D2+D Ransomware - How to remove

D2+D Ransomware is both a ransomware and a screenlocker. If your system is infected with it, your files will be encrypted and screen locked – basically you will lose control of your system.

There are several distribution methods for this ransomware – it can be remotely infiltrated into Windows operating system as an update packet or you can download it from social media website and run yourself, thinking that it is some useful software or file. That’s why we suggest to be very careful about free software and files downloaded from the file sharing networks – do not try to open them instantly, scan it with anti-malware tools first. You can use any reputable AM application to do this, such as Spyhunter and other similar tools.

It is impossible not to notice if your computer is infected with D2+D Ransomware because it will lock your screen and display evoking text message on a bright red background. Original text of the message:

WHAT THE HELL IS HAPPENING?
Your files are encrypted, you cannot close this progarm unless you have the key! This is a ransomware
What can i do?
You have to buy the key! don’t worry
Customers are treated well, we are reliable
Can you decrypt my files?
Yes, we can but we won’t do it
Enter the key yourself
You can check the F.A.Q in the link given below
http://bobdinh.hol.es
REMEMBER, THE TIME IS LIMITED you only have 3 day(s) to buy the key!
HOW TO PURCHASE?
Buy bitcoins and send to: DlEifiefiinn34n2i3 or buy me some cup of coffe or we could hang out together that is fine ! ?
don’t know how to create bitcoin account? check the F.A.Q or hang out with me!
[Send with love:] DlEifiefiinn34n2i3
Send 100$ worth of bitcoin, special offer: 50% discount for first 3 customers fot poor people offer: 90% off!!!
feel free to donate now: [Donate to D2+D ransom project now!!] button [Unlock now!]

As you can see, you are prompted to purchase a key which would unlock your screen and files. This has to be done within 3 days, otherwise the key would be permanently deleted. The ransom amount is $100, in Bitcoins. Actually, this ransom is not really big compared to what other similar viruses are asking for, yet it is still not worth paying. And that’s because this virus is not actually working – it’s just a scam for gullible users. Yes, it locks the screen but it can’t encrypt files stored on the system, so all you have to do is to deal with this annoying screenlocker. Cyber security researchers developed a cure against this virus – simply input code 215249148 into the ‘unlock now’ field and press the button. That’s it – you can use your computer once again.

However, after you unlock the screen, files of the virus still remains on the computer, so every single time you restart it, it will load and lock your screen again. Due to this, you should completely clean your computer – all files and registry entries associated with this infection should be removed. Again, it can be easily done with a help from anti-malware software. Just scan your computer with a decent anti-malware and the infection shall be gone for good.

Unlock code for D2+D Ransomware: 215249148

How to recover D2+D Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before D2+D Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of D2+D Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to D2+D Ransomware. You can check other tools here.  

Step 3. Restore D2+D Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually D2+D Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover D2+D Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.

Manual removal