By now all of we have heard of the global ransomware attack. It has created a lot of confusions in the mind of computer users. Over 60,000 companies of more than 100 countries have become the victim of this malware. So how this ransomware works and what are the possible solutions……
The term ‘RANSOMWARE’ itself gives the idea of its nature. It is somehow related to some kind of ransom. Yes, exactly it is. It is a type of malware which gets into your computer and locks down all the files. Afterwards it seeks for money from the user in order to get access to the locked files. The recent ransomwares are smarter than ever. It just not only locks down the files rather it encrypts the files which makes it really impossible to crack open the locked files. As a result the users do not have any other way to regain access to their locked files but to pay the money and get the decryption code.
So how does it get into your computer..???
The easiest to get into someone’s computer is through attachments of spam emails or by entering into any unknown link. The extension of these files are different than the conventional files. Usually users turn off the file extensions, so they can not know what kind of file they are clicking on. The virus file pretends like a doc file or any other text file. But if you turn on the file extension of your computer you will see that the file extensions are different. As you click on the file all your data start encrypting and eventually asking you for ransom.
In case if you are interested these are the possible real extensions of ransomware files……( .ecc, .ezz, .exx, .zzz, .xyz, .aaa, .abc, .ccc, .vvv, .xxx, .ttt, .micro, .crypto, _crypt, .crinf, .r5a, .XRNT, .XTBL, .crypt, .R16M01D05, .pzdc, .good, .LOL!, .OMG!, .RDM, .RRK, .encryptedRSA, .crjoker, .EnCiPhErEd, .LeChiffre, .keybtc@inbox_com, .0x0, .bleep, .1999, .vault, .HA3, .toxcrypt, .magic, .SUPERCRYPT, .CTBL, .CTB2, .locky or 6-7 length extension consisting of random characters.)
The recent ransomware which is causing mass loss is known as #WannaCry. This asks for opening a javascript file in your email in the format (.js). So it is now recommended not to open any unknown attachments sent through emails.
How to recover a ransomware infected computer……..?
Well, for now there is no way to open the encrypted files. As I mentioned earlier you have to pay through bitcoins in order to get the decryption code.
Safety measures :
1. Keep your Operating System up to date.
2. Keep you Anti-Virus up to date.
3. Create back up for the most important files either in a secured hard drive or in a secured cloud storage.
4. Do not open any email attachments from unknown senders.
5. Be careful while opening and downloading from any unknowing third party websites.
Stay safe………. 
How to remove TASKSCHE.EXE manually?
- Check all shortcuts of your browsers on your desktop, taskbar and in the Start menu. Right click on your shortcut and change it’s properties.
http://TASKSCHE.EXE
You can see TASKSCHE.EXE at the end of shortcut target (command line). Remove it and save changes.
In addition, check this command line for fake browser’s trick.
For example, if a shortcut points to Google Chrome, it must have the path:
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe.
Fake browser may be: …\Appdata\Roaming\HPReyos\ReyosStarter3.exe.
Also the file name may be: “chromium.exe” instead of chrome.exe.
- Investigate the list of installed programs and uninstall all unknown recently installed programs.
check installed programs to uninstall
- Open Task Manager and close all processes, related to TASKSCHE.EXE in their description. Discover the directories where such processes start. Search for random or strange file names.
Remove TASKSCHE.EXE virus from running processes
Remove TASKSCHE.EXE virus from running processes
- Inspect the Windows services. Press Win+R, type in: services.msc and press OK.
Remove TASKSCHE.EXE virus from Windows services
Remove TASKSCHE.EXE virus from Windows services
Disable the services with random names or contains TASKSCHE.EXE in it’s name or description.
- After that press Win+R, type in: taskschd.msc and press OK to open Windows Task Scheduler.
Remove TASKSCHE.EXE from scheduled task list.
Delete any task related to TASKSCHE.EXE. Disable unknown tasks with random names.
- Clear the Windows registry from TASKSCHE.EXE virus.
Press Win+R, type in: regedit.exe and press OK.
Remove TASKSCHE.EXE virus from Windows registry
Remove TASKSCHE.EXE virus from Windows registry
Find and delete all keys/values contains TASKSCHE.EXE.
- Remove TASKSCHE.EXE from Google Chrome.
Remove TASKSCHE.EXE Virus from Chrome Extensions - Remove TASKSCHE.EXE from Internet Explorer.
Set Internet Explorer Homepage
Set Internet Explorer Homepage
- Remove TASKSCHE.EXE from Mozilla Firefox.
Change Firefox Home Page
Change Firefox Home Page
- And at the end, clear your basket, temporal files, browser’s cache.
But if you miss any of these steps and only one part of virus remains – it will come back again immediately or after reboot.
These Complete Shared from WhatsApp Messages. All the Credit Goes to Respective Oweners
