The KeyHolder virus (Key Holder virus) is destructive ransomware similar to the FBI virus that infiltrates a computer system, encrypts personal files, and demands the user install Tor Project Browser, visit a specific website (such as mwyigd4n52mkbhye.onion), and pay a fine of $500 (or other amount) in order to decrypt the files.

The KeyHolder virus will block access to a computer system with a page or window that says “YOUR PERSONAL FILES ARE ENCRYPTED.” The page or window associated with KeyHolder ransomware will further include instructions and will claim that “all files, including videos, photos and documents on your computer are encrypted.” Furthermore, the virus may state that “guaranteed recover is provided within 10 days” of completing the instructions.

How to remove KeyHolder

1. KeyHolder removal Software and Tools – Detect and remove KeyHolder ransomware
2. System Restore/Reset – Restore PC to date and time before the KeyHolder malware infection
3. Tech Support – Call 1-888-879-0084 and they will kindly assist you with removing the KeyHolder computer infection

1. KeyHolder removal Software and Tools

1. We highly recommend writing down the toll free number below in case you run into any issues or problems while following the instructions. Our techs will kindly assist you with any problems.

2. Install the free or paid version of Malwarebytes Anti-Malware.

3. Once Malwarebytes is installed, run the program. *Malwarebytes may automatically begin to update and scan your computer at this point.

4. Once the Malwarebytes program has been open, if a scan has not initiated, please click the large Scan Now button or visit the “Scan” tab to initiate a scan. Before the scan is started Malwarebytes may ask to update the software, make sure to do so if prompted to.

5. Once the scan is complete, click the Quarantine All button to remove the files.

6. You may also chose to visit the History tab and click Delete All to remove these files from the Quarantine log, although these files no longer prove a threat.

2. System Restore/Reset

A System Restore/Reset is an easy solution to restore an infected computer to a date and time before it became infected with the KeyHolder computer virus. To learn more please select a link below:

• Windows System Restore Instructions

• Windows 8 Refresh/Reset Instructions

KeyHolder virus removal tips:

If the KeyHolder virus is difficult to remove there are several steps you can use to troubleshoot the removal process:

User accounts

Ransomware often infects 1 user account on Windows systems at a time. Here are some tips to remove ransomware by using different user accounts.

• Log into an account not affected by malware (with administrative rights) and perform a scan with reputable software to detect and remove malware.

• You can also delete the infected account.

• Other options include creating a new user account to remove malware if only 1 Window’s user account is present on the computer system.

Denying flash

Some variants of ransomware use flash and symptoms of the infection can be halted by denying flash via Macromedia’s real-time options. To learn more and deny flash please visit: http://www.macromedia.com/support/documentation/en/flashplayer/help/help09.html

Troubleshoot internet/network issues

Safe Mode With Networking can be used to access the Internet for updates, drivers, removal software, or other files if internet and network connectivity is compromised.