What is Calvo Ransomware
Being part of the Phobos Ransomware family, Calvo is another malicious program, which encrypts personal data. The way it does it is by using military-grade algorithms to cipher the files. Along with that, the virus also assigns a string of symbols to each of the files. This includes a personal ID of victims, cybercriminals’ e-mail, and .calvo extension to finish the string. For example, a file like 1.pdf will be infected and changed to 1.pdf.id[C279F237-3143].[seamoon@criptext.com].calvo. The same change will happen to the rest of the data stored on a PC. As soon as this part of the infection gets to a close, Calvo creates two ransom notes (info.hta and info.txt) to guide you through the decryption process.
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail cusapool@firemail.cc
Write this ID in the title of your message
In case of no answer in 24 hours write us to this e-mail:cusapool@firemail.cc
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment, we will send you the tool that will decrypt all your files.
Free decryption as a guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click ‘Buy bitcoins’, and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
!!All of your files are encrypted!!!
To decrypt them send e-mail to this address:
seamoon@criptext.com.
If we don’t answer in 24h., send e-mail to
this address: seamoon@tutanota.com
It is said that victims should write to seamoon@criptext.com attaching the personal ID that is stated inside of the note. If you do not receive any response from the extortionists, they also attach a spare e-mail address to contact if so. Once you establish contact with cybercriminals, you will be given a crypto address to process the payment in Bitcoin. As there are no third-party tools being able to decrypt Calvo-decrypted files at the moment, the only way to decipher the data is by sacrificing money to swindlers. However, if you have a backup copy (which most people don’t), the data is easy to recover after deleting the virus completely. Despite Calvo developers offer free file decryption (up to 5 samples), paying the whole ransom might result in financial or even mental damage. This is because some extortionists disobey their principles and do not provide any promised software even after paying the ransom. Below, we will show you how to delete Calvo Ransowmare as well as some recovery tools that may be helpful eventually.
How Calvo Ransomware infected your computer
The way ransomware can sneak into your system is not a single method. There are many of them helping cybercriminals to reach their victims. Channels like trojans, fake software cracking tools, backdoors, keyloggers, unprotected RDP configuration, and more are possible to spread infections like Calvo Ransomware. One more important vector to mention is e-mail spam. Cybercriminals have been largely exploiting this method for a very long time. This is because e-mail services are used by many people on a regular basis. Based on that, fraudulent groups send a large number of e-letters bundled with malicious attachments. Inexperienced or non-attentive users may trust the received messages and open the content hidden inside. Usually, it can be files like MS Office documents, PDFs, executables, or links leading to pages that offer to download something. Although some of the files may look completely legitimate, they can be reconfigured to store malicious programs. Not excluded that such files contain trojans, which cause chain infections of other malware. If you want to stay away from such threats in the future, it is worth learning a lesson of being more careful. Never open or interact with unfamiliar content received from suspicious sources. In the article below, we will show other tips that can help you protect your PC from threats like Calvo Ransomware.
- Download Calvo Ransomware Removal Tool
- Get decryption tool for .calvo files
- Recover encrypted files with Stellar Data Recovery Professional
- Restore encrypted files with Windows Previous Versions
- Restore files with Shadow Explorer
- How to protect from threats like Calvo Ransomware
Download Removal Tool
To remove Calvo Ransomware completely, we recommend you to use Norton Antivirus from Symantec. It detects and removes all files, folders, and registry keys of Calvo Ransomware and preavents future infections by similar viruses.
Alternative Removal Tool
To remove Calvo Ransomware completely, we recommend you to use SpyHunter 5. It detects and removes all files, folders, and registry keys of Calvo Ransomware. The trial version of Spyhunter 5 offers virus scan and 1-time removal for FREE.
Calvo Ransomware files:
info.txt
info.hta
{randomname}.exe
Calvo Ransomware registry keys:
no information
How to decrypt and restore .calvo files
Use automated decryptors
Download Kaspersky RakhniDecryptor
Use following tool from Kaspersky called Rakhni Decryptor, that can decrypt .calvo files. Download it here:
There is no purpose to pay the ransom because there is no guarantee you will receive the key, but you will put your bank credentials at risk.
Dr.Web Rescue Pack
Famous antivirus vendor Dr. Web provides free decryption service for the owners of its products: Dr.Web Security Space or Dr.Web Enterprise Security Suite. Other users can ask for help in the decryption of .calvo files by uploading samples to Dr. Web Ransomware Decryption Service. Analyzing of files will be performed free of charge and if files are decryptable, all you need to do is purchase a 2-year license of Dr.Web Security Space worth $120 or less. Otherwise, you don’t have to pay.
If you are infected with Calvo Ransomware and removed it from your computer you can try to decrypt your files. Antivirus vendors and individuals create free decryptors for some crypto-lockers. To attempt to decrypt them manually you can do the following:
Use Stellar Data Recovery Professional to restore .calvo files
- Download Stellar Data Recovery Professional.
- Click Recover Data button.
- Select type of files you want to restore and click Next button.
- Choose location where you would like to restore files from and click Scan button.
- Preview found files, choose ones you will restore and click Recover.
Using Windows Previous Versions option:
- Right-click on infected file and choose Properties.
- Select Previous Versions tab.
- Choose particular version of the file and click Copy.
- To restore the selected file and replace the existing one, click on the Restore button.
- In case there is no items in the list choose alternative method.
Using Shadow Explorer:
- Download Shadow Explorer program.
- Run it and you will see screen listing of all the drives and the dates that shadow copy was created.
- Select the drive and date that you want to restore from.
- Right-click on a folder name and select Export.
- In case there are no other dates in the list, choose alternative method.
If you are using Dropbox:
- Login to the DropBox website and go to the folder that contains encrypted files.
- Right-click on the encrypted file and select Previous Versions.
- Select the version of the file you wish to restore and click on the Restore button.
How to protect computer from viruses, like Calvo Ransomware, in future
1. Get special anti-ransomware software
Use ZoneAlarm Anti-Ransomware
Famous antivirus brand ZoneAlarm by Check Point released a comprehensive tool, that will help you with active anti-ransomware protection, as an additional shield to your current protection. The tool provides Zero-Day protection against ransomware and allows you to recover files. ZoneAlarm Anti-Ransomware is compatible with all other antiviruses, firewalls, and security software except ZoneAlarm Extreme (already shipped with ZoneAlarm Anti-Ransomware) or Check Point Endpoint products. The killer features of this application are: automatic file recovery, overwrite protection that instantly and automatically recovers any encrypted files, file protection that detects and blocks even unknown encryptors.
2. Back up your files
As an additional way to save your files, we recommend online backup. Local storages, such as hard drives, SSDs, flash drives, or remote network storages can be instantly infected by the virus once plugged in or connected to. Calvo Ransomware uses some techniques to exploit this. One of the best services and programs for easy automatic online backup is iDrive. It has the most profitable terms and a simple interface. You can read more about iDrive cloud backup and storage here.
3. Do not open spam e-mails and protect your mailbox
Malicious attachments to spam or phishing e-mails are the most popular method of ransomware distribution. Using spam filters and creating anti-spam rules is good practice. One of the world leaders in anti-spam protection is MailWasher Pro. It works with various desktop applications and provides a very high level of anti-spam protection.
