Smrss32 Ransomware Virus (Removal Steps and Protection Updates)

The Smrss32 ransomware is a new strain of the Crypto family of ransomware, learn how to remove the infection from your computer by reading this guide.

Smrss32 Ransomware Description

The first samples of the Smrss32 ransomware were detected in early August this year. The name of the threat has been received by one of the files that has beared the malware, namely Smrss32.exe.

The Smrss32 Ransomware has been identified to be a variant of the Crypto family of ransomware viruses that target Microsoft Windows computer users. The malware shows typical infection behavior, once it has compromised a machine it encrypts target user files with a strong cipher, changes the file name extensions to “.encrypted” and displays a ransom note that blackmails the victims for money to restore their files.

The threat also has the ability to incur damage against mounted network shares when the appropriate privileges have been granted. The AES cipher is used and the private key that is used to regain the files is stored on the remote malicious C&C server. According to the security research some of the following types of files are affected:

.18113 .3gp2 .3gpp .8pbs .acs2 .acsm .aifc .aiff .albm .amff .ascx .asmx .aspx .azw3 .back .backup .backupdb .bank .bdmv .blob .bndl .book .bsdl .cache .calb .cals .cctor .cdda .cdr3 .cdr4 .cdr5 .cdr6 .cdrw .ciff .class .clipflair .clpi .conf .config .contact .craw .crtr .crtx .ctor .ctuxa .d3dbsp .data .dazip .ddat .ddoc .ddrw .desc .divx .djvu .dmsk .dnax .docb .docm .docx .dotm .dotx .dsp2 .dump .encrypted .epfs .epub .exif .fh10 .flac .fmpp .forge .fsproj .gray .grey .group .gtif .gzip .h264 .hkdb .hplg .html .hvpl .ibank .icns .icxs .ilbm .im30 .incpas .indd .indt .ipsw .itc2 .itdb .ithmb .iw44 .java .jfif .jhtml .jnlp .jpeg .json .kdbx .kext .keychain .keychain .kpdx .lang .latex .lay6 .layout .ldif .litemod .log1 .log2 .log3 .log4 .log5 .log6 .log7 .log8 .log9 .m2ts .m3url .macp .maff .mcmeta .mdbackup .mddata .mdmp .menu .midi .mobi .moneywell .mp2v .mpeg .mpga .mpls .mpnt .mpqge .mpv2 .mrwref .ms11 .msmessagestore .mspx .mswmm .oeaccount .opus .otpsc .pack .pages .paint .phtml .pict .pj64 .pkpass .pntg .potm .potx .ppam .ppsm .ppsx .pptm .pptx .ppxps .psafe3 .psmdoc .pspimage .qcow2 .qdat .qzip .rels .rgss3a .rmvb .rofl .rppm .rtsp .s3db .sas7bcat .sas7bdat .sas7bndx .sas7bpgm .sas7bvew .sidd .sidn .sitx .skin .sldm .sldx .smil .sqlitedb .svg2 .svgz .targa .temp .test .text .tiff .tmpl .torrent .trace .tt10 .uns2 .urls .user .vcmf .vfs0 .view .vmdk .wallet .wbmp .webm .webp .wlmp .wotreplay .wrml .xbel .xfdl .xhtml .xlam .xlsb .xlsm .xlsx .xltm .xltx .xspf .xvid .ycbcra .ychat .yenc .zdct .zhtml .zipx .ztmp

The total number of 6674 different file extensions are affected. The interesting thing is that this threat does not affect system-specific files that could prevent the operating system from functioning properly. This includes files located in the following locations: AppData, Application Data, Boot, Games, Program Files, Program Files (x86), Program Data, Sample Music, Sample Pictures, System Volume Information, Temp, Windows, cache, thumbs.db, tmp and winnt.

The ransom note is created as an image file – _HOW_TO_Decrypt.bmp, a shortcut to which is created in every folder with an affected file. The hackers do not specify the ransom sum in the note and ask the victims to contact them via the given email address. Reports indicate that the requested ransom sum from the victims is 1 Bitcoin which is about 600 US dollars.

The ransomware also injects its code deep into the system by infecting directly the Explorer.exe and svchost.exe processeses. It also modifies the Windows registry and disables the Automatic Repair feature. The Smrss32 ransomware also sends private information about the user to the remote control servers. In addition it may also lead into installing other malware that could lead to loss of more data.

Smrss32 Ransomware Distribution

The identified malware infections have been the result of compromised RDP connections. The hackers have manually installed the Ransomware by exploiting weak protocol settings and easy to guess credentials. Other intrusion methods include spam email campaigns containing infected binaries and malicious links. The Sundown Exploit Kit may have been used to distribute this malware threat, click here to learn more about it.

Upon execution the encryption process is started.

Smrss32 Ransomware Removal

For a faster solution, you can run a scan with an advanced malware removal tool and delete Smrss32 completely with a few mouse clicks.

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

1) Hit WIN Key + R

2) A Run window will appear. In it, write “msconfig” and then press Enter
3) A Configuration box shall appear. In it Choose the tab named “Boot”
4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking”

STEP II: Show Hidden Files

1) Open My Computer/This PC
2) Windows 7
– Click on “Organize” button
– Select “Folder and search options”
– Select the “View” tab
– Go under “Hidden files and folders” and mark “Show hidden files and folders” option

3) Windows 8/ 10

– Open “View” tab
– Mark “Hidden items” option



4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

1) Hit the following key combination: CTRL+SHIFT+ESC
2) Get over to “Processes”
3) When you find suspicious process right click on it and select “Open File Location”
4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”
5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely Smrss32 Ransomware Using SpyHunter Anti-Malware Tool

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

1) Again type simultaneously the Windows Button + R key combination
2) In the box, write “regedit”(without the inverted commas) and hit Enter
3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

1) Use present backups
2) Restore your personal files using File History
– Hit WIN Key
– Type “restore your files” in the search box
– Select “Restore your files with File History”
– Choose a folder or type the name of the file in the search bar



– Hit the “Restore” button

3) Using System Restore Point

– Hit WIN Key
– Select “Open System Restore” and follow the steps

STEP VII: Preventive Security Measures

1) Enable and properly configure your Firewall.
2) Install and maintain reliable anti-malware software.
3) Secure your web browser.
4) Check regularly for available software updates and apply them.
5) Disable macros in Office documents.
6) Use strong passwords.
7) Don’t open attachments or click on links unless you’re certain they’re safe.
8) Backup regularly your data.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter