To remove this infection, simply end the cryptohost.exe process using Task Manager and then delete the cryptohost.exe file. It will alsocreate an autorun called software that executes the ransomware on login. When CryptoHost is installed it will create a file called cryptohost.exe and store it in the C:\Users\\AppData\Roaming folder. When done, open that folder and copy all of the folders in it to the root of your C: drive. You data will now be extracted into a folder name that is the same name as the RAR archive.
When the 7-Zip prompts you for the password, enter the password as described above and press enter. Then click on the End Process button to terminate it. Now click on the Processes tab and select the cryptohost.exe process as shown below. When the Task Manager search results appears, click on it to start the program. So for example, if the name of the user is Test and the RAR archive is located at C:\Users\Test\AppData\Roaming\3854DE6500C05ADAA539579617EA3725BAAE2C57, the password would be 3854DE6500C05ADAA539579617EA3725BAAE2C57Test.įor those who do not want to deal with figuring out the password, you can use this password generator created by Michael Gillespie.īefore we begin, we want to first terminate the cryptohost.exe process. To do this, open the Start Menu and type Task Manager. The password for this archive is the name of the archive combined with the logged in user name. This file will have a 41 character name and no extension. When CryptoHost infects your computer it will move certain data files, which is detailed in the technical analysis below, into a password protected RAR archive located in the C:\Users\\AppData\Roaming folder. Unfortunately, a certain site who will not be named, irresponsibly revealed the method that can be used to decrypt these files, so the secret is already out. Normally I would not disclose a vulnerability in a ransomware as it will just lead to the developer fixing it in a future version. The CryptoHost Ransomware How to Decrypt or get your data back from the CryptoHost Ransomware
0 kommentar(er)
