How to remove Ech0raix (QNAPCrypt) Ransomware and decrypt .encrypt files

What is Ech0raix (QNAPCrypt) Ransomware

Ech0raix a.k.a. QNAPCrypt is a type of malware classified as ransomware that uses uncommon methods of penetrating and encrypting user’s data. Besides typical system infection, it also spreads across physical network appliances like NAS Synology or QNAP that are meant to ensure high-quality internet connections. After sneaking into the system, intruders get access to your “admin” account by matching the password (if set) and start encrypting vulnerable files as a result. Unlike other ransomware, it infiltrates network devices by violating their settings which therefore leads to its malfunction. Consecutively, users are compelled to update their software or ask for professional help. Of course, likewise Medusalocker or Ouroboros, it involves AES-256 algorithms to lock down the data like images, videos, office documents, and others by assigning .encrypt extension to each file so that it looks like this 1.mp4.encrypt. Once done, users are no longer allowed to access their data and forced to proceed with the ransom note that is created after the encryption.

In this note, extortionists notify that your data was locked and can be deciphered by purchasing a unique decrypting key that costs 0.05 BTC (=500$). The payment has to be done only via the Tor browser through the attached link where you should paste their bitcoin address. Unfortunately, most of the time, frauds stay aside from keeping their promises meaning that there is no guarantee that your files will be brought back. In addition, depending on the complexity of the encryption, some files are impossible to unblock. However, we will show how to delete this dreadful application from your computer and maybe decrypt files in this article.

ECh0raix Ransomware (ransom note)

ECh0raix Ransomware (chat)

How Ech0raix (QNAPCrypt) Ransomware infected your computer

As mentioned above, Ech0raix is quite unusual and uses additional distribution channels besides traditional ones. The developers neatly decided to abuse unsafe and publicly available NAS devices connected directly to the Internet. This allows them to manage your system remotely and ingrain different infections without your consent. To secure your connection, developers strongly recommend enabling the firewall, using VPN and allowing only services to use public ports when needed. Besides that, ransomware can be distributed via more conventional ways like e-mail spams, Trojans, fake updates, suspicious downloads, and others. For instance, e-mail spams are used to spread messages with malicious files attached to them. Thus, swindlers pretend themselves as legitimate services to push gullible users into downloading these files that usually contain Trojans in them. Trojans themselves are designed to cause so-called malware chains. Once infected, it starts installing different sorts of programs like ransomware that can put your privacy under a threat. In addition, you have to be cautious when downloading or clicking on something from the web because fake flash player updates or repacked software can also become a reason for unknown infiltrations. We have prepared a bunch of tools that will help you remedy Ech0raix ransomware from your computer and possibly unlock the encrypted data.

1. Download Ech0raix Ransomware Removal Tool
2. Get decryption tool for .encrypt files
3. Recover encrypted files with Stellar Data Recovery Professional
4. Restore encrypted files with Windows Previous Versions
5. Restore files with Shadow Explorer
6. How to protect from threats like Ech0raix Ransomware

Ech0raix Ransomware files:


{randomfilename}.exe
ELF-file
README_FOR_DECRYPT.txt

Ech0raix Ransomware registry keys:

no information

How to decrypt and restore .encrypt files

Use automated decryptors

Download Ech0raix Decoder

Use following tool from BloodDolly called Ech0raix Decoder, that can decrypt .encrypt files. Download it here:

There is no purpose to pay the ransom because there is no guarantee you will receive the key, but you will put your bank credentials at risk.

Dr.Web Rescue Pack

Famous antivirus vendor Dr. Web provides free decryption service for the owners of its products: Dr.Web Security Space or Dr.Web Enterprise Security Suite. Other users can ask for help in the decryption of .encrypt files by uploading samples to Dr. Web Ransomware Decryption Service. Analyzing of files will be performed free of charge and if files are decryptable, all you need to do is purchase a 2-year license of Dr.Web Security Space worth $120 or less. Otherwise, you don’t have to pay.

If you are infected with Ech0raix Ransomware and removed it from your computer you can try to decrypt your files. Antivirus vendors and individuals create free decryptors for some crypto-lockers. To attempt to decrypt them manually you can do the following:

Use Stellar Data Recovery Professional to restore .encrypt files

1. Download Stellar Data Recovery Professional.
2. Click Recover Data button.
3. Select type of files you want to restore and click Next button.
4. Choose location where you would like to restore files from and click Scan button.
5. Preview found files, choose ones you will restore and click Recover.

Using Windows Previous Versions option:

1. Right-click on infected file and choose Properties.
2. Select Previous Versions tab.
3. Choose particular version of the file and click Copy.
4. To restore the selected file and replace the existing one, click on the Restore button.
5. In case there is no items in the list choose alternative method.

Using Shadow Explorer:

1. Download Shadow Explorer program.
2. Run it and you will see screen listing of all the drives and the dates that shadow copy was created.
3. Select the drive and date that you want to restore from.
4. Right-click on a folder name and select Export.
5. In case there are no other dates in the list, choose alternative method.

If you are using Dropbox:

1. Login to the DropBox website and go to the folder that contains encrypted files.
2. Right-click on the encrypted file and select Previous Versions.
3. Select the version of the file you wish to restore and click on the Restore button.

How to protect computer from viruses, like Ech0raix Ransomware, in future

1. Get special anti-ransomware software

Use ZoneAlarm Anti-Ransomware

ZoneAlarm Anti-Ransomware Dashboard

ZoneAlarm Anti-Ransomware Alert

ZoneAlarm Anti-Ransomware Blocked

Famous antivirus brand ZoneAlarm by Check Point released a comprehensive tool, that will help you with active anti-ransomware protection, as an additional shield to your current protection. The tool provides Zero-Day protection against ransomware and allows you to recover files. ZoneAlarm Anti-Ransomware is compatible with all other antiviruses, firewalls, and security software except ZoneAlarm Extreme (already shipped with ZoneAlarm Anti-Ransomware) or Check Point Endpoint products. The killer features of this application are: automatic file recovery, overwrite protection that instantly and automatically recovers any encrypted files, file protection that detects and blocks even unknown encryptors.

2. Back up your files

As an additional way to save your files, we recommend online backup. Local storages, such as hard drives, SSDs, flash drives or remote network storages can be instantly infected by the virus once plugged in or connected to. Ech0raix Ransomware uses some techniques to exploit this. One of the best services and programs for easy automatic online backup is iDrive. It has the most profitable terms and simple interface. You can read more about iDrive cloud backup and storage here.

3. Do not open spam e-mails and protect your mailbox

Malicious attachments to spam or phishing e-mails is most popular method of ransomware distribution. Using spam filters and creating anti-spam rules is good practice. One of the world leaders in anti-spam protection is MailWasher Pro. It works with various desktop applications, and provides very high level of anti-spam protection.