KK_ Ransomware - How To Remove?


Another greedy ransomware virus has emerged to the surface. This time it can be referred to as KK_ crypto-ransomware due to the prefix, added to the encrypted data (KK_). We called this virus covetous because of the demanded amount of bitcoins: 4. If this number does not seem that grant, how about 2303.96 US Dollars sound? If you store some extremely meaningful and exceptional material in your device’s memory, then you might stop to consider the possibility to pay the required fee for the decryption key. IT specialists are always doing their best to show how rash it would be to attempt to redeem files from hackers. Such shady programmers can disappear as soon as you send them the required amount of bitcoins, leaving your pockets empty and files ruined.

About KK_ Ransomware

The payload of KK_ virus is probably remaining undetected in one of the most common hiding-places of ransomware: folders like AppData, Local or etc. It is pretty difficult to spot the file, corrupting your system and managing to encrypt files. Why? Because these payloads manage to be completely ordinary and plain so suspicion would not be drawn to them. KK_ virus also makes unauthorized modifications to Windows Registry Keys so the payload of this ransomware would auto-run, together with other applications that are launched once computer system is rebooted. Before starting the encryption process, it employs a hunt for files that can be ruined. Once it finds various files, containing all sorts of content (video, music, photos, documents, pdf books or etc.), it is prepared to begin the encryption process. For this shady task KK_ virus exploits the RSA-1024-bit key to successfully corrupt the selected amount of date. As we have already established, every file gets an addition before its title to identify that it is encrypted: KK_. For example, if you had a filed name picture.jpg, after the encryption was concluded, it was transformed into KK_picture.jpg. Also, no ransomware virus manages without a letter of demands: KK_ IN YOUR DOCUMENTS..txt. KK_ virus gives explicit instructions and hopes that infected victims panic and follow them.

“Greetings, your computer has been locked by ransomware, your personal files are encrypted and you have unfortunately “lost” all your pictures, files and documents on the computer. Your important files encryption produced on this computer: videos, photos, documents, etc.
Encryption was produced using unique public key RSA-1024 generated for this computer. To decrypt files you need to obtain the private key.
All encrypted files contain KK_
Your number: ______________
To obtain the program for this computer, which will decrypt all files, you need to pay
4 bitcoins on our bitcoin address 15bs8hWKN9nYFcjLt1ET9azWFU6kfiK3WH (today 1 bitcoin was 225 $). Only we and you know about this bitcoin address.
You can check bitcoin balanse here – https://www.blockchain.info/address/15bs8hWKN9nYFcjLt1ET9azWFU6kfiK3WH
After payment send us your number on our mail nown@ruggedinbox.com and we will send you decryption tool (you need only run it and all files will be decrypted during 1…3 hours)
Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it – it’s your garantee that we have decryption tool. And send us your number with attached file.
We dont know who are you. All what we need – it’s some money.
Don’t panic if we don’t answer you during 24 hours. It means that we didn’t received your letter (for example if you use hotmail.com or outlook.com
it can block letter, SO DON’T USE HOTMAIL.COM AND OUTLOOK.COM. You need register your mail account in www.ruggedinbox.com (it will takes 1..2 minutes) and write us again)
You can use one of that bitcoin exchangers for transfering bitcoin. “

How to Decrypt Files Encrypted by KK_ Ransomware?

Since the creators of KK_ virus offer to extract one small file for free (from 100 – 500 kilobytes), we are suggesting that you exploit this opportunity. Even though a bigger file would be more helpful, you should take a chance with a small one as well. Once you have the encrypted and decrypted file, there are more glimmers of hope that your files can be successfully decrypted without having to pay the demanded ransom. For the future, acknowledge the fact that you never know when you might get infected with a ransomware. That is why it is advisable to always have backup copies of your files. You can upload them into online storing facilities or keep them in USBs. However, do not keep your USB plugged in your device: some variants of ransomware are able to encrypt the data stored in connected flash drives as well.

How is KK_ Ransomware Distributed?

KK_ virus is no stranger to the shady ways ransomware is distributed: it might be utilizing the same strategies to gain control over users’ devices. If you notice that your email account is receiving suspicious letters, never let curiosity lead you to opening it. Delete such spam letters even if they seem to be originating from reputable sources. It is hard to say who hackers are going to pretend to be. Either way, before opening letters and downloading bizarre attachments inside, make sure that the entire email is not a scam.

Never pay the demanded ransom and simply eliminate KK_ virus: there is no reason to keep it around. Utilize Reimage, Spyhunter or Hitman and these scanners will efficiently remove a ransomware from your system. To find out more about manual removal and the decryption of your files, read the following sections.

How to recover KK_ ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP
  • Start Shutdown RestartOK.
  • Press F8 key repeatedly until Advanced Boot Options window appears.
  • Choose Safe Mode with Command Prompt. Windows 7 enter safe mode

for Windows 8 / 10
  • Press Power at Windows login screen. Then press and hold Shift key and click Restart. Windows 8-10 restart to safe mode
  • Choose TroubleshootAdvanced OptionsStartup Settings and click Restart.
  • When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings. Windows 8-10 enter safe mode

2.Restore System files and settings.

  • When Command Prompt mode loads, enter cd restore and press Enter.
  • Then enter rstrui.exe and press Enter again. CMD commands
  • Click “Next” in the windows that appeared. Restore point img1
  • Select one of the Restore Points that are available before KK_ ransomware has infiltrated to your system and then click “Next”. Restore point img2
  • To start System restore click “Yes”. Restore point img3

Step 2. Complete removal of KK_ virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Reimage and remove all malicious files related to KK_ ransomware. You can check other tools here.

Step 3. Restore KK_ ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually KK_ virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so.

Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer.

a) Native Windows Previous Versions

Right-click on an encrypted file and select PropertiesPrevious versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

Previous version
b) Shadow Explorer

It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.
Shadow explorer

Step 4. Use Data Recovery programs to recover KK_ ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

  • We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
  • Download Data Recovery Pro (commercial)
  • Install and scan for recently deleted files. Data Recovery Pro

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.


About the author

 - Main Editor
I have started 2-viruses.com in 2007 after wanting to be more or less independent from single security program maker. Since then, we kept working on this site to make internet better and safer place to use.
August 30, 2016 05:34, January 3, 2017 06:32

Leave a Reply

Your email address will not be published. Required fields are marked *