Bestdecoding@cock.li Ransomware

Bestdecoding@cock.li Ransomware is a new Crysis/Dharma Ransomware version. Same as with the previous variant its goal is to encrypt user’s data and show a message with demands for a ransom. Files that get enciphered become useless without decryption tools, but we would not recommend purchasing them from the malware’s developers. They may promise you anything, but in reality, you cannot know if they will do the right thing. In other words, there is a chance they might not deliver the needed tools or try to ask for even more money. For those who do not want to take any chances, we advise removing Bestdecoding@cock.li Ransomware from the system. The steps available below the article should help you get rid of it manually. Of course, users who would like to learn more about the malicious application first should read the rest of the text.

There is a couple of ways of how Bestdecoding@cock.li Ransomware could be spread. For instance, its developers might be sending its installer to targeted victims via email. Therefore, cybersecurity specialists often recommend not to interact with attachments or links coming from unknown senders, especially if it comes as Spam. The first thing you should do is ask yourself whether you were expecting to receive the email. Then check the sender’s email address. For example, if the sender pretends to represent some company, it should be easy to check if the mentioned organization uses a particular email address. Another extra precaution we advise is scanning suspicious content with a reliable antimalware tool first. You should scan not just email attachments, but any other files received from untrustworthy sources, such as installers from file-sharing web pages or pop-up advertisements.

Before starting the encryption process, Bestdecoding@cock.li Ransomware should create a couple of copies of its launcher in the %WINDIR%\System32 and few other folders. Plus, the malware is supposed to create a few Registry entries that ought to make the infected computer launch the malicious application and its ransom note with the operating system. It means, restarting the device could result in relaunching the malware. Users should keep in mind, this could mean the threat might start its encryption process once again with each restart. Thus, if the user creates any new data that was not enciphered before, it could become affected too. Sadly, Bestdecoding@cock.li Ransomware can encrypt a lot of various file types, for example, pictures, text document, videos, etc.

It is easy to separate encrypted data, as each affected file is supposed to be marked with the malware’s extension. This version’s extension is id-{8 random characters}.[bestdecoding@cock.li].best, for example, a file called picture.png could turn into picture.png.id-B4500913.[bestdecoding@cock.li].best. As soon as all targeted files are enciphered and have the mentioned extension, Bestdecoding@cock.li Ransomware should open a ransom note. It looks almost identical to other ransom notes displayed by threats from the same ransomware family. The note claims the user has 24 hours to contact the malicious application’s developers. The hackers ask to do so because the note does not so how much to pay or how to transfer the money.

As usual, there is a mention of getting a single file decrypted free of charge. Ransomware creators often suggest it, to prove the user they have the needed decryption tools. The problem is, even if they do have these tools, there are no guarantees they will deliver them. As you see, Bestdecoding@cock.li Ransomware’s creators will most likely ask paying the ransom first, and they wish to be paid in Bitcoins to remain anonymous. Therefore, the moment the malware’s developers get their money they can take them whether they send the promised tools or not.

Naturally, if you do not want to pay to the hackers, we advise you to remove Bestdecoding@cock.li Ransomware from the system. To get rid of it manually users should follow and complete the instructions available a bit below. Provided, the task seems too complicated, it might be better to employ a reliable antimalware too that could eliminate the threat for you.

Erase Bestdecoding@cock.li Ransomware

1. Click Ctrl+Alt+Delete.
2. Choose Task Manager and select Processes.
3. Find a process belonging to the threat.
4. Mark it and click End Task.
5. Exit Task Manager.
6. Click Win+E.
7. Find these paths:
   %TEMP%
   %USERPROFILE%\Downloads
   %USERPROFILE%\Desktop
8. Locate the malicious application’s launcher.
9. Right-click it and select Delete.
10. Find these locations:
    %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
    %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
    %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup
    %WINDIR%\System32
    %APPDATA%
11. Locate files called Info.hta, right-click them and select Delete.
12. Find these folders:
    %HOMEDRIVE%
    %PUBLIC%\Desktop
    %USERPROFILE%\Desktop
13. Search for text files named FILES ENCRYPTED.txt, right-click them and select Delete.
14. Find these specific Startup directories:
    %WINDIR%\System32
    %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
    %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
    %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup
15. Find suspicious executable files, for example, file.exe; right-click them and choose Delete.
16. Exit File Explorer.
17. Press Win+R.
18. Insert Regedit and click Enter.
19. Find the given directory: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
20. Locate a value name dropped by the threat, for example, file.exe.
21. Right-click this value name and press Delete.
22. Find two other value names in the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run location.
23. For example, {random title}.exe, right-click malicious value names and select Delete.
24. Exit Registry Editor.
25. Empty your Recycle Bin.
26. Restart the computer.