Remove EKING Ransomware (Virus Removal Guide)
Eking ransomware comes from Phobos malware group
Contents
EKING is a ransomware-type virus that belongs to Phobos malware family. Once installed, it encrypts all files on the system and appends victim’s ID, decphob@tuta.io email address and .eking file extension to them. As a result, file named document.jpg will be renamed to document.jpg.id[9Y836L01-13453.[decphob@tuta.io].eking. The virus then launches info.hta window on the screen and also leaves info.txt files across the computer system to inform the victim about the cyber attack and criminals’ requirements that must be fulfilled in order to decrypt data. Just like typical ransomware programs, it demands paying a ransom in exchange for data recovery tools.
The files left by the virus (info.hta and info.txt) serve as ransom notes that contain information on actions the victim should take in order to decrypt .eking files. The .hta note says “encrypted” and says “your PC has been infected by ransomware. If you want to restore them, contact the following address below.” The note provides two emails, which vary depending on virus version.
Known list of emails used by this virus distributors are listed below.
decphob@protonmail.com, holylolly@airmail.cc, digistart@protonmail.com, ecphob@tuta.io, greed_001@aol.com, helpmedecoding@airmail.cc, Black_Wayne@protonmail.com, Decryptdatafiles@protonmail.com, quickrecovery05@firemail.cc, tsec3x777@protonmail.com, supp0rt@cock.li, DECRYPTUNKNOWN@Protonmail.com, recoryfile@tutanota.com, ICQ@fartwetsquirrel, jerjis@tuta.io, gluttony_001@aol.com, holylolly@airmail.cc, pride_001@aol.com, kabura@firemail.cc, r4ns0m@tutanota.com, contactjoke@cock.li, moon4x4@tutanota.com, eleezcry@tutanota.com, HELPUNKNOWN@Tutanota.com, decrypt20@vpn.tg, clearcom@protonmail.com, chinadecrypt@fasthelpassia.com, hublle@protonmail.com, paymantsystem@cock.li, savemyself1@tutanota.com, qirapoo@firemail.cc, Hubble77@tutanota.com, yoursjollyroger@cock, raboly@firemail.cc, eight20@protonmail.com, cyvedira@firemail.cc, filedec@tutanota.com, divevecufa@firemail.cc, crioso@protonmail.com.
Eking ransomware developers explain that the victim must contact them via given emails. If they do not reply within 24 hours, they suggest contacting them via Sonar (username decphob). The criminals also promise to decrypt 5 files for free, but their size shouldn’t exceed 4MB, and they should not contain any important information. Such demands are typical and are typically included in other ransomware campaigns, such as STOP/DJVU, KASP, DHARMA, OGDO and others.
The ransom note also includes links to sites where the victim can purchase Bitcoins worth the demanded amount of dollars. Finally, they warn the victim to not rename encrypted files, as this might interfere with future data restoration using EKING ransomware decryptor tool. Second, the attackers warn not to use any third-party data recovery tools.
Threat Summary
| Name | EKING |
| Category | Ransomware |
| File Marker | .id[random chars].[email].eking |
| Ransom notes | info.hta and info.txt |
| Executable name | AntiRecuvaAndDB.exe, executable.2380.exe or other randomly named exe format file |
| Symptoms | File icons turn blank white and their names have an additional extension as explained earlier. The files cannot be opened, no matter what program is used. Each folder contains info.txt ransom note, and an “encrypted” window launches on the screen, informing that all files have been encrypted. |
| Decryption | No decryption tools available at the moment – please use data backups |
| Removal | Remove malware using comprehensive security suite. To repair virus damage on the system, run a scan with RESTORO (highly recommended after a Eking ransomware attack) |
Finally, the note warns about scammers who claim they can decrypt victim’s files for a certain amount of money – these simply ask more money than the actual ransom, then pay part of the money to ransomware developers and take the rest of the money for themselves. This is actually true – never pay for some suspicious individuals who claim to be able to restore your files, while the most respectful and well-known malware analysts from large companies like Emsisoft cannot create a decryptor.
Please remember that cryptography is a very complex algorithm and it was made to lock the information in a way so that only the ones who have the decryption key can access it. In this situation, the developers of Eking ransomware have it.
That said, we do not encourage you to pay a ransom. Instead, focus on securing your device immediately. You can remove Eking ransomware securely by using anti-malware software. To check and repair possible virus damage on Windows OS system, we suggest downloading RESTORO.
How does Phobos ransomware spread?
Phobos ransomware variants such as Eking virus are mainly distributed via hacked Remote Desktop (RDP) connections. That said, you should check for open or weakly secured RDP ports. The ports used for this service are TCP port 3389 and UDP port 3389, so consider adding some security rules for them, such as:
- Use very strong passwords along with two-factor authentication.
- Limit users and IPs that can log in using RDP;
- Keep your software up-to-date at all times.
Additionally, you should know about general ransomware distribution tricks that can help you avoid any type of this threat. First of all, you should be careful while browsing the web, and watch what you click online. Beware of fake software update pop-ups originating from shady websites. Clicking on these can redirect you to domains pushing malicious payloads. Next, we recommend staying away from software cracks promoted via torrent clients. These are very, very common tools used to deliver ransomware.
Finally, never open email attachments sent by unknown senders. Even if you receive a PDF or WORD document, which seems to be far from an executive file, remember that it can contain a script that CAN download and run a malicious program. All that it takes is a working network connection on your computer. We suggest you read more about ransomware prevention and protection methods here.
Remove EKING ransomware effectively
If you have fallen victim to a ransomware attack, it is essential to eliminate the malware and cleanse your computer as soon as possible. You can remove Eking virus using robust malware removal software. To cleanse malware damage on Windows OS, use RESTORO, a highly recommended PC Repair software.
To ensure a successful Eking ransomware removal, we suggest you to follow the guidelines given down below. These instructions explain how you can start your computer in Safe Mode and ensure secure environment for malware removal procedure.
Lastly, start .eking file recovery using data backups you created previously. If you do not have them, it might be extremely hard if not impossible to ever restore your files.
OUR GEEKS RECOMMEND
Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:
STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS
STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER
GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.
Eking ransomware Removal Guidelines
Method 1. Enter Safe Mode with Networking
Step 1. Start Windows in Safe Mode with Networking
Before you try to remove the virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, see a video tutorial on how to do it:
Instructions for Windows XP/Vista/7 users
- First of all, turn off your PC. Then press the Power button to start it again and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. This launches the Advanced Boot Options menu.
- Use arrow keys on the keyboard to navigate down to Safe Mode with Networking option and press Enter.
Instructions for Windows 8/8.1/10 users
- Open Windows Start menu, then press down the Power button. On your keyboard, press down and hold the Shift key, and then select Restart option.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart. Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Networking. In this case, it is the F5 key.
Step 2. Remove files associated with the virus
Now, you can search for and remove Eking ransomware files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable malware removal program. In addition, we suggest trying a combination of INTEGO antivirus (removes malware and protects your PC in real-time) and RESTORO (repairs virus damage to Windows OS files).
REMOVE MALWARE & REPAIR VIRUS DAMAGE
1 Step. Get robust antivirus to remove existing threats and enable real-time protection
INTEGO Antivirus for Windows provides robust real-time protection, Web Shield against phishing and deceptive websites, blocks malicious downloads and blocks Zero-Day threats. Use it to remove ransomware and other viruses from your computer professionally.
2 Step. Repair Virus Damage on Windows Operating System Files
Download RESTORO to scan your system for FREE and detect security, hardware and stability issues. You can use the scan results and try to remove threats manually, or you can choose to get the full version of software to fix detected issues and repair virus damage to Windows OS system files automatically.
Method 2. Use System Restore
In order to use System Restore, you must have a system restore point, created either manually or automatically.
Step 1. Boot Windows in Safe Mode with Command Prompt
Instructions for Windows XP/Vista/7 users
- Shut down your PC. Start it again by pressing the Power button and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. You will see Advanced Boot Options menu.
- Using arrow keys on the keyboard, navigate down to Safe Mode with Command Prompt option and press Enter.
Instructions for Windows 8/8.1/10 users
- Launch Windows Start menu, then click the Power button. On your keyboard, press down and hold the Shift key, and then choose Restart option with the mouse cursor.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart. Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Command Prompt. In this case, press F6 key.
Step 2. Start System Restore process
- Wait until system loads and command prompt shows up.
- Type cd restore and press Enter, then type rstrui.exe and press Enter. Or you can just type %systemroot%system32restorerstrui.exe in command prompt and hit Enter.
- This launches System Restore window. Click Next and then choose a System Restore point created in the past. Choose one that was created before ransomware infection.
- Click Yes to begin the system restoration process.
After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won't be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.
Alternative software recommendations
Malwarebytes Anti-Malware
Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense
If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.
Recent Posts
Private Internet Access Review 2022: Fast, Secure & Cheap VPN
Private Internet Access (PIA) VPN maintains its long-term role as a leader Private Internet Access…
Remove XCBG Ransomware Virus (DECRYPT .xcbg FILES)
XCBG ransomware aims to lock your files and demand a ransom XCBG ransomware is a…
Remove BPQD Ransomware Virus (DECRYPT .bpqd FILES)
BPQD ransomware encrypts all computer files, demands a ransom from the user BPQD ransomware is…
Remove KQGS Ransomware Virus (DECRYPT .kqgs FILES)
KQGS ransomware is a hostile computer virus designed to encrypt all of your files KQGS…
Remove VTYM Ransomware Virus (DECRYPT .vtym FILES)
VTYM ransomware description: a virtual menace to your files stored on the computer VTYM ransomware…
Remove FOPA Ransomware Virus (DECRYPT .fopa FILES)
FOPA ransomware is a new threatening computer virus that encrypts your files FOPA ransomware virus…
View Comments
mostly open RDP connection, IMHO
Hi Norbert,
I would like to enquire if it is at all possible to pin point the origin of the virus or where it was initiated.
Our company was hit by this ransomware and while we have restored and taken the knocks, we have know began the process of investigating the infected PCS. 3 machines were hit the worst one being our head programers. His machine is the only machine with the Ransomware note and by far the worst infection corrupting over 750GB of data while the rest of the company had maximum 30GB on the second worst machine.
Is the Ransomware note itself an indication that we virus was initiated from his machine ? if not what key pieces of evidence can we look for when pinpointing.
You opinion would be greatly appreciated.
Kind Regards