Popcorn Time Ransomware
Written by Tomas Meskauskas on
Popcorn Time ransomware removal instructions
What is Popcorn Time?
Popcorn Time is a ransomware-type virus discovered by security researcher MalwareHunterTeam. Following infiltration, Popcorn Time encrypts various data stored on the infected computer. During encryption, this ransomware appends the names of encrypted files with the ".kok" or ".filock" extension. Following successful encryption, Popcorn Time opens a pop-up window and creates an HTML file ("restore_your_files.html"), placing it on the desktop. Both contain ransom-demand messages.
The messages inform victims of the encryption. The key is stored on a remote server owned by Popcorn Time's developers. Therefore, victims are encouraged to pay a ransom of 1 Bitcoin (approximately $750) to receive it. If the ransom is not paid within seven days, the key is permanently deleted and decryption becomes impossible. Popcorn Time has one feature making it unusual amongst ransomware-type viruses: it allows victims to decrypt their files free of charge using an affiliate link provided. Victims must promote this link to other users so that their computers are infected. If at least two of these other people pay the ransom, files are decrypted free of charge. The ransom demand message states that Popcorn Time's developers are students from Siria. They claim that the reason why they make these ransom demands is hunger in Syria. All payments are supposedly used to help refugees and impoverished people of this nation. Be aware, however, that these claims are false - Popcorn Time's developers are cyber criminals who simply aim to generate revenue. In addition, research reveals that cyber criminals often ignore victims, despite submitted payments. Therefore, these people should never be trusted - never attempt to contact them or pay any ransom. There is a high probability that you will be scammed. There are currently no tools capable of restoring files encrypted by Popcorn Time. The problem can only be resolved by restoring your files/system from a backup.
Screenshot of a message encouraging users to pay a ransom to decrypt their compromised data:
There are dozens of ransomware-type viruses similar to Popcorn Time including Sage, GoldenEye, and *.osiris - these are just some examples from many. As with Popcorn Time, other ransomware-type viruses also encrypt files and make ransom demands. The encryption algorithm (symmetric/asymmetric) and cost of decryption are the only major differences. These viruses are often distributed using third party software download sources (peer-to-peer networks, freeware download websites, free file hosting websites, etc.), malicious files attached to spam emails, fake software update tools, and trojans. Therefore, you should never download software from unofficial sources or open files received from suspicious emails. In addition, keep your installed applications up-to-date - cyber criminals are capable of exploiting software bugs/flaws to infect the system. Never use a third party update tool - it might be fake and can result in high-risk computer infections. Always use a legitimate anti-virus/anti-spyware suite. The key to computer safety is caution.
Screenshot of Popcorn Time HTML file ("restore_your_files.html"):
Text presented within Popcorn Time HTML file:
We are sorry to say that your computer and your files have been encrypted, but wait, don’t worry. There is a way that can restore your computer and all of your files. When countdown ends your files will be lost forever.
You must send at least [AMOUNT] Bitcoin to our wallet and your will get your files back.
Your personal unique ID: -
Send [AMOUNT] BTC to this address: 1LEiPgvh6S9VEXWV2dZTytSRd7e9B1bWt3
We are sorry to say that your computer and your files have been encrypted,
but wait, don’t worry. There is a way that you can restore your computer and all of your files.
Your personal unique ID: -
You must send at least - Bitcoin to address - to get your files back
Warning! ! ! If you will not pay for the next 7 days, the decryption key will be deleted and your files will be lost forever.
Restoring your files - The fast and easy way
To get your files fast, please transfer - Bitcoin, to our wallet -. When we will get the money we will immediately give your your private decryption key. Payment should be confirmed in about 2 hours after payment made.
Restoring your files - The nasty way
Send the link - below to other people, if two or more people will install this files and pay, we will decrypt your files for free.
What we did?
We had encrypted all of your important images, document, videos and all other files on your computer. We used a very strong encryption algorithm that used by all governments all over the world. We store your personal decryption code to your files on our servers and we are the only ones that can decrypt your files. Please don’t try to be smart, anything other than payment will cause damage to your files and the files will be lost forever! ! ! If you will not pay for the next 7 days, the decryption key will be deleted and your files will be lost forever.
What we do that?
We are a group of computer science students from Syria, as you probably know Syria is having bad time for the last five years. Since 2011 we have more the half million people died and over 5 million refugees. Each member of our team has lost a dear from his family. I personally have lost both my parents and my little sister in 2015. The sad part is that the world remained silent and no one helping us so we decided to take an action.
How to buy Bitcoins?
If you aren’t familiar with Bitcoin and don’t know what is it. Please visit the official Bitcoin website (https://bitcoin.org/en/getting-started), follow the steps and you’ll get your Bitcoins. To understand more you can check also on the FAQ page (https://bitcoin.org/en/faq). Please check this website (https://coinatmradar.com) where you can find Bitcoin ATM all over the world.
List of encrypted files on your computer -
Screenshot of files encrypted by Popcorn Time (".kok" extension):
Screenshot of files encrypted by Popcorn Time (".filock" extension):
Popcorn Time ransomware removal:
Quick menu: Quick solution to remove Popcorn Time virus
- What is Popcorn Time?
- STEP 1. Popcorn Time virus removal using safe mode with networking.
- STEP 2. Popcorn Time ransomware removal using System Restore.
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.
Video showing how to start Windows 8 in "Safe Mode with Networking":
Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.
Video showing how to start Windows 10 in "Safe Mode with Networking":
Log in to the account infected with the Popcorn Time virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.
If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.
Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":
1. During your computer start process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.
2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.
3. Next, type this line: rstrui.exe and press ENTER.
4. In the opened window, click "Next".
5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the Popcorn Time ransomware virus infiltrating your PC).
6. In the opened window, click "Yes".
7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining Popcorn Time ransomware files.
To restore individual files encrypted by this ransomware, try using Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of Popcorn Time are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.
To restore a file, right-click over it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.
If you cannot start your computer in Safe Mode with Networking (or with Command Prompt), boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.
To protect your computer from file encryption ransomware such as this, use reputable antivirus and anti-spyware programs. As an extra protection method, you can use programs called HitmanPro.Alert and Malwarebytes Anti-Ransomware, which artificially implant group policy objects into the registry to block rogue programs such as Popcorn Time ransomware.
HitmanPro.Alert CryptoGuard - detects encryption of files and neutralises any attempts without need for user-intervention:
Malwarebytes Anti-Ransomware Beta uses advanced proactive technology that monitors ransomware activity and terminates it immediately - before reaching users' files:
- The best way to avoid damage from ransomware infections is to maintain regular up-to-date backups. More information on online backup solutions and data recovery software Here.
Other tools known to remove Popcorn Time ransomware: