SadStory ransomware : How To Eliminate & Recover Enciphered Files?

Complete Information on SadStory ransomware

 

SadStory ransomware is a new file-encrypting virus that was reported in the last week of March 2017. This malware is being distributed among the system users as a bait, which claims to be a free license of a famous product known as Microsoft Office 365. Computer users may see plenty of lucrative advertisements on the visited insecure website and lure into clicking on the ads that claims to be the Office 365 free license. In order to infect a website, the operators of this ransomware exploit a vulnerability in Magento framework and then place a file with a double extension identified as “ReadMe-how_to_get_free_office365-idGHDGf426142GE25.pdf.exe”. With the help of malicious PHP scripts, the above mentioned file is downloaded to the user's machine and the users may think that the file is a guide related to how to obtain free license of MS Office 365.

Once the users open the so-called guide, it enables the installation of SadStory ransomware which begins their work immediately just after successful infiltration. Although, it is very important to understand that the ransomware is based on CryPy ransomware infected which is written in Python programming language and specifically attacks the server network. According to the security investigators, the malware encode the files stored on connected removable drives, local disks and network shares. It uses a combination of AES and RSA encryption algorithm to encipher the files or data stored on infected PCs. SadStory ransomware is especially designed by the con artists in order to target more than 270 file formats. Thus, the threat aims to encrypt a broad range of file formats by using a secure encipher algorithms. Before encrypting the files stored on targeted machine, it generates a unique key which is 256-bit long.

Working Principles of SadStory ransomware

After the SadStory ransomware successfully encrypt the system's files, it also encode the decryption key by using a cryptographic algorithm known as RSA-2048. This decryption key is then sent to the hackers Command & Control server and the affected PC users is left with a ransom note named as “SADStory_README_FOR_DECRYPT.txt”. The ransom notification can be found on the computer's desktop and the files that are encoded by this ransomware will appended with a weird file extension reported as “.sad” and the enciphered files has no thumbnail as well. Furthermore, it provides two email address “[email protected]” and “[email protected]” and instruct the users to contact the hackers to receive a decryption key. However, the malware researchers strongly advised against writing a mail to the con artists. In such circumstances, one the best way to eliminate SadStory ransomware is by using a credible anti-malware shield, like the one mentioned below in this post and use a backup copy for file restoration.

Free Scan your Windows PC to detect SadStory ransomware

How To Remove SadStory ransomware From Your PC

Start Windows in Safe Mode with Networking.

• Click on Restart button to restart your computer
• Press and hold down the F8 key during the restart process.

 

• From the boot menu, select Safe Mode with Networking using the arrow keys.

• Now your computer will get started in Safe Mode with Networking.

End SadStory ransomware Related Process From Task Manager

• Press Ctrl+Alt+Del together on your keyboard.

• Task manager Windows will get opened on your computer screen.
• Go to Precess tab, find the SadStory ransomware related Process.

• Now click on on End Process button to close that task.

Uninstall SadStory ransomware From Windows 7 Control Panel

• Visit the Start menu to open the Control Panel.

• Select Uninstall a Program option from Program category.

• Choose and remove all SadStory ransomware related items from list.

Uninstall SadStory ransomware From Windows 8 Control Panel

• On right edge of screen, Click on Search button and type “Control Panel”.

• Now choose the Uninstall a Program option from Programs category.

• Find and delete SadStory ransomware related items from the programs list.

Delete SadStory ransomware From Windows 10 Control Panel

• Click on Start button and search Control Panel from Search Box.

• Got to Programs and select the Uninstall a Program option.

• Select and Remove all SadStory ransomware related programs.

Remove SadStory ransomware Related Registry Entries

• Press Windows+R buttons together to open Run Box

• Type “regedit” and click OK button.

• Select and remove all SadStory ransomware related entries.

Remove SadStory ransomware Infection From msconfig

• Open Run Box by pressing Windows+R buttons together.

• Now type “msconfig” in the Run Box and press Enter.

• Open Startup tab and uncheck all entries from unknown manufacturer.

Hope the above process has helped you in removing the SadStory ransomware virus completely from your computer. If you still have this nasty ransomware left in your PC then you should opt for a malware removal tool. It is the most easy way to remove this harmful computer virus from your computer. Download the Free SadStory ransomware Scanner on your system and scan your computer. It can easily find and remove this pesky ransomware threat from your PC.

If you have any questions regarding the removal of this virus then you can ask your question from your PC security experts. They will feel happy to solve your problem.