Dever Ransomware Removal Guide

You have to protect your Windows operating system at all times. If you fail to do that, Dever Ransomware could slither in without you realizing it. This infection is most likely to use spam emails and also bundled downloaders to slither in. Note that these methods are employed by most ransomware infections, and so if you do not become more cautious about the spam emails and bundled downloaders you interact with in the future, you could face new infections. The launcher of the ransomware is meant to be concealed, and once it is executed, it can start encrypting files almost instantly. Unfortunately, it does not look like victims have any time to figure out what has happened and remove the infection before files are encrypted. After that, even if you delete Dever Ransomware successfully, your files will remain corrupted. Hopefully, we can offer you effective solutions to get your files back, and if you are interested in this, you should continue reading.

Dever Ransomware is a clone of Phobos Ransomware, Bitx Ransomware, Nvram Ransomware, and many other infections that belong to the Crysis/Dharma Ransomware family. Both names are interchangeable, and different malware scanners might identify the threat by either of them. The Dever version adds the “.id[…].[lizethroyal@aol.com].Dever” extension to the files it corrupts. Note that the “[…]” part represents a unique code that is assigned to every unique victim. Next to the corrupted files, the infection should drop a file named “info.txt,” and you can open it safely. The message inside reads: “!!!All of your files are encrypted!!!To decrypt them send e-mail to this address: lizethroyal@aol.com.” The message also presents an alternative email address – maitlandtiffaney@aol.com – that, allegedly, must be used if no response is received from the first email address within 24 hours. Dever Ransomware also employs a file named “Info.hta” to introduce victims to a more extensive message. This message is delivered via a window that is launched as soon as files are encrypted, and, for most victims, this will be the first sign of infection.

The Dever Ransomware delivered using the Info.hta file informs that files were encrypted due to security issues. Well, your system does have security issues because ransomware has managed to slither in. The fact that your files are encrypted is not surprising either because that is how most ransomware infections work. This message also presents the two email addresses, and it instructs to send the unique ID code along with several encrypted files to them. Once the attackers receive your message, they should decrypt the files and send them back to you to prove that decryption is possible. This is how they expect to convince you to pay a ransom. We do not know how much the attackers would demand from you, but it is clear that the ransom would have to be paid in Bitcoins, a popular crypto-currency. The message warns that renaming files is dangerous. It also warns that victims should not trust third-party decryption software because, allegedly, that would lead to permanent data loss and also scams. It is true that schemers could offer fake Dever Ransomware decryptors, but we know for a fact that legitimate Dharma and Crysis decryptors created by malware experts exist. Hopefully, they can help you get your files decrypted for free.

If you can use Crysis and Dharma decryptors to restore the files corrupted by Dever Ransomware, do so after you delete the infection. If you cannot use these tools, use backups (stored online or on external drives) to replace the corrupted files. If you do not have backups, you appear to be out of options, unfortunately. Even if that is the case, we do not recommend contacting cybercriminals and paying the ransom because that is unlikely to help you achieve anything. After you remove Dever Ransomware and secure your operating system against the attacks of other threats, remember that all important, irreplaceable files must be backed up outside the computer. As for the removal, even if you can successfully follow the instructions below, we recommend using anti-malware software. It will ensure that there are no files or registry entries left behind, and it will also secure your system against new attacks.

How to delete Dever Ransomware

1. Right-click and Delete the ransom note file called info.txt.
2. Simultaneously tap Win and E keys to access Windows Explorer.
3. Enter the following paths into the quick access field and right-click and Delete a file named Info.hta:
   • %HOMEDRIVE%
   • %USERPROFILE%\Desktop\
4. Enter the following paths into the quick access field and right-click and Delete a {random name}.exefile:
   • %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\
   • %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\
   • %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
   • %LOCALAPPDATA%
5. Simultaneously tap Win and R keys to access the Run dialog box.
6. Enter regedit into the box and click OK to access Registry Editor.
7. Go to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
8. Right-click and Delete a value with a random name that is linked to the {random name}.exe file.
9. Go to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and repeat step 8.
10. Empty Recycle Bin and then quickly employ a malware scanner to check for malware leftovers.