Sad Computer Ransomware

Sad Computer Ransomware encrypts user’s files if the user answers Yes to its displayed pop-up window that proposes to install antivirus software. In other words, the malicious application tricks its victims into believing it will provide a useful application, but instead encrypts their data with a robust encryption algorithm. Soon after the encryption process, the malware should show another window called Sad Computer. This window shows a text written in questions and answers form. In short, it explains the user will have to pay to get his data decrypted. Of course, dealing with the malicious application’s developers could be risky, and we do not recommend it. For more details about the malware, we invite you to continue reading our article. Users who choose to remove Sad Computer Ransomware from the computer may also find useful our deletion instructions available below the text.

As mentioned earlier, the malware encrypts user’s files after showing a pop-up that asks whether the victim wishes to install an antivirus tool. Consequently, it is quite possible that Sad Computer Ransomware could be distributed with fake antivirus installers. Usually, users find such data on unreliable file-sharing web pages, for example, websites offering pirated programs. Therefore, those who wish to keep their systems clean should stay away from such websites. Installing a random application available on a questionable file-sharing site is usually a bad idea. Instead, you should always research tools you wish to install, and if they appear to be worthy of your trust, it is best to download them from legitimate websites. Also, it might be easier to recognize malicious or potentially dangerous content with a reliable antimalware tool, just this time we highly recommend obtaining it from legit sites.

Sad Computer Ransomware’s pop-up window that asks if the user wishes to install antivirus software allows answering Yes or No. According to our researchers, if you click the No button nothing happens or, in other words, the malware does not start the encryption process. Thus, changing one’s mind could save the user from destructing his data accidentally. However, if he clicks the Yes button, the threat should start encrypting his photos, videos, various documents, and other data considered to be personal. It means program data and files associated with the computer’s operating system should not get encrypted. It is difficult to say how long it might take to encrypt all targeted files as it depends on how much data there is on the infected computer. Nonetheless, as soon as Sad Computer Ransomware finishes it, the victim should notice text documents called sadcomputer_note.txt in all directories containing encrypted files. Plus, data that was affected ought to have a second extension called .sad, for example, kittens.jpg.sad.

Lastly, the malicious application is supposed to show a window titled Sad Computer. It provides answers to the following questions: “what happend to my computer,” “how do I restore the files,” “can I use other methods,” and “how can I trust.” The answer to the second question is “you need to use bitcoin to restore the files,” which means the hackers demand ransom in exchange for decryption tools. As for the answer to the last question, the Sad Computer Ransomware’s developers claim they do not trick their victims. The only problem is such words do not mean anything, as they could say one thing and do the other.

Another thing that you should notice on the malware’s window is a timer. When the time runs out, our researchers say that the malicious application should delete the encrypted files. Of course, if you are not going to pay the ransom, it does not matter what happens to encrypted data as it cannot be unlocked without decryption tools anyway. What we recommend is using the backup copies that you could keep on cloud storage or removable media devices. If you do not back up your data, we advise doing so from now on. Needless to say before uploading any data or creating new files you should delete Sad Computer Ransomware. It can relaunch with the operating system, which means it could encrypt new files too. You can erase it manually by following the instructions available below or with a reliable antimalware tool of your choice.

Erase Sad Computer Ransomware

1. Click Ctrl+Alt+Delete.
2. Choose Task Manager and select Processes.
3. Find a process belonging to the threat.
4. Mark it and click End Task.
5. Exit Task Manager.
6. Click Win+E.
7. Find these paths:
   %TEMP%
   %USERPROFILE%\Downloads
   %USERPROFILE%\Desktop
8. Locate the malicious application’s launcher.
9. Right-click it and select Delete.
10. Locate files called sadcomputer_note.txt, right-click them and select Delete.
11. Exit File Explorer.
12. Press Win+R.
13. Insert Regedit and click Enter.
14. Find the given directory: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
15. Look for a value name dropped by the threat; its name should be the same as your computers.
16. Right-click this value name and press Delete.
17. Exit Registry Editor.
18. Empty your Recycle Bin.
19. Restart the computer.