CIA Special Agent 767 Ransomware Virus (Removal and Protection)

A window with CIA identification and a message which begins in the following manner: „IMPORTANT! PLEASE READ! Unfortunately the files on this computer (documents, photos, videos) have been encrypter using an extremely secure and unbreakable algorithm… “ is related with yet another lock screen ransomware called CIA Special Agent 767.

Read further and learn how to deal with this crypto virus in case of infection.

Details of CIA Special Agent 767 Ransomware

CIA Special Agent 767 is a ransomware that has the function to lock the computer screen and demand a ransom amount of $100 USD. The amount increases up to $500 USD after the first five days. The fraudsters accept the payment in Bitcoin only.

CIA Special Agent 767 ransomware modifies some values in the Windows Registry. Thus it successfully locks the computer screen and displays its ransom note. The ransom message is rather disturbing because of CIA badge is shown in the upper left corner.

The message states that the files on the infected computer (documents, photos, videos) have been encrypted by an extremely secure and unbreakable algorithm. However, this message is fake, and the only locked thing is the computer screen. Actually, the files are not encrypted, the crooks only aim to fool the victims into paying the ransom.

Here is what reads the whole message:

“IMPORTANT! PLEASE READ! Unfortunately the files on this computer (documents, photos, videos) have
been encrypter using an extremely secure and unbreakable algorithm. This
means that the files are now useless unless they are decrypted using a key. The good news is that your files are not lost forever! This tool is able
to rescue the files on your computer for you! BY PURCHASING A LICENSE FROM US, WE ARE ABLE TO RESCUE YOUR FILES 100% GUARANTEED
FOR EVERY LOW EARLY BIRD PRICE OF ONLY $100 USD!* In 5 days however, the price of this service
will increase to $250 USD, and after $500 USD. Payment is accepted in Bitcoin only. You can purchase Bitcoin very easily in your area by bank transfer,
Western Union, or even cash. Visit www.localbitcoins.com to find a seller in your area. You can also goolge Bitcoin Exchanges to find
other methods for buying Bitcoin Please check the current price of Bitcoin and ensure you are sending the correct amount before making your payment! Visit
www.bitcoinaverage.com for the current Bitcoin Price. After making your payment, please wait up to 24 hours for us to make your key available. Usually done in much less time however. IMPORTANT: Once the key is available and you click \”Decrypt Files\”, please wait and let the decryption process complete before closing
this tool. This Process can take from 15 minutes to 2+ hours depending on how many files need to be decrypted. You will get a
notification thatthe decryption process is complete, at which time you can click \”Exit\”. Removing this tool from your computer without first
decrypting your files will cause your files to be lost forever. Bitcoin Address: 1GmGBH9ra2dqA8CgRg8a8Rngx4qHb2hLDW *Please note that early bird qualification is determined from the date that this tool was first run as recorded on our servers.”

In case that a victim of CIA Special Agent 767 ransomware pays the ransom, he will receive the unlock code:

→“suckmydicknigga”

Once it is entered, the victims receive an alert with the following message:

JUST DELETE IT TO REMOVE IT
HAHA YOU HAVE BEEN FOOLED

This malicious scheme is not enforced for the first time. We have noticed that in the M4N1F3STO ransomware message is provided the same Bitcoin address as the one in CIA Special Agent 767.

Fortunately, all victims of CIA Special Agent 767 screen locker ransomware could use the code “suckmydicknigga” to unlock their screen and resume the access to their files. Let us notice that as long as the malicious files are on the computer, the CIA Special Agent 767 lock screen message will appear each time the Windows OS is started. So the threat should be removed permanently.

Delivery

The threat is detected to be distributed like an executable application. The executable files associated with CIA Special Agent 767 ransomware are WindowsApplication1.exe and Receipt.exe. The malicious source code may be distributed via malicious email attachments, exploit kits, and compromised websites or advertisements displayed on different legitimate websites. CIA Special Agent 767’s malicious payloads might also be bundled with less familiar freeware.

CIA Special Agent 767 Ransomware Removal

For a faster solution, you can run a scan with an advanced malware removal tool and delete CIA Special Agent 767 completely with a few mouse clicks.

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

1) Hit WIN Key + R

2) A Run window will appear. In it, write “msconfig” and then press Enter
3) A Configuration box shall appear. In it Choose the tab named “Boot”
4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking”

STEP II: Show Hidden Files

1) Open My Computer/This PC
2) Windows 7
– Click on “Organize” button
– Select “Folder and search options”
– Select the “View” tab
– Go under “Hidden files and folders” and mark “Show hidden files and folders” option

3) Windows 8/ 10

– Open “View” tab
– Mark “Hidden items” option



4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

1) Hit the following key combination: CTRL+SHIFT+ESC
2) Get over to “Processes”
3) When you find suspicious process right click on it and select “Open File Location”
4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”
5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely CIA Special Agent 767 Ransomware Using SpyHunter Anti-Malware Tool

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

1) Again type simultaneously the Windows Button + R key combination
2) In the box, write “regedit”(without the inverted commas) and hit Enter
3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

1) Use present backups
2) Restore your personal files using File History
– Hit WIN Key
– Type “restore your files” in the search box
– Select “Restore your files with File History”
– Choose a folder or type the name of the file in the search bar



– Hit the “Restore” button

3) Using System Restore Point

– Hit WIN Key
– Select “Open System Restore” and follow the steps

STEP VII: Preventive Security Measures

1) Enable and properly configure your Firewall.
2) Install and maintain reliable anti-malware software.
3) Secure your web browser.
4) Check regularly for available software updates and apply them.
5) Disable macros in Office documents.
6) Use strong passwords.
7) Don’t open attachments or click on links unless you’re certain they’re safe.
8) Backup regularly your data.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter