How to remove SERVER Ransomware (Virus Removal Guide)

If your documents are encrypted with a [32_random_characters].SERVER extension, then your PC is infected with the CryptoMix ransomware.

CryptoMix is a file-encrypting ransomware, which encrypts the personal documents found on victim’s computer using RSA-2048 key (AES CBC 256-bit encryption algorithm), then displays a message which offers to decrypt the data if a payment of about 1 Bitcoin is made. The instructions are placed on the victims desktop in the _HELP_INSTRUCTION.TXT file.



We cannot help your recover your files, and we recommend that you use ShadowExplorer or (free) file recovery software to restore your documents. This guide was written to help you remove the infection itself, and if a 100% proven method to recover the encrypted files is found we will update this guide.

There is no decryption tool available for the SERVER ransomware. However, you can try to search these webpages for updates:
  • https://id-ransomware.malwarehunterteam.com
  • https://decrypter.emsisoft.com/
  • https://noransom.kaspersky.com/
  • https://www.avast.com/ransomware-decryption-tools

  • . How did the SERVER ransomware get on my computer?
  • 2. What is SERVER Ransomware?
  • 3. Is my computer infected with *.SERVER extension?
  • 4. Is it possible to decrypt files encrypted by *.SERVER extension?


1. How did the SERVER ransomware get on my computer?

The SERVER ransomware is distributed via spam email containing infected attachments or links to malicious websites. Cyber-criminals spam out an email, with forged header information, tricking you into believing that it is from a shipping company like DHL or FedEx. The email tells you that they tried to deliver a package to you, but failed for some reason. Sometimes the emails claim to be notifications of a shipment you have made. Either way, you can’t resist being curious as to what the email is referring to – and open the attached file (or click on a link embedded inside the email). And with that, your computer is infected with the CryptoMix SERVER ransomware.




2. What is SERVER ransomware?

  • Ransomware family: CryptoMix Ransomware
  • Added Extensions: SERVER
  • Ransomware note: _HELP_INSTRUCTION.TXT
  • Emails Associated with the SERVER Ransomware: serverup@keemail.meserverup@protonmail.comserverup1@yandex.com
    serverup3@yandex.com
    ann.c@iname.com
  • Ransom: From 0.5 Bitcoins to 1 Bitcoin
The SERVER ransomware restricts access to data by encrypting files. It then attempts to extort money from victims by asking for “ransom”, in form of Bitcoin cryptocurrency, in exchange for access to data.
The SERVER ransomware targets all versions of Windows including Windows 7, Windows 8.1 and Windows 10. This infection is notable due to how it encrypts the user’s files – namely, it uses AES-265 and RSA encryption method – in order to ensure that the affected user has no choice but to purchase the private key.
When the SERVER ransomware is first installed on your computer it will create a random named executable in the %AppData% or %LocalAppData% folder. This executable will be launched and begin to scan all the drive letters on your computer for data files to encrypt.
SERVER ransomware searches for files with certain file extensions to encrypt. The files it encrypts include important productivity documents and files such as .doc, .docx, .xls, .pdf, among others. When these files are detected, this infection will change the extension to .SERVER, so they are no longer able to be opened.
CryptoMix ransomware changes the name of each encrypted file to the following format: Filename .SERVER.
Files targeted are those commonly found on most PCs today; a list of file extensions for targeted files include:
.sql, .mp4, .7z, .rar, .m4a, .wma, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum, .ibank, .t13, .t12, .qdf, .gdb, .tax, .pkpass, .bc6, .bc7, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps, .docm, .docx, .doc, .odb, .odc, .odm, .odp, .ods, .odt
Once your files are encrypted with the .SERVER extension, the CryptoMix SERVER ransomware will create the _HELP_INSTRUCTION.TXT file ransom note in each folder that a file has been encrypted and on the Windows desktop.
These files are located in every folder that a file was encrypted as well as in the user’s Startup folder so that they are automatically displayed when a user logs in. These files will contain the information on how to access the payment site and get your files back.
When the infection has finished scanning your computer it will also delete all of the Shadow Volume Copies that are on the affected computer. It does this so that you cannot use the shadow volume copies to restore your encrypted files.

3. Is my computer infected with SERVER Ransomware?

When CryptoMix ransowmare infects your computer it will scan all the drive letters for targeted file types, encrypt them, and then append the .SERVER extension to them. Once these files are encrypted, they will no longer able to be opened by your normal programs. When Loky ransowmare has finished encrypting the victim’s files, it will change the desktop wallpaper to an image that acts like a ransom note. It will also display a HTML ransom note in your default browser. These ransom notes include instructions on how to connect to the Decrypt Service where you can learn more about what happened to your files and how you can make a payment.
The messages displayed by this ransomware infection can be localized depending on the user’s location, with text written in the appropriate language.
This is the message that the SERVER ransomware (_HELP_INSTRUCTION.TXT) will display:
Hello!
Attention! All Your data was encrypted!
For specific informartion, please send us an email with Your ID number:
serverup@keemail.me
serverup@protonmail.com
serverup1@yandex.com
serverup3@yandex.com
ann.c@iname.com
Please send email to all email addresses! We will help You as soon as possible!
IMPORTANT: DO NOT USE ANY PUBLIC SOFTWARE! IT MAY DAMAGE YOUR DATA FOREVER!

4. Is it possible to decrypt files encrypted with the *.SERVER extension?

No, at this time it’s not possible to recover the files encrypted by the .SERVER extension.
SERVER ransomware is notable due to how it encrypts the user’s files – namely, it uses AES-265 and RSA encryption method – in order to ensure that the affected user has no choice but to purchase the private key. The RSA public key can only be decrypted with its corresponding private key. Since the AES key is hidden using RSA encryption and the RSA private key is not available, decrypting the files is not feasible as of this writing.
Brute forcing the decryption key is not realistic due to the length of time required to break an AES encryption key. Unfortunately, once the .SERVER encryption of the data is complete, decryption is not feasible without paying the ransom.
Because the needed private key to unlock the encrypted file is only available through the cyber criminals, victims may be tempted to purchase it and pay the exorbitant fee. However, doing so may encourage these bad guys to continue and even expand their operations. We strongly suggest that you do not send any money to these cyber criminals, and instead address to the law enforcement agency in your country to report this attack.

News article is edited by: yakura - 9-04-2018, 15:37

Comments 1

Dino Bumpass
Dino Bumpass 11 May 2019 13:35
The guidance to remove virus from PCs and laptops is very good and helpful for me. Get custom essay writing services uk as this article proved tremendous for me as well as for others who had the issue of virus in their computers.
Add comment

Add comment

reload, if the code cannot be seen