How to Remove the Purge Ransomware Virus and Decrypt .Purge Files

Purge ransomware is the newest cyber-security threat. It’s a virus that infects the computer and finds important files and encrypts them with the strong AES-256 algorithm. The encryption renders the files useless until their decryption. The ransomware adds the files extension .purge at the end of locked files. The virus is especially nasty because it can break the locked files and make them useless. You can learn more about it and how you can remove it in the article bellow. Avoid paying the ransom before you’ve familiarized yourself completely with its specifics.

Purge Ransomware – Infection Through Malicious Emails

Purge uses the most common way of distributing ransomware – the email spam. Crooks launch spam campaign with emails, containing infected attachments or malicious URLs. These emails are often masked to look like they were sent from big name corporations, like banks, Microsoft, PayPal, and others. When the user makes the mistake of clicking on these infected connections, they’ll most likely get infected.

Purge ransomware – More details about the Virus

Once Purge gets into your computer, it’s going to drop its payload, often in the following system folders:

C:\ Windows\ Temp
C:\ Windows
C:\ User\[Windows username]\ AppData\ Local
C:\ Users\ [ Windows username]\ Appdata\ Roaming
C:\ Users\[ Windows username]\ Appdata

Purge’s files are often named in such a way as to avoid suspicion. They look like any other system file in those folders.
After this process finishes, Purge is going to make changes to the Windows Registry Editor. It’ll modify the Run and RunOnce keys. That will make the ransomware start on Window’s boot-up. These are the locations of the keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

The Purge will then search for a particular file type to encrypt. Files like videos, pictures, audio files (music, audiobooks, podcasts), documents. All of the encrypted files will have the .purge extension.
The ransomware note of the Purge virus is posted bellow:

YOUR FILES HAVE BEEN ENCRYPTED!
You personal ID {PID}
Your files have been encrypted with a powerfull strain of a virus called ransomware.
Your files are encrypted using RSA encryption, the same standard used by the military and banks. It is currently impossible to decrypt files encrypted with rsa encryption.
Lucky for you, we can help. We are willing to sell you a decryptor UNIQUELY made for your computer (meaning someone else’s decryptor will not work for you). Once you pay a small fee, we will instantly send you the software/info neccessary to decrypt all your files, quickly and easily.
To get in touch with us email us at [email protected] your email write your personal ID (its located at the up of the page, it is a string of random characters). Once we receive your personal ID, we will send you payment instructions.
As proof we can decrypt you files, we may decrypt one small file for the test.
If you dont get answer from [email protected] in 10 hours
Register here: http://bitmsg.me (online sending message service Bitmessage)
Write to address BM-2cUrKsazEKiamN9cZ17xQq9c5JpRpokca5 with you email and personal ID
When you payment will bee confirmed, You will get decrypter of files on you computer.
After you run decrypter software, all you files will be decrypted and restored.
IMPORTANT!
Do not try restore files without our help; this is useless and you may lose data permanently
Decrypters of others clients are unique and work only on PC with they personal ID.
We can not keep your decryption keys forever, meaning after one week after you have been infected, if you have not paid, we will not be able to decrypt your files. Email us as soon as you see this message; we know exactly when everyone has been encrypted and the longer you wait, the higher the payment gets.

The virus also has a nasty trick up its sleeve. It uses a technology called Vector (IV), which can damage files beyond repair if the user tries to decrypt or temper with them.

Purge Ransomware Removal

For a faster solution, you can run a scan with an advanced malware removal tool and delete Purge completely with a few mouse clicks.

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

1) Hit WIN Key + R

2) A Run window will appear. In it, write “msconfig” and then press Enter
3) A Configuration box shall appear. In it Choose the tab named “Boot”
4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking”

STEP II: Show Hidden Files

1) Open My Computer/This PC
2) Windows 7
– Click on “Organize” button
– Select “Folder and search options”
– Select the “View” tab
– Go under “Hidden files and folders” and mark “Show hidden files and folders” option

3) Windows 8/ 10

– Open “View” tab
– Mark “Hidden items” option



4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

1) Hit the following key combination: CTRL+SHIFT+ESC
2) Get over to “Processes”
3) When you find suspicious process right click on it and select “Open File Location”
4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”
5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely Purge Ransomware Using SpyHunter Anti-Malware Tool

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

1) Again type simultaneously the Windows Button + R key combination
2) In the box, write “regedit”(without the inverted commas) and hit Enter
3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

1) Use present backups
2) Restore your personal files using File History
– Hit WIN Key
– Type “restore your files” in the search box
– Select “Restore your files with File History”
– Choose a folder or type the name of the file in the search bar



– Hit the “Restore” button

3) Using System Restore Point

– Hit WIN Key
– Select “Open System Restore” and follow the steps

STEP VII: Preventive Security Measures

1) Enable and properly configure your Firewall.
2) Install and maintain reliable anti-malware software.
3) Secure your web browser.
4) Check regularly for available software updates and apply them.
5) Disable macros in Office documents.
6) Use strong passwords.
7) Don’t open attachments or click on links unless you’re certain they’re safe.
8) Backup regularly your data.