Starbax@tutanota.com Ransomware Removal Guide

Starbax@tutanota.com Ransomware adds an unusually long second extension to all files it manages to encrypt. However, the strangest thing about this malicious application is the fact it does not leave any ransom note through which its creators could demand the victim to pay a ransom. Instead, the threat mentions a specific email address that can be seen in the second extension we talked about a bit earlier. Probably, the infected device’s user is supposed to realize he has to contact the hackers to learn how to get his files back on his own. Of course, it is not what we would recommend since they may demand a ransom and by paying it you might lose your savings in vain. Instead, our specialists advise deleting the malware. Then, you could restore encrypted data from backup copies if you have any. To get rid of Starbax@tutanota.com Ransomware manually you could use the instructions located a bit below this text, but if you would like to learn more first, we advise you to keep reading this report.

The malware might be spread through malicious email attachments, fake installers on harmful file-sharing web pages, and so on. One way or the other if your computer got infected it most likely happened because you carelessly opened an unreliable file. Therefore, to keep the system safe from malicious applications like Starbax@tutanota.com Ransomware in the future our specialists recommend to stay away from potentially harmful sites and being extra cautious before opening doubtful files. If it is possible, it would be safest to scan suspicious files before opening them with a reliable security tool, so if you did not acquire it yet, we strongly recommend doing so to strengthen your device.

After the malware’s launcher is opened the threat may create a couple of copies of it in the %LOCALAPPDATA%\Mozilla and %USERPROFILE%\Local Settings\Application Data\Mozilla directories. Additionally, the malicious application might add a new Registry entry in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run directory to make the infected computer launch Starbax@tutanota.com Ransomware automatically after each restart. Then, the malware should look for data it could encrypt. According to our specialists, it could be various pictures, videos, photos, documents, and so on. Also, as mentioned earlier each encrypted file might be marked with a second extension called “! ,--, Revert Access ,--,  starbax@tutanota.com  ,--,.BlockBax_v3.2.” Consequently, the files damaged by Starbax@tutanota.com Ransomware may look something like this: panda.jpg.! ,--, Revert Access ,--,  starbax@tutanota.com  ,--,.BlockBax_v3.2, short_story.docx.! ,--, Revert Access ,--,  starbax@tutanota.com  ,--,.BlockBax_v3.2, etc.

Most likely, the mentioned email (starbax@tutanota.com) is the only way to contact the hackers and learn of what they want in exchange for decryption tools. Nonetheless, we would not recommend using it because even if the malicious application’s creators do answer and send instructions on how to pay a ransom there are no guarantees they can be trusted. In other words, there is a chance you could get tricked and lose your savings in vain. Provided, you do not want to end up being scammed we recommend removing Starbax@tutanota.com Ransomware instead. To do so manually users should follow the instructions located a bit below as they will list the necessary steps. The malware can be erased with a reliable security tool as well; all you have to do is pick a legitimate tool, perform a system scan with it, and click the given deletion button.

Get rid of Starbax@tutanota.com Ransomware

1. Tap Ctrl+Alt+Delete.
2. Select Task Manager.
3. Locate a particular process belonging to the malware.
4. Mark it and press End Task.
5. Exit Task Manager.
6. Press Win+E.
7. Locate the given directories:
   %TEMP%
   %USERPROFILE%\Desktop
   %USERPROFILE%\Downloads
8. Find a malicious file downloaded before the malware appeared.
9. Right-click the doubtful file and select Delete.
10. Locate the following paths:
    %LOCALAPPDATA%\Mozilla
    %USERPROFILE%\Local Settings\Application Data\Mozilla
11. Look for randomly titled executable files, e.g., ZqnMZCvo.exe.
12. Right-click these files and select Delete.
13. Exit File Explorer.
14. Press Win+R.
15. Type Regedit and click OK.
16. Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
17. Look for a randomly titled value name, e.g., HYxqzAVO.
18. Right-click it and select Delete.
19. Exit Registry Editor.
20. Empty your Recycle Bin.
21. Reboot the system.