Piny File Locker - How to remove

Piny is a Djvu file locker and it affects Windows users all over the world. It appeared at or before December 21st and has been spreading on pirating sites, hidden in cracks and unlocked software. Piny’s most noticeable and most devastating effect is its ability to lock your files by encrypting them with a public key. Though there are some ways to try to recover your data, the best thing to do after a Piny infection is to restore the files from a backup.

Piny file locker should be removed before it can do more damage:

How Piny infects computers	Downloaded with hacked Office suites, Windows cracks, and other pirated software.
Infection symptoms	Files have “.piny” at the end of their name and don’t open, some websites do not load, malware gets installed, online accounts get hacked.
Similar threats	Redl, Righ, Hets.
How to remove Piny	Fix your hosts file, use a malware scanner to get rid of malware (SpyHunter), change your passwords.

Piny symptoms

After Piny starts running on your computer, it deletes Shadow volume copies and Restore points. This means that you can’t fix your files by restoring previous versions. Piny might also install a spyware virus on your computer. It’s called Azorult and it may install adware and steal your passwords.

Most importantly, Piny locks your files by using a cryptographic algorithm on them. If you know the algorithm that Piny uses (and ransomware researchers do know it) and if you know the decryption key, you can reverse the encryption process to restore your files. Unfortunately, the decryption keys are hidden.

Piny uses public-key cryptography to make sure that only the people behind Piny know everyone’s decryption keys. This does mean that Piny needs internet access to communicate with the criminals’ server to correctly lock your files, but even if there’s no internet, Piny will still encrypt the files using a hardcoded public key.

Piny creates files called “_readme.txt” that contain instructions for you to contact [email protected] or [email protected] and to pay them $490. The notes promise that the criminals have your decryption keys and they do, but we advise you against contacting them. There’s never a guarantee that those people won’t just ignore you after they get their money, not to mention that they’re criminals whose activities should not be supported. The only reason that these extortion attacks continue happening is that some victims end up paying the criminals. The fewer people pay, the less incentive there is for more file lockers to be made.

Piny locked files restore options

If Piny locked your files and you want to get them back, you have a few options:

• restore from a backup (but not everyone has backups),
• use data recovery software to recover deleted files (won’t work if you have an SSD or if you used your computer a lot since Piny’s infection),
• wait for someone to pay for and get the offline decryption key (if your files were encrypted with it),
• have an expert repair some of your files.

Having a backup for your most important files is always good. The backup has to be a separate device on a separate network to make sure that the same attack can’t affect the backup as well as the main device. For example, if Piny attacked you while you had your external drive connected, it will lock the external drive, too.

Data recovery software has helped some people, but it all depends. If you don’t know how to do it, read about it a lot and do not write to the drive that was affected. You’ve only got one chance to get this right. There’s a bit more info in the last section of this article.

If you want to know if Piny used the offline key to lock your files, go ahead and check your _readme files or C:\SystemID\PersonalID.txt. If your personal ID ends with “t1”, then it’s likely that the offline key was used for some of your files. Emsisoft has released their own free decrypter and they are always on the lookout for offline keys for Djvu file lockers.

Piny is fast, and to remain fast, it only encrypts portions of big files. Pictures, songs, databases. archives, videos, and other big “.piny” files have a lot of data in them that’s still okay. If someone who knows how these files work can look at them, they can repair them. Some data will be lost, for example, pictures will be partially corrupted and videos will lose a few seconds of footage. But if you find someone knowledgable that you trust, they may be able to help you. Just be careful of scammers who prey on desperate victims.

How to remove Piny file locker

The files that Piny encrypted, all the “list.doc.piny” and “song.flac.piny” files – they are not dangerous and you can keep them. Piny and the spyware virus it installs are dangerous (as is the file that infected your computer in the first place), but a malware remover can get rid of them (we recommend SpyHunter). Whatever program you use, you may want to set the removal to quarantine. Just in case your scanner tries to delete the encrypted files. You may need them to possibly decrypt them later, after all.

Important -- edit the hosts file to unblock security websites

TL DR : The hosts file is edited to block security sites Before the virus can be removed, it's necessary to fix the hosts file (the file which controls which addresses connect to which IPs). That is the reason the majority of security websites is inaccessible when infected with this particular parasite. This infection edits this file to stop certain websites, including anti-malware download sites, from being accessed from the infected computer, making browsers return the "This site can't be reached" error. Luckily, it's trivial to fix the file and remove the edits that were made to it.

Find and edit the hosts file

The hosts file can be found on C:/Windows/System32/Drivers/etc/hosts. If you don't see it, change the settings to see hidden files.

1. In the Start Menu, search for Control Panel.
2. In the Control Panel, find Appearance and Personalization.
3. Select Folder Options.
4. Open the View tab.
5. Open Advanced settings.
6. Select "Show hidden files...".
7. Select OK.

Open this file with administrator privileges.

1. Open the Start Menu and enter "notepad".
2. When Notepad shows up in the result, right-click on it.
3. In the menu, choose "Run as administrator"
4. File->Open and browse for the hosts file.

The hosts file should look like this: Delete additional lines that they connect various domain names to the wrong IP address. Save the file.

Download and run the antivirus program

After that, download antivirus programs and use them to remove the ransomware, the trojan, and other malware. Spyhunter (https://www.2-viruses.com/reviews/spyhunter/dwnld/).

Automatic Malware removal tools

How to recover Piny File Locker encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Piny File Locker has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Piny File Locker

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Piny File Locker. You can check other tools here.  

Step 3. Restore Piny File Locker affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Piny File Locker tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Piny File Locker encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.