How to Terminate Leon Ransomware (Crypto-Malware/Ransomware)

What is Leon ransomware? And how does it execute its attack on the infected PC?

Leon ransomware is a file-encrypting Trojan infection that corrupts a victim’s files and extorts money from them in exchange for file recovery. It is a new variant of a high-risk ransomware threat called Blind ransomware. Once it infects a system, it would begin scanning the system’s entire drive to look for files to encrypt. According to researchers, just like Blind ransomware, Leon ransomware might encrypt files with the following extensions:
.1c, .3fr, .accdb, .ai, .arw, .bac, .bay, .bmp, .cdr, .cer, .cfg, .config, .cr2, .crt, .crw, .css, .csv, .db, .dbf, .dcr, .der, .dng, .doc, .docm, .docx, .dwg, .dxf, .dxg, .eps, .erf, .gif, .htm, .html, .indd, .iso, .jpe, .jpeg, .jpg, .kdc, .lnk, .mdb, .mdf, .mef, .mk, .mp3, .mp4, .mrw, .nef, .nrw, .odb, .ode, .odm, .odp, .ods, .odt, .orf, .p12, .p7b, .p7c, .pdd, .pdf, .pef, .pem, .pfx, .php, .png, .ppt, .pptm, .pptx, .psd, .pst, .ptx, .r3d, .rar, .raw, .rtf, .rw2, .rwl, .sql, .sr2, .srf, .srw, .tif, .wb2, .wma, .wpd, .wps, .x3f, .xlk, .xls, .xlsb, .xlsm, .xlsx, .zip
At the time of writing, it is not yet known which encryption algorithm Leon uses in encrypting files, but security experts reckon it would be some sophisticated algorithms like RSA or AES or even a combination of both. After it’s done encrypting files, it will append the .Leon extension at the end of each files’ names. Following that, Leon ransomware creates a file called “How_Decrypt_Files.hta” which contains the ransom note that states:
“All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] You have to pay for decryption of Bitcoins. The price depends on how fast you write to us. After payment, we will send you the decryption tool that will decrypt all your files. Only in case you do not receive a response from the first email address within 48 hours, please use this alternative email address: [email protected]
Free decryption as a guarantee:
Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 1 Mb (non-archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins in LocalBitcoins site. You have to register, click ‘Buy bitcoins’, and select the seller by payment method and price.”
Victims are asked to contact the [email protected] for the decryption tool. Even though the crooks offer to decrypt three files for free, it most probably is only a ploy to lure you into paying the ransom. In other words, you shouldn’t do such thing because you will only fall into the cybercriminals’ trap. For now, all you must do is to terminate Leon ransomware from your computer as soon as you can and wait until a free decryptor is available to decrypt your inaccessible files.
How does Leon ransomware spread its malicious payload?
Leon ransomware might be using peer to peer sharing networks in spreading its malicious payload where the crooks disguise the malware as a useful program – it could even imitate a popular program to get users to download it. Moreover, Leon ransomware might also spread its malicious payload as an attachment in spam emails. So you have to be careful when opening any emails even if they look like they came from trustworthy senders.
To terminate Leon ransomware from your PC, refer to the following removal guide.
Step1. Open the Task Manager simply by tapping Ctrl + Shift + Esc keys on your keyboard.
Step2. Under the Task Manager, go to the Processes tab and look for any suspicious-looking process which takes up most of your CPU’s resources and is most likely related to Leon ransomware.
Step3. After that, close the Task Manager.
Step4. Tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
Step5. Under the list of installed programs, look for Leon ransomware or anything similar and then uninstall it.

Step6. Next, close Control Panel and tap Win + E keys to launch File Explorer.
Step7. Navigate to the following locations below and look for Leon ransomware’s malicious components such as How_Decrypt_Files.hta and [random].exe as well as other suspicious files and then delete all of them.

%TEMP%
C:\ProgramData
%ALLUSERSPROFILE%
%ALLUSERSPROFILE%\Application Data
%APPDATA%\Microsoft\Windows\Templates\
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step8. Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step9. Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step10. Navigate to the following path:

HKEY_CURRENT_USER\Control Panel\Desktop\
HKEY_USERS\.DEFAULT\Control Panel\Desktop\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Step11. Delete the registry keys and sub-keys created by Leon ransomware.
Step12. Close the Registry Editor and empty your Recycle Bin.
It is important to make sure that nothing is left behind and that Leon ransomware is completely removed using the following antivirus program. To use it, refer to the instructions below.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with NetLeoning then hit
Windows will now load the Safe Mode with NetLeoning.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. The installation will start automatically once a download is done.