DCRTR Ransomware

What is DCRTR Ransomware?

DCRTR Ransomware appears to be a file-enciphering threat that utilizes AES and RSA encryption algorithms to damage user’s private files. Afterward, the malicious program should drop a ransom note claiming the files were encrypted “due to a security problem with” the PC. The same note should also ask to write the cyber criminals behind this malware via email and learn how much the user has to pay to get his data back. Whatever the price is, we do not think it would be wise to give them any money as there are no guarantees they will not scam you. If you do not believe the cyber criminals would hold on to their end of the deal too, we urge you not to take any chances and remove DCRTR Ransomware immediately. Users who feel up to the task can follow the steps available at the end of this report as they will show how to eliminate the malware manually. However, first, it might be wiser to read the rest of our article and get to know this threat better.

Where does DCRTR Ransomware come from?

Our researchers at Anti-spyware-101.com believe the malicious program might infect the system after accidentally launching its installer. For example, file carrying DCRTR Ransomware could be a suspicious file received via email or a recently downloaded setup file you found on torrent or other untrustworthy file-sharing networks. Naturally, if you do not want to make such mistakes in the future, you should watch out for questionable data downloaded from the Internet. Additionally, it is advisable to pick a legitimate antimalware tool you could install on the device. It could stand guard and protect your computer from various threats, just do not forget to update it from time to time; as new malicious programs keep reappearing antimalware tools need to be updated to be able to recognize them, remove their possible vulnerabilities, and so on.

How does DCRTR Ransomware work?

DCRTR Ransomware installs itself by dropping an executable file in the %APPDATA% folder. In fact, it could also add a couple of new Registry entries in two separate paths. According to our researchers, the malware may need such value names to make the computer load it when it gets restarted. Thus, there might be a possibility the malicious program could continuously encrypt new user’s files. It would seem the threat targets almost all data available on the PC except the files in the %WINDIR% folder and its subfolders. It is easy to recognize affected files as they should have a specific second extension (e.g., document.docx.[decryptor@cock.li].dcrtr).

Afterward, the malicious program is supposed to drop copies of ReadMe_Decryptor.txt in all locations with enciphered files. As we explained earlier, the cyber criminals do not say how much their decryption tool is. They claim “the price depends on how fast you write” to them via decryptor@cock.li or masterdecrypt@openmailbox.org. Of course, we would not advise doing so as there are no guarantees they will hold on to their promise and give you the decryption tool. In other words, if you choose to pay the ransom you could lose both your files and your money, which is why it is advisable to eliminate DCRTR Ransomware instead of contacting its developers.

How to erase DCRTR Ransomware?

If you want to try to delete the malware manually, you should use the steps we placed at the end of this paragraph as they can guide you through this process. Users who find it a bit too complicated could employ a legitimate antimalware tool instead. All you need to do is choose a trustworthy tool, install it, and set it to scan the PC. Once the scanning is over it should display a report with detected possible threats; among them, you should see DCRTR Ransomware.

Remove DCRTR Ransomware

1. Tap Ctrl+Alt+Delete.
2. Select Task Manager.
3. Look for a malicious process that could be associated with the malware.
4. Select this process and click End Task.
5. Leave Task Manager.
6. Click Windows key+E.
7. Check the following paths:
   %USERPROFILE%Desktop
   %USERPROFILE%Downloads
   %TEMP%
8. Locate the file responsible for infecting the system.
9. Right-click the suspicious file and press Delete.
10. Navigate to %APPDATA%
11. Right-click a file called msshost.exe and press Delete.
12. Exit the File Explorer.
13. Tap Windows key+R.
14. Insert Regedit and press OK.
15. Find the given paths:
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
16. Right-click value names titled MssHostEngine and press Delete.
17. Exit Registry Editor.
18. Empty Recycle bin.
19. Restart the device. Download Removal Tool100% FREE spyware scan and
    tested removal of DCRTR Ransomware*

Stop these DCRTR Ransomware Processes: