C4H ransomware

C4H is a malicious file-encrypting virus hailing from the Globeimposter ransomware family

C4H is a ransomware-type cyber infection that belongs to the infamous GlobeImposter family. Since 2018, a reduction in the persistence of this ransomware family has been observed up until May 2020 when Petrovic, Russian cybersecurity expert, grasped a virus that encrypts files using .C4H file extension and appends “Decryption INFO.html.” 

The ransomware is distributed via trojanized apps, spam emails, or pirated software like cracks. Upon infiltration, it installs Windows boot-up entries, Registry keys, and executables int the Task Manager. Furthermore, it loads an automatic encryption software, which targets non-system files on D: drive and locks them using AES and RSA encryption with the .C4H extension. As a final point, the ransomware generates a ransom note, which presses the victim to contact criminals via [email protected] or [email protected] email. 

C4H ransomware and other file-encrypting viruses are used by extortionists who seek financial profit on behalf of other people’s misfortune. Criminals engage many strategies to disseminate ransomware payloads and the most “successful” way of tricking regular users seems to be email attachments. 

Once the virus finds its place on a target system, criminals engage social engineering techniques to scare victims that the only way to decrypt files is to pay the ransom. For this purpose, C4H virus developers use false claims that running an antivirus program or attempts to self-decrypt files will end up in a permanent loss of encrypted files. 

It is not recommended to trust criminals’ promises that the C4H decryptor will immediately be provided as soon as the ransomware demand will be received. Paying the ransom poses a high risk of identity theft and other privacy-related issues. 

ENGLISH
ALL YOUR FILES AND IMPORTANT DATA ARE ENCRYPTED!

To recover data you need decryptor.
To get the decryptor you should:
Send 1 test image or text file [email protected] or [email protected].
In the letter include your personal ID (look at the beginning of this document).

We will give you the decrypted file and assign the price for decryption all files
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.
Attention!

Only [email protected] or [email protected] can decrypt your files
Do not trust anyone [email protected] or [email protected]
Do not attempt to remove the program or run the anti-virus tools
Attempts to self-decrypting files will result in the loss of your data
Decoders other users are not compatible with your data, because each user’s unique encryption key

The ransom note provides two ways to contact the virus developers, i.e. [email protected] or [email protected]. However, instead of disputes with criminals, immediate C4H removal is recommended. 

The only way to remove C4H ransomware from the system is to restart Windows into Safe Mode and run a thorough scan with a reputable anti-virus program. Once all malicious entries are removed, you can try to retrieve locked data with a free GlobeImposter decryptor or give a try for alternative recovery methods in case the first one fails. 

C4H has been detected in Spring 2020 as the newest variant of the notorious GlobeImposter ransowmare

C4H has been detected in Spring 2020 as the newest variant of the notorious GlobeImposter ransowmare

Currently, according to VirusTotal analysis, the C4H virus can successfully be detected and decontaminated by 60 AV engines out of 72. The detection rate is very high, so do not ignore pop-ups of the AV engine if it delivers one of the following warnings:

• Ransom:Win32/GlobeImposter.180910
• Trojan[Ransom]/Win32.GlobeImposter
• Generic.Ransom.GlobeImposter.9F3AF8D5
• TrojWare.Win32.Necne.AB@7l2s58
• Generic.Ransom.GlobeImposter.9F3AF8D5 (B)
• Ransom.GlobeImposter
• Troj/Ransom-EVE
• Mal_FakeGlobe, etc.

If the data on your PC has been encrypted, a ransom note created on the desktop and other folders, desktop background were changed and other signs evidence a ransomware attack, do not postpone C4H removal. Such and similar cyber infections often bear secondary payloads for trojans and spyware. Therefore, the longer you keep an intruder on the system, the higher the danger gets. 

Strategies that criminals use to spread ransomware

Our colleagues from LosVirus.es^[2] warn users about various insecurities online that can help ransomware to get inside the system. In many cases, ransomware viruses are launched as second payloads of trojans, which usually get installed after vulnerability exploits or pirated software. However, the most infamous online places where people encounter the highest risk to get a ransomware infection are email accounts (spam section), torrent websites, questionable gaming websites, or adult content (gambling, porn) websites. 

Apart from having a powerful AV engine with real-time protection enabled, there are other precautionary measures that people should render to stay away from file-encrypting and other malware:

• Manage your email with extreme carefulness. Do not rely on email messages that fall into the spam section. The biggest danger hides under messages that carry attachments or links. 
• Avoid visiting unprotected websites and secondary networks. Poorly protected third-party websites can easily be exploited by criminals and infected with malicious ransomware code. 
• Avoid visiting adult-content websites. Although there are some potentially secure porn websites^[3], clicking on shady ads positioned on those sites poses a risk of being redirected to a phishing website.

A combination of precaution and powerful anti-virus program should be enough to protect your personal information, software, identity, and money from violations. 

C4H is a file-encrypting virus that corrupts personal files and urges their owners to pay the ransom for a decryption software

C4H is a file-encrypting virus that corrupts personal files and urges their owners to pay the ransom for a decryption software

C4H ransomware elimination and data recovery guidelines

C4H ransomware removal process is implemented by both regular users and skilled users in the same way – a full scan with a professional anti-virus program is required. Manual removal is not possible in any way and any attempt to change malicious files can put the system at risk. 

Before you take any actions to remove C4H ransomware, we strongly recommend making the backups of the locked files. That’s a measure to ensure that you’ll have copies in case the virus gets removed alongside files with .c4h file extensions. For that, you can use a USB flash drive or cloud storage. 

Once ready, restart Windows into Safe Mode with networking as explained below, and launch the scanner of your AV tool. A professional tool will detect all ransomware-related entries, processes, and registries that have to be terminated together to successfully finish the C4H removal. For a full system check, we recommend using SpyHunter 5Combo Cleaner or Malwarebytes tools. 

Finally, do not forget to fix virus damage. Ransomware affects the Windows system severely and, unfortunately, AV programs cannot fix system damage. For that, use a tool like Reimage Reimage Cleaner Intego. 

Remove C4H using Safe Mode with Networking

Restart Windows into Safe Mode with Networking to terminate all malicious processes triggered by C4H ransomware.

• Windows 7 / Vista / XP
  1. Click Start → Shutdown → Restart → OK.
  2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
  3. Select Safe Mode with Networking from the list

  Windows 10 / Windows 8

  1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
  2. Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
  3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window.

• Log in to your infected account and start the browser. Download Reimage Reimage Cleaner Intego or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete C4H removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove C4H using System Restore

The System Restore function on Windows can help with the C4H removal and retrieval of encrypted data.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove C4H from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

.C4H extension files can be encrypted with the help of third-party data recovery tools or a free decryptor that has been designed for the previous versions of this cyber infection.

If your files are encrypted by C4H, you can use several methods to restore them:

Use Data Recovery Pro to retrieve some of the compromised files and documents

Files encrypted by C4H ransomware virus can be recovered with the help of third-party software. However, successful decryption is possible when a process is performed step-by-step as shown below. 

• Download Data Recovery Pro;
• Follow the steps of Data Recovery Setup and install the program on your computer;
• Launch it and scan your computer for files encrypted by C4H ransomware;
• Restore them.

Windows Previous Versions can be of use when dealing with ransomware encrypted files

This software can be used to restore some files affected by file-encrypting malware. However, this option is only available when a System Restore feature was enabled on the system before. 

• Find an encrypted file you need to restore and right-click on it;
• Select “Properties” and go to “Previous versions” tab;
• Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Take advantage of the Shadow Explorer

In case C4H ransomware fails to remove Volume Shadow Copies of the data stored on the system, most of the files can be retrieved by following these steps:

• Download Shadow Explorer (http://shadowexplorer.com/);
• Follow a Shadow Explorer Setup Wizard and install this application on your computer;
• Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
• Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

C4H ransomware decryption software hasn’t been developed yet

Despite the fact that there’s no official C4H decrypter, you can give a free GlobeImposter decryption software a try since both viruses stem from the same family. 

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from C4H and other ransomwares, use a reputable anti-spyware, such as Reimage Reimage Cleaner Intego, SpyHunter 5Combo Cleaner or Malwarebytes