Devill Ransomware EXPOSED: Random Five-Letter Endings and Readme.txt

You open Documents the way you did yesterday. The vacation photo should still be vacation.jpg. The invoice should still be invoice-2026.pdf. The tax sheet should still be taxes.xlsx. The family video should still be family.mp4. The names are still there. Then you see the extra endings. One photo is now vacation.jpg.iYaqG. The invoice is invoice-2026.pdf.oMdyl. The tax sheet is taxes.xlsx.iYaqG. The video is family.mp4.oMdyl. A small text file named Readme.txt is sitting in the same folder, as if it has always belonged there.

That is the trap, not a glitch. Devill ransomware locks the files first. Then it hangs a random five-character tail on each name. Then it drops Readme.txt and paints the same words across the desktop wallpaper. The note talks like a person. It is a storefront. It tells you a dangerous virus infected the computer. It tells you to write devillhackerr@gmail.com. It tells you they will name a crypto amount after you write. It tells you that a wrong decryption key deletes everything. That last line is pressure. It is not a lab result this page is going to certify.

This page is for the moment those five-letter endings appear. It explains the rename, the note, the wallpaper, the Gmail checkout, and why a blank $ line is still a bill. It is not a tour of ransomware in general. It is about this strain, the one that keeps the old filename, appends a random five-character ending, and signs the flyer By Devill.

Overview

The first thing they take is the files you can still recognize. Photos. Invoices. Spreadsheets. Videos. Anything that looks like work or memory. Devill does not hide the catalog behind a coded title. It keeps vacation.jpg in front of the new tail. It keeps invoice-2026.pdf in front of a different tail. You can still read what you lost. You cannot open it. That readable loss is the product.

The way they take it is a lock plus a label. The locker rewrites the bytes so everyday apps fail. Then it appends a random five-character extension to that file. Documented samples look like this. 1.jpg becomes 1.jpg.iYaqG. 2.png becomes 2.png.oMdyl. In the same folder you can also see vacation.jpg.iYaqG, invoice-2026.pdf.oMdyl, taxes.xlsx.iYaqG, and family.mp4.oMdyl. The five letters are not a family brand you can search once and be done. Two files in one pass can wear two different tails.

What happens after you click is the sales floor. Readme.txt is sitting next to the locked copies. The desktop wallpaper repeats the same text, so you do not have to open the note to get the pitch. The note says hello, names itself Devill, and calls itself a dangerous virus. It tells you to buy a key with the crypto they will specify. It tells you to write devillhackerr@gmail.com. It tells you to pay or lose everything. There is no ransom $ amount on the page. The number is the prize they hand you after you have already started the conversation.

What happens after you email is the checkout. You have told them a person is sitting in front of the locked machine and is willing to talk. Then they can name a crypto amount. Then they can ask for a sample file. Then they can warn you again that a wrong key deletes the pile. The mailbox is not a help desk. It is the aisle. A reply from that address is still the same shop. A later $ figure from that address is still the same shop.

What happens after you pay is not a contract. Paying can send coin to people you cannot sue. Paying can buy a tool that never arrives. Paying can buy a tool that opens two junk files and then asks for more. Paying does not close the hole that let the locker in. Paying does not turn 1.jpg.iYaqG back into 1.jpg by magic if they decide not to finish the job. There is no public free decryptor known for this strain. Anyone who says they already have the Devill key is selling the lock again.

That is the whole costume. A folder of familiar names with random five-letter endings. A note called Readme.txt. A wallpaper that copies the note. A Gmail address. A blank $ line. A threat that a wrong key wipes the disk. There is no reason to write that inbox. There is no reason to type a guessed key into a box. There is no reason to pay a number they invent after you say hello.

The random five-letter ending is the first warning

Most lockers pick one extension so you notice the change in seconds. You still see taxes.xlsx in front of a single brand. Devill refuses that courtesy in a quieter way. The old name stays. The extra ending changes. One file can land as .iYaqG. The next file can land as .oMdyl. The listing looks almost right, which is why the first instinct is to double-click.

Windows may now call the type an IYAQG file, or an OMDYL file, and then offer a useless “choose an app” box. An app cannot talk those bytes back into a JPEG. Double-clicking 1.jpg.iYaqG does not open the photo. Spreadsheet software does not open taxes.xlsx.iYaqG. A video player does not open family.mp4.oMdyl. The listing still has one object per file. The shock lands because the names still look like yours. The lock is in the content, not in the label.

Do not treat that readable name as a fix. Do not strip .iYaqG off the end and expect Photos to open the file. Do not strip .oMdyl off the invoice and expect a PDF reader to smile. Do not run a bulk “extension fixer” you found in an ad. The name is a label. The lock is in the content. Editing the label can make a later trusted tool have a harder time matching the file to what it was. Leave the locked copies as they are until you have a clean machine and a plan that does not start in a criminal inbox.

The mixed endings also make a later scam easier. Anyone who sees vacation.jpg.iYaqG next to invoice-2026.pdf.oMdyl can pretend they already “have your case.” They can quote both tails back to you. They can offer a paid unlock. They can claim the random letters are a serial only they can decode. The five letters are branding that changes per file. They are not a hint that the file can be renamed back to normal.

Readme.txt is a sales floor, not a help file

The note is a plain text file with the most ordinary name on a Windows disk. Readme.txt looks like documentation that came with a tool. Plenty of real software drops a readme. This locker uses that habit against you. It is meant to be the first thing you double-click when the folder already looks wrong and the wallpaper is already talking.

The file speaks in a short, personal voice. It says hello. It names itself Devill. It says a dangerous virus infected the computer. It warns that a wrong key deletes the files. It tells you to buy the key with the crypto they will specify. It tells you to write devillhackerr@gmail.com. It tells you to pay or lose everything. It signs off By Devill. That is the whole flyer. This page will not invent extra lines to make the note sound longer than it is.

Notice what the note does not give you. It does not give you a $ figure. It does not give you a wallet. It does not give you a support ticket that a real company would honor. It does not give you a refund policy. It does not give you a way to prove the other side will ever send a key. It gives you a greeting, a threat, a Gmail address, and a tone that says this is already decided. That tone is the product.

A ransom note can sound like a person and still be a threat. First-person copy is cheaper than a skull. A short file is easier to read when you are scared. The people who wrote it want you to finish the page and then finish their checkout. Read it as a sales flyer that was dropped after a break-in. Then close it. Keep the file on disk. Do not treat it as a set of steps you should follow.

The wallpaper is the same bill, only louder

After the files are locked, the desktop image changes. The new wallpaper shows the same text as Readme.txt. That is the point. You do not have to find the note. You do not have to open a folder. Every time you minimize a window, the billboard is there. Every time a family member walks past the screen, the billboard is there.

This is the hurry-up layer. A text file can be ignored if you are busy trying to open the photo. A desktop cannot. People waste the first hour on the wallpaper. They screenshot it. They search every word on it. They change the image back and hope the files follow. The files do not follow. Put the wallpaper in the same mental box as the note. Keep a copy if you need evidence. Then stop decorating the crime scene and stop talking to the people who painted it.

Changing the wallpaper back is fine for your nerves. It is not a repair. The lock does not live in the picture behind your icons. The lock lives in every file that now ends in five random letters. If you spend the evening hunting a “wallpaper remover” from a search ad, you are still shopping in the market this attack created.

The Gmail line is the checkout aisle

The only contact the note prints is devillhackerr@gmail.com. That string is an identifier. It tells you which campaign you are looking at. It is not a support queue. Gmail is a real mailbox service. That sentence is not an invitation to finish their checkout. Writing that address because a ransom note told you to is how a flyer becomes a live conversation.

A public mailbox is a choice. It is easy to type. It looks less frightening than a hidden site. It also gives the operators a private counter where they can name a $ figure after they see how scared you are. There is no chargeback window on a Gmail thread with a locker. There is no manager to escalate to when the key never arrives. There is no receipt that a bank will honor.

Do not write “just to ask the price.” Do not attach 1.jpg.iYaqG “just so they can see it is real.” Every message is a signal that a person is sitting in front of the locked machine and is willing to talk. That is the moment the number, the pressure, and the follow-up scams begin. If you already sent a message before you found this page, stop there. Do not send more files. Do not pay a deposit to “hold the price.”

The wrong-key line is intimidation copy

The note warns that entering a wrong decryption key deletes all files. Read that sentence the way you would read a street vendor who says the spare key will snap if you guess. The line is written to stop your hand. It wants you afraid of trying anything that is not their inbox. It wants you afraid of a relative, a technician, or a tool you have not paid them for.

Treat that claim as attacker text, not as a deletion event this page timed. The page is not a lab report of a wipe. It will not pretend the threat was measured, and it will not pretend the threat is fake. Criminals lie. Criminals also follow through. Either way, the purpose of the sentence is the same. It wants you making decisions from panic instead of from a plan.

Do not sit in front of a Decrypt box and “try a few” so you can see if the wipe is real. Do not type family names. Do not type 1234. Do not paste a string a commenter called a universal key. A wrong guess is not a harmless experiment. At best it does nothing. At worst it keeps you on an infected desktop, feeding a hostile field, while the real work waits. This page is not going to say the files were proven to vanish. It is going to say the sentence is there to own your next click.

This is not the old Devil locker

If you searched the word devil and landed on an older Malwaretips guide, you may already have two different families in one tab. The published DEVIL article is about a Phobos-style locker that stamps .devil on the file and writes an ID plus an email into the filename. The contact on that older strain is a ProtonMail address, not this Gmail. That is not this incident.

This strain spells the name Devill, with two L’s. It does not use .devil. It does not put an ID in the filename. It hangs a random five-character tail on the original name and leaves Readme.txt plus a matching wallpaper. If your files end in .devil and the name already contains an inbox, you are in the older article. If your files look like 1.jpg.iYaqG and the note says write devillhackerr@gmail.com, stay on this page.

How The Scam Works

The shop is simple once you stop reading it as a rescue. Lock the files. Keep the old names so the loss is readable. Hang a random five-letter tail on each object. Drop Readme.txt. Paint the same words on the wallpaper. Point the scared person at a Gmail address. Keep the $ amount off the page so the first conversation can set it later, after you have already said hello. Add a wrong-key wipe threat so you are afraid to try anything else.

1. The lock keeps the old name so you recognize the loss

Devill encrypts the files it wants as leverage, then appends five random characters. That is why 1.jpg is still readable as 1.jpg.iYaqG. That is why 2.png is still readable as 2.png.oMdyl. The operators want you to inventory the damage in seconds. They want you to see the vacation photo, the invoice, the tax sheet, and the family video in one glance. A coded filename can confuse you. A readable filename makes you feel the theft.

The types that usually get hit are the ones people miss first. Pictures. Documents. Spreadsheets. Videos. Archives. System files may still boot. The browser may still open. That is not mercy. A machine that still turns on is a machine that can still display a wallpaper and still open Gmail in a tab.

If only one folder looks wrong, do not assume the rest of the disk is safe. Ransomware walks trees. It hits Documents, Desktop, Pictures, Downloads, and any drive letter it can reach, including a USB stick you forgot was plugged in. Unplug extra disks. Do not plug in the backup drive “just to check.” Checking is how the backup gets the same random five-letter ending.

2. Each file can wear a different five-letter tail

This is the detail that throws people who have already read about lockers with one stamp. Devill does not need every file to say the same brand out loud. The documented pair is enough to learn the pattern. 1.jpg.iYaqG and 2.png.oMdyl sit in the same incident. The mockup on this page shows the same habit on everyday names: vacation.jpg.iYaqG next to invoice-2026.pdf.oMdyl, taxes.xlsx.iYaqG next to family.mp4.oMdyl.

That mix is easy to misread. A person who only glances at one file can think the extra letters are a sync glitch or a camera roll tag. A person who glances at two files can think two different programs went wrong at once. The note is what makes the pile make sense. Random five-letter endings plus Readme.txt are the tell. The wallpaper saying the same words is the second tell.

Do not hunt a decoder for the five letters. They are not a puzzle this page is going to reverse. They are not a hint that iYaqG means January and oMdyl means invoices. They are random enough to look technical and short enough to fit on a filename. Leave them alone. Write the endings down for your own records if you need to describe the incident. Do not treat them as a serial you can buy a key for.

3. Readme.txt turns a break-in into a conversation

The ransom note is a simple text file named Readme.txt. It is meant to be the first thing you double-click when the folder already looks wrong. The name sounds like a key. The voice sounds like a person. The file is a script for what they want you to do next.

It says hello. It names Devill. It calls the infection dangerous. It warns that a wrong key deletes the files. It tells you to buy the key with crypto they will specify. It points you at devillhackerr@gmail.com. It says pay or lose everything. That order matters. Read the threat. Believe the wipe is one guess away. Write the inbox. Wait for a number. Then send coin. Then hope. The note is not a recovery guide. It is a path from panic to a private thread without a witness.

Part of that script is the missing $ amount. A printed price lets you shop for coin before the fear cools, and it also lets you show the bill to a friend. A blank price keeps the first move social. You have to write. You have to describe the machine. You have to wait. The people on the other end get to set the number after they hear how badly you need taxes.xlsx.iYaqG back.

4. The wallpaper repeats the flyer so you cannot miss it

Plenty of lockers change the desktop. Devill uses that habit in the simplest way. The wallpaper is not a new speech. It is the same text as Readme.txt, painted where you cannot close a tab on it. That is sales theater. A picture cannot unlock a file. Changing the picture cannot unlock a file. Searching the picture’s words cannot unlock a file.

The wallpaper also recruits the room. A partner sees it. A coworker sees it on a shared screen. A child sees it. Those people then search the same words and land in the same market of paid unlockers. The desktop is doing outreach. Save a screenshot for evidence if you still can. Then set any old picture you like. The files will not follow the new picture home.

5. The only listed door is a Gmail address

Plenty of lockers print a hidden site or a messenger handle. This note prints devillhackerr@gmail.com. That is a choice. A normal-looking mailbox lowers the fear of the first message. It also leaves you without a company you can sue and without a bank form you can file. The operators get a thread they control. You get a blank invoice that fills in after you write.

This page will not invent a second inbox, a chat ID, or a hidden site. The published contact is the Gmail address. If a later email from that address adds a new door, that is still the same shop. If a later stranger adds a different door because “Gmail is too slow,” that is a second shop standing in the same doorway. You do not need to complete either form.

Do not open a new mailbox “so the reply looks cleaner.” Do not forward the note to a friend and ask them to write instead. Every extra channel is another place a copycat can greet you like a case manager. The address in Readme.txt is enough of a tell. You do not need to use it.

6. The $ amount is withheld on purpose

A lot of locker notes print a coin amount so the victim can start shopping for crypto before the fear cools. Devill’s note does not do that. It says you must buy the key. It says they will specify the crypto amount. It never writes a USD price on the flyer. The blank is the point.

A blank price is a fitting room. Once you write, they can ask what you do for work. They can ask whether the machine is a home PC or a shop PC. They can ask whether you have backups. They can quote one number for a student and a higher number for a company inbox. They can raise the number if you sound desperate. None of that negotiation is a discount. It is the sale starting after you have already stepped inside.

If a later reply from devillhackerr@gmail.com finally names a $ figure, that is still the same flyer finishing itself. If a later helper names a $ figure first and then “finds” this Gmail, that is a second flyer. Do not help either side fill in the blank. The missing number is not mercy. It is a blank invoice.

7. The wipe threat tries to own every other click

The wrong-key warning is doing two jobs. It sounds like a technical limit. It also tries to make every path that is not their inbox feel fatal. A relative who wants to try a backup looks dangerous. A technician who wants to copy the locked files looks dangerous. A later trusted decryptor, if one ever appears, looks dangerous. The sentence is a monopoly claim dressed as a safety tip.

Part of any locker note that says “do not modify the files” is still a useful caution in the wrong mouth. Mystery decrypt apps from ads can damage files. Bulk rename tools can scramble names that a later trusted project might have used. The safe reading is narrower than the note wants. Do not take technical advice from the attacker. Do not run a paid unlocker from a search ad. Do not delete the locked copies “to start clean.” Do not type guesses into a key field because the note dared you not to.

Keep the locked files. Keep Readme.txt. Keep a screenshot of the wallpaper. Those are evidence and, if a trusted decryptor ever appears, they are the raw material that tool would need. Destroying them because the note scared you is still doing the note’s work. Guessing keys because the note scared you is also doing the note’s work.

8. A second shop offers the same miracle

After a ransomware incident, search results and inbox ads fill up with companies that say they can decrypt Devill or “all .iYaqG files.” Some of those shops are ordinary overpriced consultants. Plenty are a second scam. They will quote the five-letter tail back to you. They will mention Readme.txt so they sound close to the case. They will mention devillhackerr@gmail.com as if an inbox were a case number. They will ask for a sample file, a remote-access session, or a $ deposit.

The second scam has a friendly website and a case manager. It may even open one junk file, because anyone can decrypt a file they themselves just locked. Then the price rises, the chat dies, or the remote tool installs more malware. A logo in a banner does not make them a rescue desk. A promise that 100% of clients got files back is still a sales line.

A real public decryptor, when one exists, shows up on an official project page that already existed before your incident. It does not need a deposit in cryptocurrency. It does not need devillhackerr@gmail.com. It does not need you to “hold a slot” with a $ figure they invent on the call. If the pitch is “we can decrypt, pay us first,” you are still in the market the ransomware created. There is no public free decryptor known for this strain. Do not let anyone tell you an old builder tool from a different family will open these files. This page will not make that claim.

9. Payment closes nothing

Paying is not a guarantee. That sentence is not a slogan. It is the recorded experience of victims across ransomware families. The people who send the note can take the money and disappear. They can send a tool that only unlocks a few files. They can come back later and lock the same machine again. A Gmail thread makes that outcome easier, not harder. You cannot leave a review on a locker inbox.

Even when a key arrives in some other campaign, it can fail on some file types, stop halfway, or demand a second payment. The same access that delivered Devill the first time can still be open. A payment teaches the operators that this victim pays. It does not close the hole that let them in. It does not give you a contract you can enforce. People who pay sometimes get a second bill for “deletion.”

If someone later tells you that 100% of paying victims got everything back, ask for a public source that is not the person selling the key. You will not get one that you should trust. Until a trusted project publishes a tool for this family, treat any site that says “we already have the Devill key” as a second sales pitch. Do not test that pitch with the only copy of family.mp4.oMdyl.

What To Do If Your Files End in .iYaqG

Do not write devillhackerr@gmail.com. Do not ask them to name the crypto amount. Do not send a “test file” to that inbox. Do not type a guessed decryption key into a pop-up, a note field, or a helper app. Do not pay a $ figure they name after you arrive. If you already sent a message before you found this page, stop there. Do not send more files. Do not pay a deposit to “hold the price.”

• STEP 1: Use Rkill to terminate suspicious programs.
• STEP 2: Use Malwarebytes to remove for Ransomware and Unwanted Programs
• STEP 3: Use HitmanPro to remove Trojans and other Malware
• STEP 4: Use AdwCleaner to remove Malicious Browser Extensions and Adware
• STEP 5: Perform a final check with ESET Online Scanner
• STEP 6: Restore the files encrypted by ransomware

STEP 1: Use Rkill to terminate suspicious programs.

In this first step, we will download and run Rkill to terminate suspicious programs that may be running on your computer.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKILL DOWNLOAD LINK
   (The above link will open a new page from where you can download Rkill)

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 2: Use Malwarebytes to remove Ransomware and Unwanted Programs

In this second step, we will install Malwarebytes to scan and remove any infections, adware, or potentially unwanted programs that may be present on your computer.

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   DOWNLOAD MALWAREBYTES FOR WINDOWS (FREE)
   
   (The link opens in a new page where your download will start)

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Enable “Scan for Rootkits”

   Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.

   

   In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.

   

   Done? Click “Dashboard” in the left pane to return to the main screen.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.

   

STEP 3: Use HitmanPro to remove Rootkits and other Malware

In this third step, while the computer is in normal back, we will download and run a scan with HitmanPro to remove Trojans, rootkits, and other malicious programs.

HitmanPro is a second-opinion scanner — it’s designed to catch what your main antivirus might have missed. Instead of relying on a single detection engine, it checks the behavior of files in the locations where malware usually hides. Anything suspicious gets sent to the cloud, where it’s analyzed by two of the best antivirus engines available: Bitdefender and Kaspersky.

Good news: scanning is completely free, with no limits. You only need a license when it’s time to remove what was found — and even then, you can activate a free one-time 30-day trial to clean your PC at no cost. (A full license is $24.95 per year for 1 PC.)

1. Download HitmanPro

   Click the button below to download HitmanPro. Remember — the scan is free, so you have nothing to lose by checking your PC.

   DOWNLOAD HITMANPRO (FREE SCAN)
   (The link opens in a new page where your download will start)

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click “Next” to begin the system scan. No lengthy setup required — it goes straight to work.

   

   

4. Wait for the Scan to Finish

   HitmanPro will now check your computer for malicious programs. This usually takes just a few minutes thanks to its cloud-based scanning.
   

5. Review the Results and Click “Next”

   When the scan is done, HitmanPro will show you everything it found. Click “Next” to remove the detected threats.

   

6. Click “Activate Free License”

   To remove the malicious files, click the “Activate free license” button. This starts your free 30-day trial — no payment details needed — and unlocks the full cleanup.
   

   When the removal is complete, HitmanPro will show a summary of everything it cleaned. Click Next, then click Reboot if prompted. If there’s no reboot prompt, just click Close — your PC is clean.

STEP 4: Use AdwCleaner to remove Malicious Browser Extensions and Adware

In this next step, we will use AdwCleaner to remove malicious browser policies and unwanted browser extensions from your computer.

AdwCleaner is a free on-demand scanner that specializes in adware, browser hijackers, and unwanted toolbars — the exact threats that mainstream antivirus programs often miss. It also includes tools that repair the damage malware leaves behind, like hijacked browser settings and malicious policies. It’s a quick scan that’s well worth running.

1. Download AdwCleaner

   Click the button below to download AdwCleaner — it’s free, portable, and requires no installation.

   

   DOWNLOAD ADWCLEANER (FREE)
   (The link opens in a new page where your download will start)

2. Run AdwCleaner

   Open your Downloads folder and double-click the file named “adwcleaner_x.x.x.exe“. There’s no installation — the program starts right away.
   

   If Windows asks whether you want to allow AdwCleaner to run, click “Yes“. When the license agreement appears, click I agree to continue.

   

3. Enable “Reset Chrome policies”

   This setting removes malicious browser policies — a trick malware uses to lock your browser settings so you can’t change them back. Click “Settings” on the left side of the window, then turn on “Reset Chrome policies“.

   

4. Start the Scan

   Click “Dashboard” on the left side of the window, then click the “Scan” button.

   

5. Wait for the Scan to Finish

   AdwCleaner will now check your computer for adware and other malware. This usually takes only a few minutes — it’s one of the fastest scanners around.

   

6. Quarantine the Detected Threats

   When the scan finishes, AdwCleaner will list everything it found. Click the “Quarantine” button to remove all the malicious items at once.

   

7. Click “Continue” to Finish the Cleanup

   Save any open work first — AdwCleaner needs to close your open programs before it can clean. When you’re ready, click the “Continue” button.
   

   AdwCleaner will now delete all detected malware from your computer. If it asks you to restart your PC, allow it — your computer will be clean when you log back in.

STEP 5: Perform a final check with ESET Online Scanner

This final step involves installing and running a scan with ESET Online Scanner to check for any additional malicious programs that may be installed on the computer..

ESET Online Scanner is a free second-opinion scanner that performs a deep, full-system check for viruses, trojans, rootkits, and other malware. We use it as the final step because it’s thorough — if anything slipped past the previous scans, ESET will find it. A clean result here means your computer is malware-free.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   

   DOWNLOAD ESET ONLINE SCANNER (FREE)
   (The link opens in a new page where your download will start)

2. Run the Installer

   When the download finishes, open your Downloads folder and double-click “esetonlinescanner.exe“.
   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   On the Terms of use screen, click Accept.
   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.
   

4. Start a Full Scan

   Click Full Scan — this checks your entire computer, not just the common hiding spots.

   

   Select Enable for Detection of Potentially Unwanted Applications — this lets ESET catch adware and bundled junk programs, not just viruses. Then click Start scan.

   

5. Wait for the Scan to Finish

   ESET will now check every file on your computer. Because it’s a full scan, this can take a while — often an hour or more, depending on how much data you have. Leave it running in the background and check on it from time to time.

   

6. Review the Results

   When the scan completes, the Found and resolved detections screen appears. Any threats found were automatically cleaned and quarantined — there’s nothing extra you need to do. Click View detailed results if you want to see exactly what was removed.
   

   If ESET found nothing — congratulations, your computer has passed the final check and is malware-free.

STEP 6: Restore the files encrypted by ransomware

Unfortunately, in most cases, it’s not possible to recover the files encrypted by this ransomware virus because the private key which is needed to unlock the encrypted files is only available through the attackers. However, below we’ve listed three options you can use to try and recover your files.

Option 1: Search a decryption tool for this ransomware

The cybersecurity community is constantly working to create ransomware decryption tools, so you can try to search these sites for updates:

• https://id-ransomware.malwarehunterteam.com/
• https://decrypter.emsisoft.com/
• https://noransom.kaspersky.com/
• https://www.avast.com/ransomware-decryption-tools

Option 2: Use EaseUS Data Recovery Wizard Free to recover the encrypted files

EaseUS Data Recovery Wizard Free can restore files and repair corrupted files with simple clicks. Its powerful scanning algorithms can identify and retrieve huge file type library, including all of the popular video files, audio files, photos, and document formats.
While the free version only allows you to recover 2 GB of data, this can be helpful to see if the recovery is possible and restore back the most important files from your computer.

1. Download EaseUS Data Recovery Wizard Free.

   You can download EaseUS Data Recovery Wizard Free by clicking the link below.

   

   EASEUS DATA RECOVERY WIZARD FREE DOWNLOAD LINK
   (The above link will open a new page from where you can download EaseUS Data Recovery Wizard)

2. Double-click on the EaseUS Data Recovery Wizard Free setup file.

   When EaseUS Data Recovery Wizard Free has finished downloading, double-click on the setup file to install EaseUS Data Recovery Wizard on your computer. In most cases, downloaded files are saved to the Downloads folder.

   

   You may be presented with a User Account Control pop-up asking if you want to allow EaseUS to make changes to your device. If this happens, you should click “Yes” to continue with the EaseUS Data Recovery Wizard Free installation.

3. Follow the on-screen prompts to install EaseUS Data Recovery Wizard.

   When the EaseUS Data Recovery Wizard installation begins, click on the “Install Now” as seen in the image below.
   

   When your EaseUS Data Recovery Wizard installation completes, click the “Start Now” button to start the program.
   

4. Select a location to start recovering the encrypted files.

   Choose the drive or folder where you are the encrypted files that you want to recover and click “Scan“.
   

5. Wait for the EaseUS Data Recovery Wizard scan to complete.

   EaseUS Data Recovery Wizard will now scan your computer files that can be restored. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
   

6. Find the files you want to recover.

   When the EaseUS Data Recovery Wizard scan is finished scanning it will show a screen that displays the files that can be recovered. This tool can recover a lot of data, use the “Filter” button to quickly filter specific file types and find the files that you want to recover.
   

   Click the “Preview” button or double-click on a file for a full preview.
   

7. Select your files and click “Recover”.

   Finally, select the the files you want to recover and click “Recover“.
   
   Choose a safe location to save all the files.
   
   The free version only allow you to recover 2 GB of data, however, this will allow you to recover the most important files and see if EaseUS Data Recovery Wizard can correctly recover them.
   

Option 3: Try to restore your files with ShadowExplorer

This ransomware will attempt to delete all shadow copies when you first start any executable on your computer after becoming infected. Thankfully, the infection is not always able to remove the shadow copies, so you should continue to try restoring your files using this method.

1. Download ShadowExplorer.

   You can download ShadowExplorer from the below link.

   SHADOW EXPLORER DOWNLOAD LINK
   (This link will open a new web page from where you can download “ShadowExplorer”)

2. Install ShadowExplorer.

   Double-click on the ShadowExplorer-x.x-setup file to start the installation process, then follow the on-screen promts to install this program.
   

3. Select snapshot date.

   Open ShadowExplorer and then from the top bar select the drive where the files that you want to save are located, then select from the snapshot available one previous to this infection.

   

4. Export the files that you want to recover.

   Once you have found a copy of the original file or folder, right-click on it and the select “Export”. A window will prompt you where you want to save the file or folder.
   

Keep every random five-letter ending exactly as it is. Do not bulk-rename 1.jpg.iYaqG back to 1.jpg, or 2.png.oMdyl back to 2.png, or vacation.jpg.iYaqG back to a normal JPEG, or invoice-2026.pdf.oMdyl back to a normal PDF, or taxes.xlsx.iYaqG back to a normal sheet, or family.mp4.oMdyl back to a normal video. Stripping the extra ending is not a repair. The original name is already sitting in front of the five letters. You do not need to edit it to know what you lost.

Keep Readme.txt with the locked files. Keep a screenshot of the wallpaper if you still have it. Those two artifacts are how you prove this was Devill and not a different locker that only sounds similar. They are evidence. They are not instructions you should carry out. The Gmail address in the note is evidence too. It is not a help desk.

Read the wrong-key line the same way. The note says a wrong decryption key deletes all files. That is attacker text. It is not a reason to stay in a pop-up and test guesses. It is not a reason to pay a stranger who offers to “enter the key for you.” It is not a proven wipe published here. Do not type keys into a Decrypt field. Do not paste a password you use for email or banking.

If the desktop still shows their wallpaper, save a screenshot for your records, then set any old picture you like. That change is for you. It does not mean family.mp4.oMdyl will play again. If Windows still offers to pick an app for .iYaqG or .oMdyl, decline it. There is no player for those endings.

Do not mix this incident with the older DEVIL locker. That older strain uses a .devil ending and writes an ID plus a ProtonMail address into the filename. This strain uses two L’s, a random five-character tail, Readme.txt, and devillhackerr@gmail.com. If a later message from the Gmail in the note finally names a $ figure, that is still the same shop. Do not answer. Do not help them set a price the original note left blank on purpose.

The Bottom Line

Devill ransomware is a locker with a readable filename and a random five-letter tail. It keeps the old name and hangs five characters on the end. 1.jpg becomes 1.jpg.iYaqG. 2.png becomes 2.png.oMdyl. vacation.jpg becomes vacation.jpg.iYaqG. invoice-2026.pdf becomes invoice-2026.pdf.oMdyl. taxes.xlsx becomes taxes.xlsx.iYaqG. family.mp4 becomes family.mp4.oMdyl. The note is Readme.txt. The desktop wallpaper repeats the same text.

The note does not print a ransom $ amount. It says hello from Devill. It calls the infection a dangerous virus. It warns that a wrong key deletes the files. It tells you to buy the key with crypto they will specify. It tells you to write devillhackerr@gmail.com. It tells you to pay or lose everything. It signs off By Devill. The wrong-key wipe is intimidation copy, not a deletion this page verified. There is no public free decryptor known for this strain.

Do not pay. Do not write that inbox. Do not type guessed keys into a pop-up. Do not rename the pile in bulk. If you take one sentence with you, take this. A folder of familiar names with random five-letter endings, plus Readme.txt and a wallpaper that copies the note, is ransomware on the first sighting. Treat it that way before anyone in that Gmail names a $ figure.