Charm Ransomware - How to remove

Charm ransomware is a cryptovirus that once inside of the computer will encrypt personal files stored there and require a ransom in order to provide unique decryption key that can restore those files. It will automatically add a unique extension to the end of every encrypted file – if you had a file named “file.txt”, now it will be renamed to “file.txt.charm” because .charm is an extension employed by this malware. That’s why it is also referred to as .charm files virus.

Needless to say, ’ransomware – it can cause extremely harsh damage. For instance, you can temporarily or permanently lose your personal information, it will completely interrupt all processes on your computer. Even more damage can be done if ransomware infects a computer that belongs to a company, corporation or public organization – private information can be leaked or a lot of money can be lost.

Luckily, Charm virus is dangerous but not unsolvable. There are particular methods that can be applied in order to completely eliminate this infection and restore files that have been locked. Our job here is to provide you with instructions on how to do that and perform in-depth analysis of Charm ransomware, so if you are interested, just continue reading.

Charm Virus Overview

Virus Type	Ransomware
Extension	.charm
Alternative Name	.Charm Files Virus
Distribution	Attached to spam emails, promoted on excessive advertisements
Main Symptoms	Encrypts personal files, demands a ransom in an exchange of decryption tool
Solution	Remove virus with anti-malware tool, restore files from a backup or use a dedicated file recovery tool

When this particular infection enters a computer, the encryption process starts automatically and it’s pretty similar what anti-malware software would do when looking for a malware. However, instead of looking for malicious files, Charm looks for your personal files that can be possibly locked. Unfortunately, it is capable of encrypting most of the files – photos, text documents, audio files and so on.

After the scan, all files on the infected computer are encrypted using ’AES-256. Also, they receive a unique .charm extension and after that files are unusable. That means you can’t open them because the structure was changed. This state is not permanent, because if you reverse the encryption process and decrypt those files, they will be good to go once again. Unfortunately, there is no easy way to do that if you don’t have a special decryption key that was automatically generated by Charm virus and assigned to your computer. To get it, you will be asked to pay a ransom.

All information regarding encryption and payment of the ransomware is displayed in a so-called ransom note that will be automatically placed on your desktop. Text document called “HOW_TO_RETURN_FILES.txt” contains this exact message:

Dear manager,
your database server has been locked, your databases files are encrypted and you have unfortunately “lost” all your data, Encryption was produced using unique key AES-256 generated for this server.
To decrypt files you need to obtain the decryption key and tool.
All encrypted files ends with .charm
To obtain the program for this server, which will decrypt all files, you need to write me to email: “[email protected]”
Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it – it’s your guarantee that we have decryption tool. And send us your userkey
We don’t know who are you, All what we need is some money.
Don’t panic if we don’t answer you during 24 hours. It means that we didn’t received your letter and write us again.
You can use one of that bitcoin exchangers for transfering bitcoin:
https://localbitcoins.com
https://www.kraken.com
You dont need install bitcoin programs – you need only use one of this exchangers or other exchanger that you can find in www.google.com for your country.
Please use english language in your letters. If you don’t speak english then use https://translate.google.com to translate your letter on english language.
You don’t have enough time to think each day payment will increase and after one week your key will be deleted and your files will be locked forever.
USERKEY: ****

It’s obvious that cyber criminals behind Charm virus are targeting companies and website owners, but regular users can get infected as well. They encourage victims to contact them via [email protected] email, but we do not recommend to do that. It’s never a good idea.

They do not disclose how much you will be asked to pay to get your files back, but regardless of the amount, you should go for alternative methods to solve the problem. Even if you do pay the ransom, no one can guarantee that crooks will keep the promise to decrypt your files.

There are a lot of ransomware infections, such as Katyusha ransomware, District ransomware, EbolaRnsmwr, and so on. All those viruses can be eliminated using special anti-malware software.

Automatic Malware removal tools

How to recover Charm Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Charm Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Charm Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Charm Ransomware. You can check other tools here.  

Step 3. Restore Charm Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Charm Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Charm Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.