Cyborg Ransomware come from?

Cyborg Ransomware might come with suspicious files downloaded from sources like torrent or other untrustworthy websites, Spam emails, and so on. Thus, if you find this malware on your system, you should think about recently downloaded files or data interacted with. To prevent malicious applications from entering your device, you should never download or run files coming from questionable sources. Our researchers at Anti-spyware-101.com recommend scanning files from the Internet with a legitimate antimalware tool even if they do not seem to be dangerous. Hackers have ways to make executable files look like text or other documents instead, so they can disguise malicious launchers to trick you into opening them. A scan should not take long, and if a file appears to be harmful, the time you might spend to scan doubtful data would be well invested.

How does Cyborg Ransomware work?

Our researchers say that Cyborg Ransomware might place a copy of its launcher in the %Homedrive% directory and that the file might be hidden. Afterward, the malicious application might start searching for files it could encrypt in the following locations: %USERPROFILE%\Desktop, %USERPROFILE%\Downloads, %USERPROFILE%\Documents, %USERPROFILE%\Pictures, %USERPROFILE%\Contacts, and %USERPROFILE%\Links. As for data located in other folders, it seems like the malware should leave it be.

If the malware is allowed to finish encrypting files, they ought to receive a second extension that could be called .petra, for example, book.pdf.petra. Then, Cyborg Ransomware should change your Desktop image with a black picture that ought to have a short text written in blue. According to this message, victims can find more information about what happened to their data if they open a text file named Cyborg_DECRYPT.txt. It explains that users can get their files back or, to be more precise, get decryption tools that could restore them by paying a ransom. The requested sum appears to be 300 US dollars paid in Bitcoins. You should know that there are no guarantees that you will get your files back even if you pay a ransom, which is why we advise not to do it if you fear you might lose your money in vain.

How to erase Cyborg Ransomware?

One of the ways to delete Cyborg Ransomware is to find the downloaded launcher as well as its copy and remove them both from your system. Since the task could be challenging, we prepared the instructions you can find below this article. However, if the task still seems to be too complicated, we recommend getting a legitimate antimalware tool that could detect and remove Cyborg Ransomware.

Restart the device in Safe Mode with Networking

Windows 8/Windows 10

1. Press Windows key+I and tap the Power button.
2. Tap and hold the Shift key; then pick Restart.
3. Pick Troubleshoot from the Advanced Options menu.
4. Select Startup Settings, choose Restart, then click the F5 key and restart the computer.

Windows XP/Windows Vista/Windows 7

1. Go to Start and select the Shutdown options.
2. Select Restart, then tap and hold the F8 key as soon as the computer begins restarting.
3. Choose from Safe Mode or Safe Mode with Networking in the Advanced Boot Options window.
4. Press Enter and log on.

Display hidden files and folders

Windows 8/10

1. Press Windows key+E.
2. Choose View and select Options.
3. Click Change folder and search options.
4. Select View tab again and mark Show hidden files, folders and drives.
5. Click OK.

Windows 7/Vista

1. Open Control Panel from the Start menu.
2. Go to Appearance and Personalization.
3. Choose Folder Options and select the View tab.
4. Tap Show hidden files, folders and drives.
5. Press OK.

Windows XP

1. Open Start and launch Control Panel.
2. Navigate to Appearance and Themes.
3. Select Folder options and go to the View tab.
4. Choose Show hidden files and folders.
5. Click OK.

Eliminate Cyborg Ransomware

1. Open File Explorer (Windows key+E).
2. Locate these paths:
   %TEMP%
   %USERPROFILE%\Downloads
   %USERPROFILE%\Desktop
3. Locate the malicious application’s launcher (could be any recently downloaded file).
4. Right-click it and select Delete.
5. Navigate to: %Homedrive%
6. Find a file called bot.exe or similarly, right-click it and select Delete.
7. Find documents called Cyborg_DECRYPT.txt, right-click them too and press Delete.
8. Exit File Explorer.
9. Empty your Recycle Bin.
10. Restart the computer. Download Removal Tool100% FREE spyware scan and
    tested removal of Cyborg Ransomware*