Eking ransomware comes from Phobos malware groupThreat SummaryHow does Phobos ransomware spread?Remove EKING ransomware effectively
The files left by the virus (info.hta and info.txt) serve as ransom notes that contain information on actions the victim should take in order to decrypt .eking files. The .hta note says “encrypted” and says “your PC has been infected by ransomware. If you want to restore them, contact the following address below.” The note provides two emails, which vary depending on virus version. Known list of emails used by this virus distributors are listed below. decphob@protonmail.com, holylolly@airmail.cc, digistart@protonmail.com, ecphob@tuta.io, greed_001@aol.com, helpmedecoding@airmail.cc, Black_Wayne@protonmail.com, Decryptdatafiles@protonmail.com, quickrecovery05@firemail.cc, tsec3x777@protonmail.com, supp0rt@cock.li, DECRYPTUNKNOWN@Protonmail.com, recoryfile@tutanota.com, ICQ@fartwetsquirrel, jerjis@tuta.io, gluttony_001@aol.com, holylolly@airmail.cc, pride_001@aol.com, kabura@firemail.cc, r4ns0m@tutanota.com, contactjoke@cock.li, moon4x4@tutanota.com, eleezcry@tutanota.com, HELPUNKNOWN@Tutanota.com, decrypt20@vpn.tg, clearcom@protonmail.com, chinadecrypt@fasthelpassia.com, hublle@protonmail.com, paymantsystem@cock.li, savemyself1@tutanota.com, qirapoo@firemail.cc, Hubble77@tutanota.com, yoursjollyroger@cock, raboly@firemail.cc, eight20@protonmail.com, cyvedira@firemail.cc, filedec@tutanota.com, divevecufa@firemail.cc, crioso@protonmail.com. Eking ransomware developers explain that the victim must contact them via given emails. If they do not reply within 24 hours, they suggest contacting them via Sonar (username decphob). The criminals also promise to decrypt 5 files for free, but their size shouldn’t exceed 4MB, and they should not contain any important information. Such demands are typical and are typically included in other ransomware campaigns, such as STOP/DJVU, KASP, DHARMA, OGDO and others. The ransom note also includes links to sites where the victim can purchase Bitcoins worth the demanded amount of dollars. Finally, they warn the victim to not rename encrypted files, as this might interfere with future data restoration using EKING ransomware decryptor tool. Second, the attackers warn not to use any third-party data recovery tools.
Threat Summary
Finally, the note warns about scammers who claim they can decrypt victim’s files for a certain amount of money – these simply ask more money than the actual ransom, then pay part of the money to ransomware developers and take the rest of the money for themselves. This is actually true – never pay for some suspicious individuals who claim to be able to restore your files, while the most respectful and well-known malware analysts from large companies like Emsisoft cannot create a decryptor. Please remember that cryptography is a very complex algorithm and it was made to lock the information in a way so that only the ones who have the decryption key can access it. In this situation, the developers of Eking ransomware have it. That said, we do not encourage you to pay a ransom. Instead, focus on securing your device immediately. You can remove Eking ransomware securely by using anti-malware software. To check and repair possible virus damage on Windows OS system, we suggest downloading RESTORO.
How does Phobos ransomware spread?
Phobos ransomware variants such as Eking virus are mainly distributed via hacked Remote Desktop (RDP) connections. That said, you should check for open or weakly secured RDP ports. The ports used for this service are TCP port 3389 and UDP port 3389, so consider adding some security rules for them, such as:
Use very strong passwords along with two-factor authentication.Limit users and IPs that can log in using RDP;Keep your software up-to-date at all times.
Additionally, you should know about general ransomware distribution tricks that can help you avoid any type of this threat. First of all, you should be careful while browsing the web, and watch what you click online. Beware of fake software update pop-ups originating from shady websites. Clicking on these can redirect you to domains pushing malicious payloads. Next, we recommend staying away from software cracks promoted via torrent clients. These are very, very common tools used to deliver ransomware. Finally, never open email attachments sent by unknown senders. Even if you receive a PDF or WORD document, which seems to be far from an executive file, remember that it can contain a script that CAN download and run a malicious program. All that it takes is a working network connection on your computer. We suggest you read more about ransomware prevention and protection methods here.
Remove EKING ransomware effectively
If you have fallen victim to a ransomware attack, it is essential to eliminate the malware and cleanse your computer as soon as possible. You can remove Eking virus using robust malware removal software. To cleanse malware damage on Windows OS, use RESTORO, a highly recommended PC Repair software. To ensure a successful Eking ransomware removal, we suggest you to follow the guidelines given down below. These instructions explain how you can start your computer in Safe Mode and ensure secure environment for malware removal procedure. Lastly, start .eking file recovery using data backups you created previously. If you do not have them, it might be extremely hard if not impossible to ever restore your files. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.
Alternative software recommendations
Malwarebytes Anti-Malware
Method 1. Enter Safe Mode with Networking
Before you try to remove the virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, see a video tutorial on how to do it: Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10 users Now, you can search for and remove Eking ransomware files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable malware removal program. In addition, we suggest trying a combination of INTEGO Antivirus (removes malware and protects your PC in real-time) and RESTORO (repairs virus damage to Windows OS files).
Method 2. Use System Restore
In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future. Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
