Cyber_baba2@aol.com Ransomware Removal Guide

Cyber_baba2@aol.com Ransomware is extremely dangerous malware that is known to be able to encrypt personal files. As researchers at 411-spyware.com have revealed, this infection searches for personal files, e.g. images, documents, presentations, etc. right after it enters the computer. Then, it encrypts them all using the RSA-2048 encryption key. If the file is encrypted, it will have the new filename extension next to the original one, for instance, song.mp3.IDB324524.cyber_baba2@aol.com.xtbl. As can be seen, the ransomware leaves the original extension but adds its own one that consists of the unique ID and the email address. You are supposed to contact cyber criminals by sending an email to them, but, in our opinion, there is no need to do that if you are not going to give cyber criminals what they wish. Instead, you should delete this dangerous computer infection. It is a must to erase it fully because it might launch once again and lock all other files. Yes, it might strike once more because it has the Value in the system registry (you can find it by following this path HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run) and thus is capable of launching automatically.

Those users who have become victims of Cyber_baba2@aol.com Ransomware will not only be able to access their personal files, but will also notice a notification on Desktop informing about the condition of files and suggesting to contact cyber criminals for further instructions. Do not worry; the notification is an ordinary picture set as Desktop wallpaper, so your screen will not be locked. The message you will find on Desktop and the How to decrypt your files.txt file it creates do not provide much information about the decryption of files; however, if you contact cyber criminals, you will definitely get instructions on how to make the payment for the decryption tool or the decryption password. As our experience shows, cyber criminals usually expect to receive the ransom in Bitcoin to make it impossible for users to track the transaction and thus identify cyber criminals. Unfortunately, we cannot promise that you will get the decryptor after making a payment either but, of course, you are the only one who can decide whether it is worth transferring the required money or not. If you decide not to pay money, you should still keep those encrypted files because you might be able to unlock them one day with the help of the free software.

Cyber_baba2@aol.com Ransomware is not unique in any sense. According to specialists, it seems to be developed on the same template as Ninja_gaiver@aol.com Ransomware, Makdonalds@india.com Ransomware, and GruzinRussian@aol.com Ransomware. The aforementioned malware is prevalent these days and might enter your PC with an intention of locking your files and then demanding the ransom. In most cases, ransomware infections are spread through spam emails, so you should never open them even though they seem to be harmless. You should especially not open them if they are sent by unknown senders, or you simply do not expect to get an email with an attachment. Be careful with third-party software, especially when it is available on file-sharing and torrent web pages, as well because you might get malware instead of a movie or another decent file.

You need to get rid of the ransomware infection if you do not want it to encrypt your new files. Also, it is known that other malicious applications might enter your PC with its help too. We suggest going for the manual deletion of this threat only if you consider yourself an experienced computer user. If the opposite is the case, use an automatic malware remover to get rid of Cyber_baba2@aol.com Ransomware. Not all the automatic tools will delete this malware for you either. Users who want to be sure that they use a decent tool should acquire the SpyHunter antimalware suite and then launch its scanner. This tool will take care of Cyber_baba2@aol.com Ransomware and other infections that are present.

How to remove Cyber_baba2@aol.com Ransomware manually

1. Launch RUN (press Win+R), type regedit.exe, and click OK.
2. Move to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
3. Delete the Value having data %WINDIR%\Syswow64\*.exe or %WINDIR%\System32\*.exe (* - random name).
4. Open HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers.
5. Locate the Value with the name BackgroundHistoryPath0, right-click on it, and select Delete.
6. Go to HKCU\Control Panel\Desktop and delete the Wallpaper value too (right-click on it and then click Delete).
7. Open the Explorer and check %WINDIR%\Syswow64 and %WINDIR%\System32 directories.
8. Remove the .exe file.
9. Find the executable file that belongs to the ransomware infection (it might hide in any of these directories) and erase it:

• %ALLUSERSPROFILE%\Start Menu\Programs\Startup\
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
• %USERPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\
• %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\
• %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\

N.B Scan your system with an automatic scanner if you have erased Cyber_baba2@aol.com Ransomware manually to find out whether you have not left any other components of this infection on your PC.