How to Eliminate Foxy Ransomware (Crypto-Malware/Ransomware)

What is Foxy ransowmare? And how does it implement its attack?

Foxy ransomware is a new encryption Trojan which emerged on November 8, 2017. Its source code is based on Hidden Tear, an open source platform used by cyber criminals in developing ransomware infection like Foxy ransomware. Just like other crypto-malware, this ransomware is designed to encrypt files on the targeted computer and demands a ransom for a decryption tool.
The following file extensions are some of the file types that Foxy ransomware mostly targets as soon as it infiltrates a computer:
.3dm, .3g2, .3gp, .7zip, .aaf, .accdb, .aep, .aepx, .aet, .ai, .aif, .as, .as3, .asf, .asp, .asx, .avi, .bmp, .c, .class, .cpp, .cs, .csv, .dat, .db, .dbf, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dwg, .dxf, .efx, .eps, .fla, .flv, .gif, .h, .idml, .iff, .indb, .indd, .indl, .indt, .inx, .jar, .java, .jpeg, .jpg, .js, .m3u, .m3u8, .m4u, .max, .mdb, .mid, .mkv, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg, .pdb, .pdf, .php, .plb, .pmd, .png, .pot, .potm, .potx, .ppam, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prel, .prproj, .ps, .psd, .py, .ra, .rar, .raw, .rb, .rtf, .sdf, .sdf, .ses, .sldm, .sldx, .sql, .svg, .swf, .tif, .txt, .vcf, .vob, .wav, .wma, .wmv, .wpd, .wps, .xla, .xlam, .xll, .xlm, .xls, .xlsb, .xlsm, .xlsx,
Foxy ransomware uses the AES 256 encryption algorithm during the encryption process, leaving the files inaccessible to users. It also appends the .nightmare extension at the very end of each file’s names to mark the encrypted files. Foxy ransomware uses a malicious executable file named WindowsSoundDriver.exe is the one responsible for installing Foxy ransomware on the system. After data encryption, the ransomware launches a program window named “Foxy – Ransomware” and contains the following ransom note:
“1.) What happened to my PC/Files?
– Your files has been encrypted, that means, they are useless to you.
2.) Can I recover my Files?
– Of course. Just pay the price shown below, to the also shown below, Bitcoin Address and after we received the Payment you get the decryption key.
[48 HOURS COUNDOWN TIMER]
If the Countdown is finished, all your files get deleted
Pay Fast, get safe!
[Do Payment|BUTTON]
[Decrypt Files|BUTTON]”
Moreover, Foxy ransomware also uses the command “vssadmin.exe delete shadows /all/ Quiet” to delete the shadow volume copies of the files so it would be hard for you to recover your files using the alternative method which is through the Windows Previous versions. However, that does not mean that you should go ahead and contact these crooks as you might be in for more trouble than you already are – you will only end up losing money while your files remain encrypted. For now, you can use any backup copies of your files if you have them and wait until a free decryptor is released by security experts.
How does Foxy ransomware spread its malicious payload?
According to researchers, Foxy ransomware spread its malicious payload as a fake Windows Audio Driver program all over the web. You might have gotten tricked into installing this fake program as it uses Window’s name. To prevent this occurrence again, make sure that the program you’re about to install is legitimate and not fake and you must also keep your security programs and system updated so that it can detect any malicious programs in your computer.
Step 1: Close the program Window displaying the ransom note and then tap Ctrl + Shift + Esc to open the Task Manger.

Step 2: Once you’ve opened the Task Manager, go to the Processes tab and look for WindowsSoundDriver.exe as well as other processes of this ransomware and end all their processes by clicking on End Task or End Process.

Step 3: Open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.
Step 4: Look for Foxy ransomware or any suspicious program and then Uninstall it/them.

Step 5: Tap Win + E keys to launch File Explorer.
Step 6: Navigate to the following locations below and look for Foxy ransomware’s malicious components such as WindowsSoundDriver.exe and other suspicious files and then delete all of them.

%TEMP%
%APPDATA%
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step 7: Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then by all means go on to the next steps.
Step 8: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 9: Navigate to the following path:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Step 10: Delete the registry keys and sub-keys created by Foxy ransomware.
Step 11: Close the Registry Editor and empty your Recycle Bin.
It is important to make sure that nothing is left behind and that the Foxy ransomware is completely removed use the following antivirus program. To use it, refer to the instructions below.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOSscreen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Optionuse the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Boxwill show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. Installation will start automatically once download is done.