An infection with the dangerous .skvtb Virus leads to serious security issues. Victims can restore and protect their computers by following our complete removal guide.
Remove .skvtb Virus and Restore PC
Manual Removal Guidef
Skip all steps and download anti-malware tool that will safely scan and clean your PC.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
Distribution of .skvtb Virus
The .skvtb Virus is distributed using the usual tactics associated with the most popular malware families. They tend to use e-mail messages. Depending on the type of the issued campaign different methods may be used:
- File Attachments ‒ The criminals can directly embed the .skvtb Virus into the messages sent via the emails. The hackers utilize different social engineering tricks to make the victims infect themselves with the files which are usually disguised as legitimate executables files or documents of user interest.
- Hyperlinks ‒ Links to the .skvtb Virus strains can be inserted in the body contents of the emails.
- Infected Documents ‒ They are linked or directly attached to the messages. Depending on the current configuration the .skvtb Virus code may be placed in presentations, rich text documents or spreadsheets. When they are opened a notification prompt asks the users if they want to run the built-in macros (scripts). If this is done the infection follows.
Hacker-created sites and portals are another option which are becoming popular in the last few years. The criminals redirect the victims using scripts or emails to automatically generated portals which link or deliver the .skvtb Virus. Another well-known option is the use of browser hijackers which are addons made for the most popular web browsers ‒ Mozilla Firefox, Google Chrome, Internet Explorer, Opera, Microsoft Edge and Safari. Once installed they not only infect the users with the malware, but also redirect the victims to a hacker-controlled site. Depending on the configuration the browser hijackers can also steal sensitive information such as any stored passwords, account credentials, history, bookmarks, form data and settings.
Impact of .skvtb Virus
The security analysts that detected the .skvtb virus note that it is a new strain of the Magniber ransomware. This is an advanced threat which initially targeted victims from South Korea. The updated version retains much of the hacker sequence devised in the original. It is possible that the same exploit (CVE-2016-0189) is used as the main attack agent. It is also being used by hacker kits such as Disdain and Sundown.
We would like to remind our readers that the previous version used an extensive information harvesting module. It used a complex data check to ensure that the targets confront to the target group defined by the hackers before the infection starts. The .skvtb virus can include a large amount of modules including the following:
- Information Harvesting ‒ The criminals can steal sensitive data before the encryption process is started.
- Trojan Module ‒ It can be used to spy on the victim machines and overtake control on request.
- Additional Virus Delivery ‒ The .skvtb virus can be used to deploy other malware to the target computers.
Like the previous version the infection module retains much of its characteristics. It is able to spawn other processes and modify application settings and Windows registry values. This allows the criminal operators to conduct complex social engineering attacks. An example scenario is the creation of a web browser frame which displays a hacker-created login window. The victims can be tricked into entering sensitive credentials such as their email password, social services credentials or e-banking information.
The .skvtb virus is noteworthy for extracting a lot of information from the compromised hosts. The list includes available hardware components, application configuration and settings. The network availability of the devices are probed using standard command (like “ping”) and the regional settings are extracted as well. This is done in order to make a detailed account of the users preferences. Noteworthy with the original Magniber ransomware and the .skvtb virus offspring is that they are able to protect themselves from discovery. They contain modules that protect them from debugging environments, virtual machines and security analysis. Depending on the version of the .skvtb virus this feature may be implemented in different depth.
It is presumed that when the encryption engine is started the .skvtb uses the same or a slightly modified file list of target extensions as Magniber. This means that the following files are likely to be processed using the cipher:
docx xls xlsx ppt pptx pst ost msg em vsd vsdx csv rtf 123 wks wk1 pdf dwg
onetoc2 snt docb docm dot dotm dotx xlsm xlsb xlw xlt xlm xlc xltx xltm pptm
pot pps ppsm ppsx ppam potx potm edb hwp 602 sxi sti sldx sldm vdi vmx gpg
aes raw cgm nef psd ai svg djvu sh class jar java rb asp php jsp brd sch dch
dip vb vbs ps1 js asm pas cpp cs suo sln ldf mdf ibd myi myd frm odb dbf db
mdb accdb sq sqlitedb sqlite3 asc lay6 lay mm sxm otg odg uop std sxd otp
odp wb2 slk dif stc sxc ots ods 3dm max 3ds uot stw sxw ott odt pem p12 csr
crt key pfx der 1cd cd arw jpe eq adp odm dbc frx db2 dbs pds pdt dt cf cfu
mx epf kdbx erf vrp grs geo st pff mft efd rib ma lwo lws m3d mb obj x3d c4d
fbx dgn 4db 4d 4mp abs adn a3d aft ahd alf ask awdb azz bdb bib bnd bok btr
cdb ckp clkw cma crd dad daf db3 dbk dbt dbv dbx dcb dct dcx dd df1 dmo dnc
dp1 dqy dsk dsn dta dtsx dx eco ecx emd fcd fic fid fi fm5 fo fp3 fp4 fp5
fp7 fpt fzb fzv gdb gwi hdb his ib idc ihx itdb itw jtx kdb lgc maq mdn mdt
mrg mud mwb s3m ndf ns2 ns3 ns4 nsf nv2 nyf oce oqy ora orx owc owg oyx p96
p97 pan pdb pdm phm pnz pth pwa qpx qry qvd rctd rdb rpd rsd sbf sdb sdf spq
sqb stp str tcx tdt te tmd trm udb usr v12 vdb vpd wdb wmdb xdb xld xlgc zdb
zdc cdr cdr3 abw act aim ans apt ase aty awp awt aww bad bbs bdp bdr bean
bna boc btd cnm crw cyi dca dgs diz dne docz dsv dvi dx eio eit emlx epp err
etf etx euc faq fb2 fb fcf fdf fdr fds fdt fdx fdxt fes fft flr fodt gtp frt
fwdn fxc gdoc gio gpn gsd gthr gv hbk hht hs htc hz idx ii ipf jis joe jp1 jrtf
kes klg knt kon kwd lbt lis lit lnt lp2 lrc lst ltr ltx lue luf lwp lyt lyx man
map mbox me mel min mnt mwp nfo njx now nzb ocr odo of oft ort p7s pfs pjt prt
psw pu pvj pvm pwi pwr qd rad rft ris rng rpt rst rt rtd rtx run rzk rzn saf
sam scc scm sct scw sdm sdoc sdw sgm sig sla sls smf sms ssa sty sub sxg tab
tdf tex text thp tlb tm tmv tmx tpc tvj u3d u3i unx uof upd utf8 utxt vct vnt
vw wbk wcf wgz wn wp wp4 wp5 wp6 wp7 wpa wpd wp wps wpt wpw
wri wsc wsd wsh wtx
xd xlf xps xwp xy3 xyp xyw ybk ym zabw zw abm afx agif agp aic albm apd apm
apng aps apx art asw bay bm2 bmx brk brn brt bss bti c4 ca cals can cd5 cdc
cdg cimg cin cit colz cpc cpd cpg cps cpx cr2 ct dc2 dcr dds dgt dib djv dm3
dmi vue dpx wire drz dt2 dtw dv ecw eip exr fa fax fpos fpx g3 gcdp gfb gfie
ggr gih gim spr scad gpd gro grob hdp hdr hpi i3d icn icon icpr iiq info ipx
itc2 iwi j2c j2k jas jb2 jbig jbmp jbr jfif jia jng jp2 jpg2 jps jpx jtf jw
jxr kdc kdi kdk kic kpg lbm ljp mac mbm mef mnr mos mpf mpo mrxs my ncr nct
nlm nrw oc3 oc4 oc5 oci omf oplc af2 af3 asy cdmm cdmt cdmz cdt cmx cnv csy
cv5 cvg cvi cvs cvx cwt cxf dcs ded dhs dpp drw dxb dxf egc emf ep eps epsf
fh10 fh11 fh3 fh4 fh5 fh6 fh7 fh8 fif fig fmv ft10 ft11 ft7 ft8 ft9 ftn fxg
gem glox hpg hpg hp idea igt igx imd ink lmk mgcb mgmf mgmt mt9 mgmx mgtx
mmat mat ovp ovr pcs pfv plt vrm pobj psid rd scv sk1 sk2 ssk stn svf svgz
tlc tne ufr vbr vec vm vsdm vstm stm vstx wpg vsm xar ya orf ota oti ozb
ozj ozt pa pano pap pbm pc1 pc2 pc3 pcd pdd pe4 pef pfi pgf pgm pi1 pi2 pi3
pic pict pix pjpg pm pmg pni pnm pntg pop pp4 pp5 ppm prw psdx pse psp ptg
ptx pvr px pxr pz3 pza pzp pzs z3d qmg ras rcu rgb rgf ric riff rix rle rli
rpf rri rs rsb rsr rw2 rw s2mv sci sep sfc sfw skm sld sob spa spe sph spj
spp sr2 srw wallet jpeg jpg vmdk arc paq bz2 tbk bak tar tgz gz 7z rar zip
backup iso vcd bmp png gif tif tiff m4u m3u mid wma flv 3g2 mkv 3gp mp4 mov
avi asf mpeg vob mpg wmv fla swf wav mp3
The .skvtb virus may automatically send the collected data through special devised command and control centers over the Internet. The malware code reports the unique infection ID (UUID) to the servers. The network traffic analysis shows that among the data packets the 16-character long string used as an input value for the generation of the private key is also shown. When network connectivity is not available the engine falls back to a hardcoded string to process the target files.
Magniber ransomware was known for using a built-in exclusions list. It disallows encryption of certain system folder which may lead to permanent damage to the operating system. The list protects the following folders:
:\documents and settings\all users\
:\documents and settings\default user\
:\documents and settings\localservice\
:\documents and settings\networkservice\
\appdata\local\
\appdata\locallow\
\appdata\roaming\
\local settings\
\public\music\sample music\
\public\pictures\sample pictures\
\public\videos\sample videos\
\tor browser\
\$recycle.bin
\$windows.~bt
\$windows.~ws
\boot
\intel
\msocache
\perflogs
\program files (x86)
\program files
\programdata
\recovery
\recycled
\recycler
\system volume information
\windows.old
\windows10upgrade
\windows
\winnt
When the encryption process is complete the victim files are renamed with the .skvtb extension. Like the previous versions the hackers create ransomware notes (which are different depending on the version and the regional language) and point the users into accessing specific payment gateways located on the TOR network. The current address is located at: gcxdedv2a1zs81w2j23.e263g2eb53wgzvgk.onion/U261X574T67287Bs
When accessed through the specialist Tor browser the site reveals to be a template-based generic template. It reads the following message:
Your documents, photos, databases and other important files have been encrypted!
WARNING! Any attempts to restore your files with the third-party software will be fatal for your files! WARNING!
To decrypt your files you need to buy the special software – “My Decryptor”
All transactions should be performed via BITCOIN network.
Within 5 days you can purchase this product at a special price: BTC 0.200 (~ $1456)
After 5 days the price of this product will increase up to: BTC 0.400 (~ $2912)
The special price is available:
05 . 00:01:58
Create a Bitcoin Wallet (we recommend Blockchain.info)
2. Buy necessary amount of BitcoinsHere are our recommendations:
Buy Bitcoins with Cash or Cash Deposit
LocalBitcoins (https://localbitcoins.com/)
BitQuick (https://www.bitquick.co/)
Wall of Coins (https://wallofcoins.com/)
LibertyX (https://libertyx.com/)
Coin ATM Radar (https://coinatmradar.com/)
Bitit (https://bitit.io/)Buy Bitcoins with Bank Account or Bank Transfer
Coinbase (https://www.coinbase.com/)
BitPanda (https://www.bitpanda.com/)
GDAX (https://www.gdax.com/)
CEX.io (https://cex.io/)
Gemini (https://gemini.com/)
Bittylicious (https://bittylicious.com/)
Korbit (https://www.korbit.co.kr/)
Coinfloor (https://www.coinfloor.co.uk/)
Coinfinity (https://coinfinity.co/)
CoinCafe (https://coincafe.com/)
BTCDirect (https://btcdirect.eu/)
Paymium (https://www.paymium.com/)
Bity (https://bity.com/)
Safello (https://safello.com/)
Bitstamp (https://www.bitstamp.net/)
Kraken (https://www.kraken.com/)
CoinCorner (https://www.coincorner.com/)
Cubits (https://cubits.com/)
Bitfinex (https://www.bitfinex.com/)
Xapo (https://xapo.com/)
HappyCoins (https://www.happycoins.com/)
Poloniex (https://poloniex.com/)Buy Bitcoin with Credit/Debit Card
Coinbase (https://www.coinbase.com/)
CoinMama (https://www.coinmama.com/)
BitPanda (https://www.bitpanda.com/)
CEX.io (https://cex.io/)
Coinhouse (https://www.coinhouse.io/)Buy Bitcoins with PayPal
VirWoX (https://www.virwox.com/)
Could not find Bitcoins in your region? Try searching here:
BittyBot (https://bittybot.co/eu/)
How To Buy Bitcoins (https://howtobuybitcoins.info/)
Buy Bitcoin Worldwide (https://www.buybitcoinworldwide.com/)
Bitcoin-net.com (http://bitcoin-net.com/)3. Send BTC 0.200 to the following Bitcoin address:
1PvPJYqpFYjCxDWDcBJE1mpS2g2m3F1apX
4. Control the amount transaction at the “Payments History” panel below
5. Reload current page after the payment and get a link to download the software
Its interesting to note that the support section is done via a menu option redirecting to another page. There the victims can send messages to the victims. A free decryption is offered as an attempt to win the trust of the users. The ransomware fee is comparable to most other threats, if paid within a certain timeframe the price is lower (BTC 0.200 which amounts to $1449). It is raised double if the victims decide to postpone the payment.
As always we recommend that all users abstain from communicating with the hackers and use our full .skvtb virus removal guide below to recover their data and delete the active infections.
Remove .skvtb Virus and Restore PC
WARNING! Manual removal of the .skvtb Virus requires being familiar with system files and registries. Removing important data accidentally can lead to permanent system damage. If you don’t feel comfortable with manual instructions, download a powerful anti-malware tool that will scan your system for malware and clean it safely for you.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
.skvtb Virus – Manual Removal Steps
Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently. The steps bellow are applicable to all Windows versions.
1. Hit the WIN Key + R
2. A Run window will appear. In it, write msconfig and then press Enter
3. A Configuration box shall appear. In it Choose the tab named Boot
4. Mark Safe Boot option and then go to Network under it to tick it too
5. Apply -> OK
Remove .skvtb from Windows
Here’s a way to remove the program. This method will work regardless if you’re on Windows 10, 8, 7, Vista or XP. Simply selecting the program and pressing delete won’t work, as it’ll leave a lot of small files. That’s bad because these leftovers can linger on and cause all sorts of problems. The best way to delete a program is to uninstall it. Here’s how you can do that:
1. Hold the “Windows” button (It’s between CTRL and Alt on most keyboards) and press “R”. You’ll see a pop-up window.
2. In the textbox, type “appwiz.cpl”, then press“ Enter ”.
3. The “Programs and features” menu should now appear. It’s a list of all the programs installed on the PC. Here you can find the program, select it, and press “Uninstall“.
Remove .skvtb Virus From Your Browser
Before resetting your browser’s settings, you should know that this action will wipe out all your recorded usernames, passwords, and other types of data. Make sure to save them in some way.
- 1. Start Mozilla Firefox. In the upper right corner, click on the Open menu icon and select “Add-ons“.
2. Inside the Add-ons Manager select “Extensions“. Search the list of extensions for suspicious entries. If you find any, select them and click “Remove“.
3. Click again on the Open menu icon, then click “Options“.
4. In the Options window, under “General” tab, click “Restore to Default“.
5. Select “Search” in the left menu, mark the unknown search engine and press “Remove”.
- 1. Start Google Chrome. On the upper-right corner, there a “Customize and Control” menu icon. Click on it, then click on “Settings“.
2. Click “Extensions” in the left menu. Then click on the trash bin icon to remove the suspicious extension.
3. Again in the left menu, under Chrome, Click on “Settings“. Go under “On Startup” and set a new page.
4. Afterward, scroll down to “Search“, click on “Manage search engines“.
5. In the default search settings list, find the unknown search engine and click on “X“. Then select your search engine of choice and click “Make default“. When you are ready click “Done” button in the right bottom corner.
2. In the “Manage add-ons” window, bellow “Add-on Types“, select “Toolbars and Extensions“. If you see a suspicious toolbar, select it and click “Remove“.
3. Then again in the “Manage Add-ons” window, in “Add-on Types“, Select “Search Providers“. Chose a search engine and click “Set as default“. Select the unknown search engine and click “Remove and Close”.
4. Open the Tools menu, select “Internet Options”.
5. In the “General” tab, in “Home page”, enter your preferred page. Click “Apply” and “OK”.
Repair Windows Registry
1. Again type simultaneously the WIN Key + R key combination
2. In the box, write regedit and hit Enter
3. Type the CTRL+ F and then write the malicious name in the search type field to locate the malicious executable
4. In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys
Click for more information about Windows Registry and further repair help
