Makdonalds@india.com Ransomware Removal Guide

We would like to inform you about a newly released ransomware called Makdonalds@india.com Ransomware which belongs to a certain family of ransomware that we will discuss in more detail in this article. If this ransomware has infected your PC and encrypted your files, then the only thing you can do is remove it because we do not recommend that you attempt to pay the ransom to get them back. Based on information about its clones, you might not receive the decryption key and application needed to get your files back. There is a lot to discuss about this malware, so if you want to find out more, please continue reading.

Some ransomware-type malware is set to lock the computer’s screen, while other encrypts the files, effectively making them useless. Ransomware that locks the screen can be easily dealt with and leaves no permanent damage. However, ransomware such as Makdonalds@india.com Ransomware is set to encrypt the files using an encryption cipher that is currently unbreakable. This particular malicious application uses the RSA-2048 cryptosystem that consists of a public encryption key and a private decryption key. The keys have to match in order to decrypt the files. The unique private key is generated and sent to the Command and Control (C&C) server controlled by this ransomware’s developers and the only way you can get it is by paying the ransom.

Makdonalds@india.com Ransomware is configured to encrypt most of the files on your computer. It will encrypt everything ranging from executables of applications to videos, images, and documents. Therefore, it can encrypt almost all of your valuable data. While encrypting, it will append the files with a custom file extension that should look like .{makdonalds@india.com}.xtbl. Once the encryption process is complete, this ransomware will drop a file named How to decrypt your files.txt which says “To get decryptor write me to makdonalds@india.com.” Furthermore, this ransomware will drop a file called How to decrypt your files.jpg to C:\Users\user which is set as the desktop wallpaper that contains a ransom note in both Russian and English that tells you to email one of the two provided addresses to decrypt the files. Now, you should not trust cyber criminals to keep their word because all they care about is making money. We do not know how much money Makdonalds@india.com Ransomware’s developers want you to pay because the sum is revealed after you contact them via one of the provided emails.

As mentioned in the introduction, this malicious application is part of a family of ransomware. According to our research, it is based on the CrySIS ransomware engine that was also used to create Radxlove7@india.com Ransomware, Opencode@india.com Ransomware, Grand_car@aol.com Ransomware, and many others. Hence, all of them come from the same developers that are most likely located in Russia. We think that they ask for the ransom to be paid in Bitcoins, so there is no way to track them back to any particular place.

As far as Makdonalds@india.com Ransomware’s dissemination is concerned, we do not have enough concrete information to make an indisputable conclusion. However, we assume that it is sent in malicious spam mail that features an attachment that drops this ransomware’s executable to %WINDIR%\Syswow64 and %WINDIR%\System32. However, some versions might drop additional files in one additional location. The name of the executable may be random, but you should look for suspicious names such as Payload1.exe or Payload_c.exe if you want to delete it manually.

We hope that you found this description useful, and you are now ready to remove this infection. Paying the ransom is not an option because the chances of you getting the decryption software and key are fifty-fifty. Therefore, we suggest making use of the guide below to delete the files manually, or get SpyHunter which will eradicate this infection without too much trouble.

How to delete Makdonalds@india.com Ransomware

1. Hold down Windows+E keys.
2. Enter the following paths in the address box.
   • %WINDIR%\Syswow64
   • %WINDIR%\System32
   • %USERPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
   • %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
   • %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup
   • %ALLUSERSPROFILE%\Start Menu\Programs\Startup
   • %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
3. Locate and delete the executable (e.g. Payload1.exe or Payload_c.exe)
4. Close File Explorer.

Delete the registry keys

1. Hold down Windows+R keys.
2. Enter regedit and click OK.
3. In the Registry editor, go to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers
4. Find and delete BackgroundHistoryPath0
5. Then, go to HKCU\Control Panel\Desktop
6. Find and delete Wallpaper.
7. Go to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
8. Find and delete two randomly named strings with the Value data of %WINDIR%\Syswow64\randomname.exe and %WINDIR%\System32\ randomname.exe