How to Wipe Out PUBG Ransomware (Crypto-Malware/Ransomware)

What is PUBG ransomware? And how does it execute its attack?

PUBG ransomware is one of the latest crypto-malware discovered recently. This new ransomware threat is discovered by the MalwareHunterTeam on the first half of April 2018. Luckily, it seems to be poorly developed as it tries to imitate a typical ransomware threat and ask victims to play a game called “Player Unknown Battlegrounds”. This ransomware threat also shares some similarities with the RensenWare ransomware that also requires its victims to play a game for the alleged restoration of the encrypted files.
Once installed, PUBG ransomware will make changes on the infected computer and create entries in the Windows Registry to achieve persistence. It also starts to scan the system to look for certain files to encrypt. It will most likely encrypt files with the following extensions:
.PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG .CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG
This crypto-malware appends the .PUBG extension to each one of the encrypted files. After it has finished encrypting them, it will open a program window that contains the following message:
“PUBG Ransomware
Your files, images, musics, documents are Encrypted!
Your files are encrypted by PUBG Ransomware!
but don’t worry! It is not hard to unlock it.
I don’t want money!
Just play PUBG 7 Heurs!
Or Restore code is [ s2acxx56a2sae5fjh5k2gb5s2e ] RESTORE CODE: You Played : 0 Sec…
STATUS: Wait For Game…”
Victims are given two methods to decrypt the encrypted files. The first one can be used to simply enter the s2acxx56a2sae5fjh5k2gb5s2e code into the program window and then click the Restore button while the other method involves playing the PlayerUnknown’s Battlegrounds by monitoring the running processes for one named “TSlGame”.
How does PUBG ransomware proliferate?
PUBG ransomware seems to proliferate with the use of spam emails – a distribution method commonly used by cyber crooks in spreading malicious threats like ransomware. These spam emails may contain infected attachments or links used to download and install the ransomware threat into the targeted system.
To wipe out PUBG ransomware use the given removal instructions below.
Step 1: The first thing you need to do is to try typing the code “s2acxx56a2sae5fjh5k2gb5s2e” into PUBG ransomware’s program window then eliminate its process by opening the Task Manager – simply tap the Ctrl + Shift + Esc keys on your keyboard.
Step 2: After that, click the Processes tab and look for any suspicious process that takes up a lot of system memory and then end them all.

Step 3: Now that the malicious process is eliminated, close the Task Manager.
Step 4: Next, tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
Step 5: Under the list of installed programs, look for PUBG ransomware or anything similar and then uninstall it.

Step 6: Then close Control Panel and tap Win + E keys to launch File Explorer.
Step 7: Navigate to the following locations below and look for PUBG ransomware’s malicious components it has created and downloaded into the system like “PUBG_Ransomware.exe” and then delete all of them.

%TEMP%
%WINDIR%\System32\Tasks
%APPDATA%\Microsoft\Windows\Templates\
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step 8: Close the File Explorer.
Before you go on any further, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use [product-name], this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step 9: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 10: Navigate to the following paths:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveTimeOut
HKEY_CURRENT_USER\Control Panel\Desktop

Step 12: Delete the registry keys and sub-keys created by PUBG ransomware.
Step12. Close the Registry Editor and empty the Recycle Bin.
Try to recover your encrypted files using the Shadow Volume copies
Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if PUBG ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

Once you’ve covered the first few steps given above, all that’s left for you to do is ensure the removal of PUBG ransomware by using a reliable program named [product-name].
Perform a full system scan using [product-code]. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in the URL address, [product-url] in the Run dialog box and then tap Enter or click OK.
After that, it will download the program. Wait for the download to finish and then open the launcher to install the program.
Once the installation process is completed, run [product-code] to perform a full system scan.