Purgatory Ransomware: A Dangerous File-Encrypting Threat & Removal Guide

Purgatory ransomware is a malicious program that encrypts files on an infected system and demands payment in Bitcoin for their decryption. Once activated, it renames affected files with a “.purgatory” extension and displays a ransom note in a pop-up window, instructing victims to contact the attackers via Telegram.

---

Purgatory Ransomware Overview

To better understand the nature of this ransomware, here is a structured breakdown:

Attribute	Details
Name	Purgatory Ransomware
Threat Type	Ransomware, Crypto Virus, File Locker
Encrypted File Extension	.purgatory
Ransom Note Display	Pop-up window
Ransom Amount	0.0897 BTC (~$9,000 at the time of writing)
Cybercriminal Contact	Telegram: @G_R_A_V_3_Y_A_R_D_B_O_Y
Wallet Address	12mdKVNfAhLbRDLtRWQFhQgydgU6bUMjay
Free Decryptor Available?	No
Detection Names	Avast (FileRepMalware [Ransom]), Combo Cleaner (Generic.Ransom.PyCrypter.147BE9D9), ESET-NOD32 (Multiple Detections), Kaspersky (HEUR:Trojan-Ransom.Win32.Generic), Microsoft (Ransom:Win32/FileCrypt.MK!MTB)
Symptoms of Infection	– Files cannot be opened  – Files renamed with .purgatory extension  – Ransom demand pop-up appears  – Attackers demand payment via Bitcoin
Distribution Methods	– Infected email attachments (macros)  – Torrent websites  – Malicious ads  – Drive-by downloads  – Fake software cracks  – Exploited network vulnerabilities
Damage	– Permanent file encryption (without decryption key)  – Possible installation of additional malware/trojans  – Loss of sensitive data  – Financial loss if ransom is paid
Danger Level	High

---

How Purgatory Ransomware Works

1. Infection Process
   Purgatory is typically spread through phishing emails, malicious downloads, software cracks, or infected websites. Once a user opens a malicious file, the ransomware is executed.
2. File Encryption
   The ransomware encrypts documents, images, videos, and databases with strong cryptographic algorithms. The encrypted files receive the “.purgatory” extension.
3. Ransom Demand
   After encrypting files, the malware displays a pop-up ransom note demanding 0.0897 BTC (~$9,000) for decryption. Victims are instructed to contact the attackers via Telegram (@G_R_A_V_3_Y_A_R_D_B_O_Y).
4. Payment & Consequences
   Victims who pay the ransom may not receive the decryption key. Cybercriminals often ignore victims after receiving payment.

---

Ransom Note Message

Below is the full text of the ransom note displayed in the pop-up:

vbnetCopyEditRANSOMWARE

All your files have been encrypted!

All your documents (database, texts, images, videos, music, etc.) were encrypted. The encryption was done using a secret key. To get key contact with me:
Telegram: @G_R_A_V_3_Y_A_R_D_B_O_Y

WALLET ADDRESS: 12mdKVNfAhLbRDLtRWQFhQgydgU6bUMjay
BITCOIN FEE: 0.0897

---

How to Remove Purgatory Ransomware

To stop Purgatory from encrypting more files, you must remove it from your system immediately. However, removing the malware will not decrypt already affected files.

Step 1: Boot in Safe Mode with Networking

1. Restart your PC and press F8 (or Shift + F8) before Windows loads.
2. Select Safe Mode with Networking.
3. Log in and proceed to the next steps.

Step 2: Use SpyHunter to Remove Purgatory Ransomware

1. Download SpyHunter.
2. Install and launch SpyHunter.
3. Run a full system scan to detect and remove malicious files.
4. Quarantine and delete all detected threats.
5. Restart your PC to complete the removal process.

Step 3: Remove Purgatory from Registry & Temp Files

1. Press Win + R, type regedit, and hit Enter.
2. Navigate to:
   • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
   • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
3. Look for suspicious entries related to Purgatory and delete them.
4. Clean temporary files:
   • Press Win + R, type %temp%, and delete all files.

Step 4: Restore Files Using Backups

• If you have a backup stored externally, restore your files.
• Use Windows File History or Shadow Copies (if enabled).
• Third-party recovery tools like Recuva may help recover some files.

---

How to Prevent Future Ransomware Attacks

• Backup Important Data: Store backups in offline storage or cloud services.
• Avoid Phishing Scams: Never open email attachments from unknown senders.
• Update Software & OS: Keep Windows, antivirus software, and apps up to date.
• Disable Macros in Office: Many ransomware attacks start via infected Word/Excel files.
• Use Security Software: Keep SpyHunter or another anti-malware tool active.
• Block Suspicious URLs: Use browser security extensions to prevent malicious ads.
• Be Cautious of Free Software: Avoid torrent sites, cracked software, and third-party downloads.

---

Final Thoughts

Purgatory ransomware is a highly dangerous malware threat that can permanently encrypt your files. Paying the ransom does not guarantee file recovery and supports criminal activities. The best approach is to remove the ransomware using SpyHunter and restore files from backups.

By following preventive measures, you can reduce the risk of future infections and keep your files safe.