How to remove Mark Ransomware and Recover Encrypted Files

What is Mark file

.[mark_white@mail.ua].Mark is a file extension that uses a new malware belonging to the Crysis/Dharma ransomware family to mark files that have been encrypted. Ransomware is a malicious program that encrypts user files and demands a ransom for a key-decryptor pair that is necessary to decrypt the affected files. Ransomware uses a strong encryption system and a long key, which virtually eliminates the possibility of decrypting files without a key. Files encrypted with .[mark_white@mail.ua].Mark extension become useless, their contents cannot be read without the key that the criminals have.

What is Mark ransomware virus

Mark virus is one of the variants of Dharma/Crysis ransomware. This malware most often gets to the computer as part of other programs (torrents files, freeware, cracked apps and games) that have been downloaded by the user from the Internet. After its start, the virus begins to encrypt files using a key that is individual for each computer. Mark virus uses a very strong encryption system, which eliminates the possibility of determining the key, even using a super computer. The encryption process is very fast, regardless of what is in the file, the virus can easily encrypt it. Mark can encrypt almost all files that are on the computer, including those located on network drives. The only thing that the virus does not encrypt is the files that are necessary for the Windows OS to function normally. Below we list the types of files that can be encrypted by the ransomware:

.avi, .3dm, .qdf, .wpw, .rb, .mdbackup, .upk, .pptm, .bc7, .xbdoc, .xlgc, .yml, .kdc, .wmf, .t12, .xlsx, .1, .wmd, .xmind, .fsh, .kdb, .wot, .pak, .xlsm, .litemod, .ai, .icxs, .eps, .jpe, .p12, .itdb, .rwl, .slm, .dcr, .blob, .y, .wmo, .odm, .esm, .wav, .zdb, .desc, .sis, .arch00, .bar, .xlk, .rgss3a, .wri, .wpd, .1st, .odt, .wmv, .txt, .wpe, .vtf, .wbk, .ltx, .re4, .xlsb, .odp, .xf, .p7c, .epk, .ybk, .raw, .map, .arw, .wb2, .wbm, .xmmap, .ppt, .xwp, .wcf, .kf, .ibank, .png, .vfs0, .pem, .wps, .3ds, .cas, .syncdb, .webdoc, .ws, .m3u, .tax, .lrf, .ysp, .ztmp, .dazip, .itm, .wdb, .xx, .zi, .db0, .xls, .xxx, .bik, .ods, .xar, .hplg, .pst, .lvl, .accdb, .zip, .mlx, .sr2, .zw, .z3d, .erf, .wbz, .rim, .tor, .ncf, .bay, .xbplate, .7z, .wmv, .bc6, .rw2, .xml, .sum, .3fr, .wpt, .sie, .js, .xy3, .cfr, .xlsm, .wbmp, .zif, .forge, .xll, .yal, .wire, .doc, .cdr, .py, .wn, .flv, .rar, .sav, .mdf, .wp, .srf, .apk, .dbf, .xld, .wp7, .lbf, .m4a, .cer, .srw, .vcf, .z, .wsh, .itl, .mrwref, .csv, .big, .crw, .xyw, .raf, .dba, .mpqge, .docx, .wbd, .xls, .hkx, .bkp, .xdl, .sql, .sidn, .wbc, .wma, .wp5, .jpeg, .wdp, .bsa, wallet, .dmp, .indd, .zdc, .hvpl, .vdf, .mef, .x3f, .wpd, .rtf, .ff, .fpk, .r3d, .wp6, .wma, .webp, .mp4, .t13, .nrw, .mdb, .mcmeta, .pkpass, .wps, .xpm, .wpb, .menu, .wpa, .asset, .pef, .sid, .d3dbsp, .vpk, .mov, .odc, .p7b, .wsd, .wgz, .wm, .w3x, .gdb, .xdb, .ptx, .sb, .gho, .sidd, .x3f, .pfx, .pdf, .vpp_pc, .cr2

When the file is encrypted, ‘.id-USERID.[EMAIL-ADDRESS].Mark’ is added at the end of its name, that is, if you had a file of ‘document.docx’, then a file with the name ‘document.docx.id-USERID.[EMAIL-ADDRESS].Mark’ will appear in its place. If you change the file name, just delete the added extension, then nothing will change. The file will remain encrypted, and as before, this file will not be possible to open in the program with which it is associated.

Perhaps you found on your computer or its desktop a new file called ‘FILES ENCRYPTED.txt’, which for some reason is not encrypted. An example of such a file is given below.

all your data has been locked us
You want to return?
write email mark_white@mail.ua or whitemark@420blaze.it

This file is very important, in addition to containing a ransom demand, it also contains information that allows you to contact intruders. According to the message, the victim is invited to contact the attackers using the given email address. In response, the authors of the virus will give a Bitcoin address to which the ransom must be transferred. Of course, you should understand that there is no guarantee that the attackers, after receiving the ransom, will provide you with the key necessary to decrypt your files. In addition, by paying the ransom, you will push attackers to create a new ransomware.

Threat Summary

Name	Mark
Type	Ransomware, Crypto virus, Crypto malware, Filecoder, File locker
Encrypted files extension	.[mark_white@mail.ua].Mark
Ransom note	FILES ENCRYPTED.txt
Contact	mark_white@mail.ua, whitemark@420blaze.it
Ransom amount	$500-$1500 in Bitcoins
Detection Names	Trojan.Win32.Crusis.tqMs, Trojan/Win32.Crysis.R213980, Trojan.Ransom.Crysis.E, Win32:RansomX-gen [Ransom], AI:Packer.D3B9457E1E, Ransom.Crysis.A3, TrojWare.Win32.Crysis.D@6sd9xy, Trojan.Encoder.3953, Win32/Filecoder.Crysis.P, Win32.Trojan-Ransom.VirusEncoder.A, W32/Crysis.W!tr.ransom, Ransom.Crysis.Generic, Ransom:Win32/Wadhrama, Trojan-Ransom.Win32.Crusis.to
Symptoms	Cannot open files stored on the computer. Your personal files now have odd extensions that end with something like .locked, .crypted or .cryptor. Files named such as ‘FILES ENCRYPTED.txt’, ‘READ-ME’, ‘_open me’, _DECRYPT YOUR FILES’ or ‘_Your files have been encrypted” in every folder with an encrypted file. Desktop wallpaper is changed to the ransom note.
Distribution methods	Email attachments. Drive-by downloads from a compromised web-page. Social media posts (they can be used to entice users to download malware with a built-in ransomware downloader or click a malicious link). Suspicious web sites.
Removal	Mark ransomware removal guide
Recovery	Mark file recovery

 

As we have already said, Mark virus is not the first in its series. The fact that to date, antivirus companies have not created a way to decrypt files, and just have not found a 100% way to protect the user’s computers (otherwise how would you be on our site), indicates the complexity of the virus and the method that it uses to encrypt files. Nevertheless, you do not need to despair. There are several ways to find and remove Mark ransomware, and there is also a chance to restore part or even all encrypted files to their original state. Below we will describe in detail how to do this.

How to remove Mark virus & Restore .[mark_white@mail.ua].Mark files

If you encounter the malicious actions of Mark virus, and your files have been encrypted with ‘.[mark_white@mail.ua].Mark’ extension, then you need to remove the virus or be 100% sure that there is no ransomware on your computer, and then proceed to restore the files. Both the virus removal process and the file recovery process will take a lot of time, so do not believe the magical instructions that say that this can be done very quickly. We definitely recommend, even if for some reason one of the methods proposed below did not suit you, try another one and try all of them. Perhaps one of them will help you. Feel free to ask questions in the special section on our website or in the comments below. In addition, we want to add that all the tools that we recommend using in our instructions are free and verified by security experts. And the last, before proceeding with the instructions, we advise you to read it thoroughly carefully, and then print or open it on a tablet or smartphone to have it always at hand.

How to remove Mark ransomware virus

To remove Mark virus, we recommend using free malware removal tools, which we will consider below. You can use them in the same sequence as we gave, or in the order as you like. Perhaps you think that this virus can be removed manually by using some magic OS functions or by pressing a few keys. Probably a professional or computer specialist with great knowledge will be able to, but We recommend you use malware removal tools. They will do all the work for you, and most importantly they will prevent damage to system files that you might accidentally do. Of course, if you have an antivirus, you can use it first, but if it missed this ransomware, then your trust in it is greatly undermined.

Remove Mark ransomware virus with Zemana AntiMalware

Zemana AntiMalware is a free utility that performs a scan of your PC system and displays if there are existing worms, trojans, crypto virus, adware software, spyware and other malware residing on your personal computer. If ransomware is detected, Zemana Anti Malware (ZAM) can automatically remove it. Zemana Anti-Malware does not conflict with other antimalware and antivirus software installed on your PC.

Visit the page linked below to download Zemana setup package called Zemana.AntiMalware.Setup on your computer. Save it on your Desktop.

Run the setup package after it has been downloaded successfully and then follow the prompts to install this tool on your system.

During install you can change some settings, but we advise you don’t make any changes to default settings.

When setup is done, this malware removal utility will automatically start and update itself. You will see its main window like the one below.

Now click the “Scan” button to scan for Mark crypto malware and other security threats. This process may take quite a while, so please be patient. While the Zemana AntiMalware is scanning, you may see how many objects it has identified either as being malware.

When Zemana Anti-Malware completes the scan, Zemana AntiMalware (ZAM) will open you the results. Review the results once the utility has complete the system scan. If you think an entry should not be quarantined, then uncheck it. Otherwise, simply click “Next” button.

The Zemana Anti-Malware will delete Mark ransomware related folders,files and registry keys and move items to the program’s quarantine. After that process is complete, you can be prompted to restart your PC system to make the change take effect.

Delete Mark with MalwareBytes Anti Malware

Manual Mark removal requires some computer skills. Some files and registry entries that created by the ransomware virus may be not fully removed. We recommend that run the MalwareBytes Anti-Malware that are fully free your PC of crypto virus. Moreover, this free program will help you to remove malware, potentially unwanted software, adware software and toolbars that your system can be infected too.

1. MalwareBytes can be downloaded from the following link. Save it on your Desktop.
   
   

   Malwarebytes Anti-malware
   326457 downloads
   Author: Malwarebytes
   Category: Security tools
   Update: April 15, 2020
   
2. Once downloading is finished, close all programs and windows on your PC. Open a directory in which you saved it. Double-click on the icon that’s named mb3-setup.
3. Further, click Next button and follow the prompts.
4. Once install is finished, click the “Scan Now” button to perform a system scan for the Mark ransomware virus, other kinds of potential threats like malware and trojans. This procedure can take some time, so please be patient. While the utility is scanning, you can see number of objects and files has already scanned.
5. After the checking is finished, the results are displayed in the scan report. Make sure all threats have ‘checkmark’ and click “Quarantine Selected”. When the cleaning process is done, you can be prompted to restart your computer.

The following video offers a steps on how to delete browser hijackers, adware software and other malicious software with MalwareBytes.

Run KVRT to remove Mark

Kaspersky virus removal tool (KVRT) is a free removal utility that may be downloaded and use to delete ransomware virus, adware, spyware, trojans, worms, PUPs, malicious software and other security threats from your machine. You can use this tool to scan for threats even if you have an antivirus or any other security program.

Download Kaspersky virus removal tool (KVRT) by clicking on the following link. Save it on your Windows desktop or in any other place.

Once downloading is complete, double-click on the KVRT icon. Once initialization process is complete, you’ll see the KVRT screen as on the image below.

Click Change Parameters and set a check near all your drives. Click OK to close the Parameters window. Next click Start scan button to detect Mark crypto virus and other known infections.

When KVRT is complete scanning your machine, you will be shown the list of all detected threats on your system as shown in the figure below.

Review the report and then click on Continue to start a cleaning process.

How to decrypt .[mark_white@mail.ua].Mark files

All files with the ‘.[mark_white@mail.ua].Mark’ extension are encrypted. Their contents cannot be unlocked simply by removing this extension or completely changing the filename. Unfortunately, as we already reported in this article, there is currently no way to decrypt files. The reason for this is the complexity of the encryption algorithm that the authors of Mark virus use. In principle, this is what the attackers sought. But this does not mean that you have no choice and you need to pay a ransom for your files.

Never pay the ransom! Any security expert will tell you this. Of course, there is a chance that by paying a ransom, Mark virus authors will allow you to unlock your files, but there is no guarantee. Moreover, you should understand that when you pay a ransom, you unknowingly push the attackers to create new, even more destructive viruses.

Do not forget that besides you, thousands more people around the world have lost their files, that is, you are not alone. Antivirus companies, secuity experts are working on something that will allow you to decrypt .[mark_white@mail.ua].Mark files. Perhaps in the future an universal method will be developed that will allow all victims to unlock all their data.

Of course, as soon as a way to decrypt the files appears, we will post a message about this to this article or to our facebook account. Therefore, we recommend that you follow the updates.

How to restore .[mark_white@mail.ua].Mark files

As we wrote above, you cannot decrypt files encrypted with this virus. But you can use a different way, there is a small chance to restore .[mark_white@mail.ua].Mark files without decrypting them. Programs created for searching and recovering lost and deleted data can help you with this. We offer you to use the following free programs: PhotoRec and ShadowExplorer. Only two things that I want to say additionally. First, before restoring files, you must be 100% sure that there is no ransomware on the computer. We recommend using free malware removal tools that we examined in this article. Second, and what is very important! The less you use your computer after ransomware infection, the higher the chance that you will be able to recover encrypted files.

Use shadow copies to restore .[mark_white@mail.ua].Mark files

First of all, try to recover your files using a free tool called ShadowExplorer. This program will allow you to recover your files from Shadow Volume Copies. These copies are created automatically by the OS when you work with your files. Unfortunately, very often, the virus automatically deletes all these copies and thus prevents the user from recovering exnrypted files. Nevertheless, in some cases, the ransomware cannot delete all copies, and the user gets the opportunity to quickly restore all files. Therefore, our opinion, you should definitely try this method!

Download ShadowExplorer by clicking on the following link.

After the download is complete, extract the saved file to a folder on your computer. This will create the necessary files as displayed below.

Launch the ShadowExplorerPortable program. Now select the date (2) that you want to recover from and the drive (1) you want to recover files (folders) from as shown below.

On right panel navigate to the file (folder) you wish to recover. Right-click to the file or folder and click the Export button like below.

And finally, specify a folder (your Desktop) to save the shadow copy of encrypted file and click ‘OK’ button.

Use PhotoRec to restore .[mark_white@mail.ua].Mark files

Another really working way to recover your encrypted files is to use a program named PhotoRec. It is created to recover deleted or lost files. Does the virus block this method? Fortunately, the Mark virus cannot block it in any way. Why is this possible you ask. This is possible for the reason that when you delete files using the standard OS function, these files are not actually deleted. Just the Windows marks them as deleted and does not show them in the list of files. The program that we suggest you use, finds deleted files, including files that were deleted by the ransomware, and recovers them.

Download PhotoRec on your personal computer by clicking on the following link.

When the downloading process is complete, open a directory in which you saved it. Right click to testdisk-7.0.win and select Extract all. Follow the prompts. Next please open the testdisk-7.0 folder as displayed in the following example.

Double click on qphotorec_win to run PhotoRec for MS Windows. It will display a screen as shown below.

Select a drive to recover as displayed on the image below.

You will see a list of available partitions. Choose a partition that holds encrypted documents, photos and music as displayed in the following example.

Click File Formats button and specify file types to recover. You can to enable or disable the recovery of certain file types. When this is done, press OK button.

Next, click Browse button to select where restored files should be written, then click Search.

Count of restored files is updated in real time. All recovered documents, photos and music are written in a folder that you have chosen on the previous step. You can to access the files even if the restore process is not finished.

When the recovery is finished, click on Quit button. Next, open the directory where recovered files are stored. You will see a contents like the one below.

All restored files are written in recup_dir.1, recup_dir.2 … sub-directories. If you’re searching for a specific file, then you can to sort your recovered files by extension and/or date/time.

How to protect your PC from Mark crypto malware

Most antivirus applications already have built-in protection system against the crypto malware. Therefore, if your computer does not have an antivirus program, make sure you install it. As an extra protection, use the HitmanPro.Alert. All-in-all, HitmanPro.Alert is a fantastic utility to protect your computer from any ransomware. If ransomware is detected, then HitmanPro.Alert automatically neutralizes malware and restores the encrypted files. HitmanPro.Alert is compatible with all versions of Microsoft Windows operating system from Microsoft Windows XP to Windows 10.

Installing the HitmanPro.Alert is simple. First you will need to download HitmanPro Alert from the following link.

When downloading is complete, open the file location. You will see an icon like below.

Double click the HitmanPro.Alert desktop icon. Once the tool is launched, you will be shown a window where you can select a level of protection, as shown in the following example.

Now click the Install button to activate the protection.

Finish words

This guide was created to help all victims of Mark ransomware virus. We tried to give answers to the following questions: how to remove ransomware; how to recover .[mark_white@mail.ua].Mark files. We hope that the information presented in this manual has helped you.

If you have questions, then write to us, leaving a comment below. If you need more help with Mark related issues, go to here.