A_Princ@aol.com Ransomware Removal Guide

A_Princ@aol.com Ransomware is an annoying ransomware application that literally locks down a huge chunk of your files, and you can no longer access most of your documents. The ransomware enters your computer with the intention to rip you off, and the hackers who have created it expect you to pay huge amounts of money to restore your files. Needless to say, you should refrain from spending your money on this infection. You have to remove A_Princ@aol.com Ransomware following the instructions below this description. If some of the steps in the instructions appear to be too complicated for you, please do not hesitate to ask for help by leaving us a comment.

Seeing how the ransom note is displayed in the Russian language, it is possible to assume that this infection targets users in Russia and other Russian-speaking countries. You may also get infected with the ransomware application if you frequent the websites that are involved in the ransomware distribution network. It is more likely that the A_Princ@aol.com Ransomware program is distributed via spam emails, but even so, if your email address has been harvested, it would be possible to receive a message with the attachment file that works as the program’s installer.

We are not too excited about this application because we have seen similar infections before. There are quite a few of them, and it is possible to say that A_Princ@aol.com Ransomware is just another version of Redshitline Ransomware, Ecovector3@aol.com Ransomware, Vegclass@aol.com Ransomware, Green_ray Ransomware, and so on. Unfortunately, one cannot use the same decryption key for all of these infections because they all employ different encryption keys. The program in question uses the RSA-2048 encryption. This encryption algorithm is extremely complicated, and unless you have the original decryption key, it is virtually impossible to guess the code or use other means to unveil it.

When the encryption takes place, this ransomware infection will add a long extension to all the affected files. You will see that all of your documents now have the .picture.jpg.{a_princ@aol.com}.xtbl extension. Aside from that, the program also drops the DECRYPT FILES.txt file on your desktop that contains the decryption instructions. Of course, the so-called “instructions” are entirely in Russian, and it says that your data has been encrypted using the latest encryption algorithm. Then it says that if you want to retrieve your data, you have to send one encrypted file to a_princ@aol.com. You have 48 hours to contact the cyber criminals behind this attack. If you fail to do so, the decryption tool will be deleted. Consequently, the possibility to decrypt your files will be lost.

It is really doubtful whether A_Princ@aol.com Ransomware can really issue the decryption key. The chances are these criminals would take your money and make a run for it, without even trying to give you any way to restore your files. Thus, right now, you should focus on removing A_Princ@aol.com Ransomware from your system.

Once the ransomware application is gone, you can transfer copies of your original files back to your computer. Perhaps you keep a file backup on some external hard drive. Or perhaps you have virtual storage somewhere, and you have the most important files there. Either way, do everything you can to retrieve your files, and then do not forget to safeguard your system against similar infections. The most efficient way to do that would be acquiring a licensed antispyware tool.

How to Remove A_Princ@aol.com Ransomware

1. Press Win+R and enter %APPDATA% into the Open box.
2. Click OK and go to Microsoft\Windows\Start Menu\Programs\Startup.
3. Find and delete the random name .exe. Press Win+R.
4. Type %ALLUSERPROFILE% into the Open box and click OK.
5. Navigate to Microsoft\Windows\Start Menu\Programs\Startup.
6. Locate and remove the random name .exe file.
7. Press Win+R and enter %WINDIR% into the Open box. Hit OK.
8. Go to the Syswow64 folder and remove the random name .exe file.
9. Navigate back to the WINDOWS folder and open System32.
10. Find and remove the random name .exe file.
11. Press Win+R and type regedit. Click OK and open the utility.
12. Navigate to HKEY_CURRENT_USER\Control Panel\Desktop.
13. On the right pane, right-click the Wallpaper value.
14. Remove or change the wallpaper path to another image. Click OK.
15. Open HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers.
16. Delete the value with this data: C:\Users\user\Decryption instructions.jpg.
17. Navigate to HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run.
18. On the right, right-click and delete the following values:
    %WINDIR%\Syswow64\*.exe
    %WINDIR%\System32\*.exe
19. Run a full system scan with SpyHunter.