ExecutionerPlus ransomware - How to remove

ExecutionerPlus ransomware virus is based on a crypto-virus that emerged in January of 2016: CryptoJoker infection. Most of the efficient security tools are able to detect CryptoJoker_dump.exe.bin file as the payload of this disturbing cyber threat.

After it locks users’ files, it is supposed append .pluss.executioner or .destroy.executioner extensions which would suggest that a specific file is no longer available for usage. From the looks of the ransom note, hackers are presumably from Turkey and they make reference to “Turkish Underground World”. We have encountered several Turkish ransomware (Ransomware on the rise) variants: ApolloLocker and Kripto64 are a few of them.

One feature of ExecutionerPlus crypto-virus attracted a lot of attention from security specialists. We are referring to the fact that this ransomware uses CoinHive. This was an assumption that many researchers had made and finally, their predictions came true (Coinhive Miner Emerges as the 6th Most Common Malware).

Victims will notice a Readme.html file which will load the ransom note. However, it does not look like the crooks are attempting to earn money from this infection. On the other hand, this does not mean that the infection won’t start intimidating users with demands for money.

More details about the new ExecutionerPlus crypto-virus

We are delighted to begin this part of the article with this announcement: ExecutionerPlus file-encoder is decryptable. Victims that are interested in retrieving their files should contact Michael Gillespie for assistance. If any of the extensions have marked your files, we hope that you will not delay the file-recovery, especially when the mentioned security researchers offers his help.

ExecutionerPlus file-encoder appears to be contacting multiple websites. One of them is Crimin4lizm.org which is explain not to welcome bug founder or pentesters. When we attempted to visit it, we were denied access.

Another website called H4lis.com, displays the ransom note and plays a rap-song music video as well. In all of the websites, a phrase “HEYKLOG-LOSTHAT” is noticed. Also, the message from hackers also features “Guvenlik bir bir urun degil surectir” statement which means “Security is not a product”. Losthatdesign.com website features a different song, but displays the same message as noticed in the ransom note.

Overall, the ExecutionerPlus crypto-virus is not a fully-developed ransomware infection. It lacks certain elements that are usually essential in these type of viruses. However, if your files are damaged, it is good that there is a way of retrieving your files. Since hackers do not make clear demands, the reason for their actions is unclear.

Files that ExecutionerPlus encoder has damaged can be decrypted

Like we have mentioned in the paragraphs above, there is a way of recovering lost data. Contact Michael Gillespie and he will provide you with all of the information necessary to decrypt files that ExecutionerPlus ransomware ruined. On the other hand, you should consider a few recommendations if you want to have your system and files protected. First of all, you should backup your data in online storages or at least USB flash drives. This might save you from a devastating consequence of a ransomware infection.

On the other hand, crypto-malware variant sometimes are not decryptable. You could try using universal file-recovery tools or checking whether Shadow Volume Copies have not been deleted. Before you try any of the file-recovery method, we advise you to remove the infection from your computer. If not, your attempts to recover digital files might go to a complete waste.

Distribution of ransomware viruses like ExecutionerPlus cyber threat

First of all, you should recognize that crypto-viruses can be transmitted in spam campaigns. When you open a letter from an unknown source, do not feel eager to download its attachments. This is a sneaky technique to transmit malicious payloads of ransomware. In addition to this, you could get infected after clicking on random links and visiting suspicious websites.

We mentioned that before you attempt to recover files, it is important to get rid of the ransomware infection. Select Spyhunter to keep your computer device from going through a crypto-virus.

How to recover ExecutionerPlus ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before ExecutionerPlus ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of ExecutionerPlus ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to ExecutionerPlus ransomware. You can check other tools here.  

Step 3. Restore ExecutionerPlus ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually ExecutionerPlus ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover ExecutionerPlus ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.