Skyfile Ransomware

What is Skyfile Ransomware?

Skyfile Ransomware is a newly-discovered ransomware infection our specialists have detected while looking for new malicious applications. Since it has been detected only recently and is still new crypto-malware, we believe that it is not distributed very actively yet. Of course, it does not mean that it cannot infiltrate your computer and cause you problems one day. Ransomware infections are quite sneaky threats, so the majority of users do not even notice when they infiltrate their computers. They find out about the entrance of crypto-malware when it is already too late, i.e. when they find their files locked. Users who do not want to end up with ransomware infections cannot leave their systems unprotected. If it is already too late for prevention in your case, we want to encourage you to delete Skyfile Ransomware from your system fully right away, especially if you are not going to send money to its author for the decryption of files. Yes, ransomware infections try to obtain money from victims. If it stays and continues working on your PC, all new files you create will be encrypted in no time as well. We cannot promise that you will delete Skyfile Ransomware from your system very easily because this infection drops a bunch of new files, disables Task Manager, and makes changes in the system registry on affected computers, so we recommend reading this report first before you go to remove this ransomware infection from your system.

What does Skyfile Ransomware do?

We are 100% sure that Skyfile Ransomware has been developed to obtain money from users even though a ransom note it drops does not demand money. Cyber criminals know that it will be easier to get money from users when they take something from them, so they have programmed Skyfile Ransomware to lock the most important files, including documents, pictures, videos, and more. Once files are locked, the ransomware infection opens a window with a private ID and a short message explaining what has happened to files that can no longer be opened. Also, it tells users to find and read HOW TO DECRYPT.txt. This file is dropped in all folders that contain encrypted files, so you could find it easily. It does not explain users how to decrypt their files. Instead, users are told that they need to contact cyber criminals by writing an email to getsend@tutanota.com. Even though the ransomware infection does not demand money from users, users might be told that they need to send the ransom in exchange for the decryption tool when they write an email to the author of Skyfile Ransomware. To make sure that users purchase the decryptor, cyber criminals have set this infection to delete Shadow Copies of files and remove the system restore backup too. Free decryption software is not available either. Do not send your money to crooks no matter how badly you need your files back because you cannot be so sure that they will give you the tool for unlocking them.

Where does Skyfile Ransomware come from?

It is still hard for us to talk about the distribution of Skyfile Ransomware because this malicious application has been developed only recently and thus has not affected many computers yet. Even though specialists do not have much information about distribution methods used to spread this ransomware infection, they say that the highest chance to encounter Skyfile Ransomware is for those users who download tons of programs from dubious websites, click on various links, and open attachments from spam emails. Ransomware infections are quite sneaky threats, but it does not mean that it is impossible to prevent them from entering the system. You will be protected against all kinds of threats if you enable security software on your computer, which is why we recommend doing this in the near future.

How to delete Skyfile Ransomware

Skyfile Ransomware is quite sophisticated malware, as research has shown. It not only drops several files, disables Task Manager, but also adds an entry in the system registry. Because of this, you should follow our removal guide step by step if you decide to erase this infection manually. If a single file of this threat is left, it might revive or continue working, so make sure you delete it fully. It is not that easy to delete harmful malware manually, so if you are one of those inexperienced computer users, it would be easier for you to delete Skyfile Ransomware automatically. In this case, you will only need to install antimalware software on your PC and then launch it.

Skyfile Ransomware

1. Press Ctrl+Shift+Esc to open Task Manager.
2. Inspect all processes under Processes and kill those you find suspicious.
3. Close Task Manager.
4. Open Registry Editor (tap Win+R, insert regedit in the command line and click OK).
5. Access HKCU\Software\Microsoft\Windows\CurrentVersion\Run and locate the Java Platform Auto Updater Value.
6. Right-click it and select Delete.
7. Move to HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System.
8. Locate DisableTaskMgr.
9. Right-click it and select Modify.
10. Type 0 instead of 1 and click OK.
11. Close Registry Editor.
12. Open Windows Explorer (tap Win+E).
13. Go to C:\Windows\system32 and delete two files: SkyFile Decryptor.exe and SkyFile Decryptor.lnk.
14. Go to C:\Windows.
15. Remove the following files one by one: debuglog.dll, lan.dll, 0F8BFBFF000506E3files, 0F8BFBFF000506E3, and {random numbers}ID.
16. Remove HOW TO DECRYPT.txt from all affected folders.
17. Delete recently downloaded files from Desktop (%USERPROFILE%\Desktop), Downloads (%USERPROFILE%\Downloads), and Temporary files (%TEMP%) directories.
18. Empty Trash. Download Removal Tool100% FREE spyware scan and
    tested removal of Skyfile Ransomware*

Stop these Skyfile Ransomware Processes: