Do you know what Cyber_baba2@aol.com Ransomware is?
Cyber_baba2@aol.com Ransomware is another infection that encrypts files and adds the .xtbl extension to all the files it touches. As it shares similarities with other ransomware infections prevalent these days, our team of specialists has no doubt that it has been developed by cyber criminals who have released such well-known ransomware infections as Redshitline Ransomware, Vegclass@aol.com Ransomware, and Makdonalds@india.com Ransomware. Cyber_baba2@aol.com Ransomware is not unique at all. Even though it sets a different picture on Desktop, it acts exactly the same as the aforementioned threats. This is, it finds a way to enter the computer without permission, and then it encrypts data. Unfortunately, it is primarily targeted at personal files as they are the most valuable, which means that you will no longer have access to your music, pictures, documents, and even applications. Fortunately, it does not lock any system files, so it will not ruin your system if it ever enters your computer. It is extremely hard to unlock files having the .xtbl extension. To be frank, it might be impossible to unlock them, so you should remove this ransomware from your computer and make sure that another file-locking ransomware cannot enter your PC ever again. You will find out how you can ensure the system’s safety if you read this report.
Cyber_baba2@aol.com Ransomware screenshot
Scroll down for full removal instructions
Cyber_baba2@aol.com Ransomware is not a screen-locking infection. Rather than locking the Desktop, it changes the Wallpaper the second it finishes encrypting users’ personal files. The image it sets contains the ransom note. It does not tell users much – it only says that files have been encrypted, and the only way to get the data back is to write an email to cyber_baba2@aol.com:
HELLO MY FRIEND
ALL YOUR DATA HAS BEEN CRYPTED
YOU SERVER HAS A SECURITY PROBLEM
TO GET YOUR DATA BACK AND PROTECT
YOUR SYSTEM WRITE TO
CYBER_BABA2@AOL.COM
Cyber criminals want all the users to know about the loss of files, so it creates the How to decrypt your files.txt on Desktop too. It contains the similar information as the picture set as Wallpaper.
It is up to you whether or not to contact cyber criminals; however, in our opinion, there is no point in doing that if you are not going to transfer money to them. Yes, we are sure that you will be asked to purchase the decryptor or make a payment for the decryption key. Taking into account amounts of money asked by other ransomware infections, it will not be cheap to decrypt files. Also, there are no guarantees that they will really be unlocked after you make a payment. If you decide not to give cyber crooks what they want, you should try to use the free decryptor you can download from the web. We cannot guarantee that it will unlock files for you because Cyber_baba2@aol.com Ransomware uses the RSA-2048 encryption key, which is known to be extremely hard to break. If you find that it is impossible to decrypt files free of charge, you should not delete those encrypted files because the free tool might be released one day. Of course, it does not mean that you do not need to erase Cyber_baba2@aol.com Ransomware.
You need to know how ransomware infections are distributed to be able to prevent them from entering your PC in the future. As research carried out by our specialists has shown, these threats mainly come as attachments in spam emails; however, they might be spread using other methods too, for example, the ransomware might be dropped by the so-called Trojan dropper. Also, it might pretend to be a good application and hide on third-party websites. If you doubt that you can protect your PC from harm, you should install a reputable security tool and let it do this job for you. We recommend using SpyHunter because we know that it would protect your system from all kinds of threats.
Cyber_baba2@aol.com Ransomware is not an ordinary application, so it will not be very easy to remove it either because you will have to find the executable file it places on the system and then delete it. As it has the random name, it will not be easy to find it. What is more, you will need to undo the changes this ransomware has applied in the system registry. If our manual removal guide does not help you much either, use an automatic scanner to erase this threat.
How to delete Cyber_baba2@aol.com Ransomware
- Open the Windows Explorer (Win+E).
- Check all these directories (copy and paste the path in the URL bar) and delete the .exe file:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
- %USERPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\
- %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\
- %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\
- %WINDIR%\Syswow64\
- %WINDIR%\System32\
- Open the Registry Editor (Win+R).
- Type regedit.exe in the Open field and click OK.
- Move to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
- Delete the Value that has the Data %WINDIR%\Syswow64\*.exe or %WINDIR%\System32\*.exe (* - random name).
- Open HKCU\Control Panel\Desktop.
- Right-click on the Wallpaper value and empty the Value data field. Click OK.
- Move to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers.
- Right-click on BackgroundHistoryPath0 and select Delete.
- Remove the malicious file you have downloaded recently.
- Empty the Recycle bin.
In non-techie terms:
Do not forget that you need to take care of other untrustworthy applications after the Cyber_baba2@aol.com Ransomware removal. Yes, it is very likely that there are other threats on your PC too if this ransomware has so easily entered your computer. It is basically impossible to find all the threats and malicious components manually, so we suggest using the diagnostic scanner. You can download it from our website.