Last_centurion@aol.com Ransomware Removal Guide

If you want to remove Last_centurion@aol.com Ransomware, then you have come to the right cyber security website. In this short article we will show you not only how you can get rid of it, but how it is distributed and how it works. This malicious application is set to infect your computer secretly and encrypt most of the files stored on it. Then, its ransom note will give you instructions on what to do next which will involve paying a ransom for the decryption tool. The cyber criminals behind this program use this ransomware to make money — that is its only purpose. There is no telling how much money they want you to pay for the decryptor, but, at any rate, the sum in not by any means small.

Last_centurion@aol.com Ransomware comes from an established developer or developers that make dozens of copies of the same application and set up its distribution. This particular program is distributed internationally, but some of its clones have their ransom notes in Russian such as in the case of Malevich Ransomware, Okean-1955@india.com Ransomware, and Cryakl Ransomware. For this reason, we think that this line of ransomware comes from Russia, but is intended to be disseminated across the globe.

We think that this new ransomware is distributed in much the same way as its predecessors are still being distributed. Indeed, the release of Last_centurion@aol.com Ransomware does not signify that is counterparts are obsolete. All of these ransomware-type programs form a network that we think is apt to generate a healthy profit. As far as this program’s distribution methods are concerned, we believe that it is distributed using fake emails that are disguised as invoices. They contain an attached zipped file. We think that the zipped attachments can be WSF files (Windows Script Files) that are executed by Windows Script Host. Thus, this ransomware can secretly infect your computer by you simply opening the attached file.

Our research has determined that Last_centurion@aol.com Ransomware is usually named randomly, but, like its predecessors, it can have the word “payload” in it, so you have to watch for it if you decide to delete this ransomware manually. Furthermore, the malicious script is set to drop this executable to one of seven possible locations that include %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup and %WINDIR%\System32. In addition, this ransomware will create a randomly named registry string at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run that is set to auto run the main executable on system startup. You can identify this string from its odd name or Value data that features the file path to the executable.

This ransomware uses RSA-2048 encryption key to encrypt your files in nearly all of the locations on your PC with the notable exception of %Windows%, %AppData%, %System32%, and %Temp%. We found that it is set to encrypt most of the files on your PC including file formats such as .doc, .xls, .ppt, .jpg, .exe, .dll, and .odt. Once it completes the encryption, Last_centurion@aol.com Ransomware will drop two files: one called how to decrypt your files.jpg that is set as the desktop wallpaper and Decryption instructions.txt that is dropped on the desktop and functions as the ransom note. However, this note only states the email address for contacting the cyber criminals to get the decryption program with the unique decryption key tailored for your PC. However, the decryption key does not come cheap. We think that the criminals will demand that you pay 2 BTC or an approximate 1,215 USD at the very least because that is the minimal known payment.

Unfortunately, you cannot decrypt your files for free as there is no third-party application that could do that. However, paying the ransom may be uneconomical and risky because you might not receive it. For these two reasons we suggest removing this infection using our step-by-step instructions or an antimalware program, such as SpyHunter. Note that you do not need to boot your PC in safe mode to install an antimalware application.

Remove this ransomware

1. Press Windows+E keys.
2. Type the following directories in the address box.
   • %ALLUSERSPROFILE%\Start Menu\Programs\Startup
   • %WINDIR%\Syswow64
   • %WINDIR%\System32
   • %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
   • %USERPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
   • %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
   • %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup
3. Find this ransomware’s executable and delete it.
4. Then, go to C:\Users\{user name}\Documents
5. Find how to decrypt your files.jpg and delete it.
6. Finally go to the desktop and delete How to decrypt your files.txt
7. Empty the Recycle Bin.
8. Press Windows+R keys.
9. Enter regedit in the dialog box and hit Enter.
10. Go to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
11. Find the registry sting with the Value data of one of its seven locations, such as %WINDIR%\System32
12. Then, go to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers
13. Find BackgroundHistoryPath0 and delete it.
14. Done.