Category: Ransomware

Articles about ransomware – malware encrypting your personal files or stopping you from accessing your computer – and ways to remove it

How to Remove GANDCRAB V3 and Restore .CRAB Files

What is Gandcrab v3 ransomware

A new version of Gandcrab ransomware has been released recently, called Gandcrab v3. While files encrypted by the first version of Gandcrab have turned out to be decryptable, and a free decryptor has been released by Bitdefender, Gandcrab versions 2, 2.1 and 3 seem more solid, and security researches weren’t able to find vulnerabilities in these ransomware variants so far. That is, no free decryptor for Gandcrab v3 exists and it is not guaranteed that there will be one. However, there are methods of file recovery that may be able to restore some of your encrypted files. READ MORE

How to Remove Zenis Ransomware and Recover Encrypted Files

Win XP

What is Zenis ransomware

Zenis encrypts files on the infected computer, renaming them to Zenis-[2 random characters].[12 random characters], and leaves ransom notes (Zenis-Instructions.html) in folders with encrypted files. Zenis ransomware has been analyzed by security researchers, and Michael Gillespie (@demonslay335 on Twitter) has found a weakness in the ransomware that allows decryption of files. That weakness is not released publicly lest the ransomware developers find out and fix it. Users who wish to decrypt their files for free can contact Michael Gillespie (however that won’t be quick: there are a lot of victims, and the decryption itself is time-consuming). It is quite possible that Zenis developers will find the weakness and release a new, more secure version of ransomware in the future; in that case you can use this guide to try recovering your files by other methods. READ MORE

How to Remove Sigma Ransomware and Recover Encrypted Files

How to remove Sigma virus and decrypt files

What is Sigma ransomware

Sigma ransomware is distributed via spam emails containing .docx or .rtf attachments with macros embedded. If a user has macros enabled, the script gets executed and downloads ransomware. Unlike most ransomware, Sigma doesn’t add new extensions to encrypted files and just creates ransom notes (ReatMe.txt and ReadMe.html) inside folders that contain encrypted files. At the time of writing no free decryptors exist, and the decryptor that ransomware developers offer in exchange for payment doesn’t work very well, according to users who have paid the ransom. Supposedly the decryptor crashes when encountering certain sorts of files, and some of the files stay encrypted as a result. In addition to decrypting files, there are some methods of file recovery that may or may not work in each particular case. You may follow this guide to remove Sigma and try to recover encrypted files. READ MORE

How to Remove Arrow (CrySiS) Ransomware and Recover .arrow Files

Win XP

What is Arrow ransomware

CrySiS or Dharma ransomware encrypts files on the infected computer and upends one of several extensions to encrypted files. The newest variant uses .arrow (.[marat20@cock.li].arrow, .[blammo@cock.li].arrow, .[java2018@tuta io].arrow, .[helprestore@cock.li].arrow) extension. Right now there is no free decryptor, and there may never be one. First two variants of CrySiS (.crysis and .dharma) had free decryptors released eventually but none of the later variants (.wallet, .arena, .cesar, .java) have so far. If your files have been encrypted by CrySiS and you don’t have back-ups, your best bet would be to back up encrypted files in case the free decryption tool is released in the future, and meanwhile try some methods of file recovery that may be able to restore at least some of the files. READ MORE

How to Remove GandCrab2 Ransomware and recover .CRAB Files

What is GandCrab2 ransomware

GandCrab2 is a new version of GandCrab ransomware. For the first variant of GandCrab, which have been using .GDCB extension for encrypted files, the free decryptor was released last week. GandCrab2 upends .CRAB extension to encrypted files and supposedly is not decryptable by Bitdefender’s free decryption tool. At the time of writing there is still almost no information about GandCrab2 and it is not known whether it can be decrypted for free or not. If GandCrab2 have encrypted your files, you may wait until more data is released about this ransomware or try the below methods of file recovery. Don’t delete your ransom note (CRAB-DECRYPT.txt) and don’t allow your antivirus software to delete it, as it may be needed for successful decryption in the future. READ MORE

How to Remove GandCrab Ransomware and recover .GDCB files (Updated)

---= GANDCRAB =--- Attention! All your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: 1. Download Tor browser - hxxps://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in tor browser: hxxp://gdcbghvjyqy7jclk.onion/113737081e857d00 5. Follow the instructions on this page If Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser: 1. hxxp://gdcbghvjyqy7jclk.onion.top/113737081e857d00 2. hxxp://gdcbghvjyqy7jclk.onion.casa/113737081e857d00 3. hxxp://gdcbghvjyqy7jclk.onion.guide/113737081e857d00 4. hxxp://gdcbghvjyqy7jclk.onion.rip/113737081e857d00 5. hxxp://gdcbghvjyqy7jclk.onion.plus/113737081e857d00 On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. DANGEROUS! Do not try to modify files or use your own private key - this will result in the loss of your data forever!

What is GandCrab ransomware

GandCrab ransomware is actively distributed right now and uses several different ways to infect computers. A user can get this ransomware downloaded after they open a PDF attachment in a spam email (which will open a Word document which will ask the user to enable editing). Or they may, for example, encounter the “HoeflerText’ font wasn’t found” scam page and download and run the offered file. GandCrab ransomware upends .GDCB extensions to the files it encrypts and dumps GDCB-DECRYPT.txt file with decryption instructions to every folder. At the time of writing GandCrab is still a new ransomware variant, and security specialists are not done researching it. So far no free GandCrab decryptor exists (and it is not guaranteed that it will be created – that might happen if researchers find some fault in the ransomware code that will allow them to obtain decryption keys, or, for example, if someone gets access to GandCrab’s Command & Control servers where the key are stored). However, there are some other ways to recover GandCrab encrypted files that may or may not work in each separate case. READ MORE

How to Remove Saturn Ransomware and Recover .saturn Files

How to decrypt .saturn files and remove Saturn virus

What is Saturn ransomware

Saturn is a new ransomware variant that is actively distributed right now. Saturn has its own affiliate program, offering anyone to create an account, download their own version of Saturn encryptor and distribute it, earning revenue share when their victims pay ransom. Because of this Saturn may be distributed in many different ways (spam emails, pop-ups asking users to download something, RDP brute force attacks, etc.), and the amount of ransom asked may vary. Once on a computer, Saturn encryptor encrypts users’ files and drops #DECRYPT_MY_FILES#.txt and #DECRYPT_MY_FILES#.html ransom notes and #KEY-[user-id].KEY file into every folder where files were encrypted. Unfortunately, security researches that have studied Saturn say that it uses a secure encryption method, and files cannot be decrypted without the decryption key. There still may be a slim possibility to recover files for free if Saturn creators release decryption keys to everyone in the future (that has happened with several ransomware variants before) or if their Command and Control servers are seized by law enforcement. There are also ways of file recovery that may work and recover at least some encrypted files. You may use instructions below to remove Saturn from your computer and try to recover encrypted files. READ MORE

How to Remove .java (Crysis) Ransomware and Recover Your Files

How to decrypt .java files and remove Java virus

What is Java ransomware

If your files have been encrypted, and .id-[your-id].[contact-email].java extension has been added to them, that was the work of the newest variant of Crysis (Dharma) ransomware. That ransomware takes advantage of unsecure RDP setups (a weak password usually) to enter the machine and encrypt all files that might be of any importance to the user/company (by targeting certain file types). Crysis ransmware uses strong encryption method, and so far security researches weren’t able to find vulnerabilities that would allow them to create a decrypter. However, two first versions of Crysis ransomware – .crysis and .dharma – had their master decryption keys anonymously posted on computer security forums, making it possible for antivirus vendors to create decryption tools. Of course, these tools will only work on files encrypted by those two ransomware variants, and won’t work on .java files. At the time of writing no free decrypter for .java ransomware exists, however you can use some other methods of recovering encrypted files. READ MORE

How to Remove Scarab Ransomware and Restore Encrypted Files

How to decrypt .scarab files and remove Scarab virus

What is Scarab ransomware?

This ransomware variant is dubbed Scarab because of the extension it adds to encrypted files; it has been around since at least June this year when it was discovered by a security researcher. Lately Scarab has seen a rapid increase in activity, distributed to users mostly by spam emails with 7Zip archives containing supposed images of scanned documents. Once opened, these “images”, which are really Visual Basic Script files, would download and launch a Scarab ransomware executable. Scarab would scan the computer for most common file types, create encrypted versions of those files and delete the originals. READ MORE

Posts navigation

1 2 3 … 93 94 95 96 97
Scroll to top