Viruses Archives | BugsFighter

Velso Ransomware is maleficent crypto-virus, that uses AES encryption algorithm to encode user files. Ransomware mostly targets English-speaking countries, but may infect computers in any country. Affected files get .velso or .david extension and become inaccessible. After encryption Velso Ransomware creates text file get_my_files.txt with instructions to pay the ransom. The ID of the key and victim is generated by CryptGenRandom (), using AES-256 OpenSSL in ECB mode. Currently, there is almost impossible to decrypt files encrypted by Velso without master key.

April 24, 2018 James Kramer 0

How to remove STOP Ransomware and decrypt .STOP, .SUSPENDED or .WAITING files

Standard

STOP Ransomware is dangerous file-encrypting virus. It uses AES/RSA-1024 encryption algorithm. Depending on version, ransomware adds .STOP, .SUSPENDED or .WAITING extensions to encrypted files. First variant of STOP Ransomware creates !!!YourDataRestore!!!.txt files, second !!!RestoreProcess!!!.txt, third !!!INFO_RESTORE!!!.txt. In this files, malware demands $600 ransom, that has to be paid in 72 hours, in BitCoins. It also contains user personal id and e-mail addresses for contacting.

April 19, 2018 James Kramer 0

How to remove Hermes (2.0 – 2.1) Ransomware and decrypt .hrm files

Standard

Hermes Ransomware wide-spread family of crypto-viruses. There have been 2 major updates of initial ransomware – Hermes 2.0 Ransomware and Hermes 2.1 Ransomware. All variants use AES-256 encryption algorithm combined with RSA-2048. First version did not add any extensions and modified only content of the files by adding HERMES file-marker. Last version started to append .hrm suffix, but then just encrypted files without filename modification. After encryption, ransomware creates text files DECRYPT_INFO.txt and DECRYPT_INFORMATION.html, that contains message with instructions to pay the ransom and contact details. You can see the contents of this files below in the next paragraph.

April 10, 2018 James Kramer 0

How to remove WhiteRose Ransomware and decrypt .WHITEROSE files

Standard

WhiteRose Ransomware is dangerous encryption virus from InfiniteTear family. It uses AES algorithm to encode user files. After this it appends complex suffix _ENCRYPTED_BY.WHITEROSE, and modifies the filename to random set of letter and numbers. Then, ransomware creates text file HOW-TO-RECOVERY-FILES.TXT, containing ransom-demanding message with contact information and instructions. Usually, viruses of this type ask for $500 – $1000 in BitCoins. To reсover data, users must contact WhiteRose’s developers via Tox chat.

April 3, 2018 James Kramer 0

How to remove Rapid (2.0) Ransomware and decrypt .rapid or .paymeme files

Standard

Rapid Ransomware is nasty virus, that encrypts user files using AES encryption algorithm and demands ransom for decryption. All affected files get .rapid extension, in some versions .paymeme suffix is added. Rapid 2.0 Ransomware appends extensions, that contains 5 random letters in uppercase. Extension is unique for every PC. Unlike other similar ransomware threats, it does not do one time encryption, but continues to encode every new file on victims computer, whether it was just created or copied. Amount of ransom varies from $500 to $1500 and have to be paid in BitCoins. Using BitCoin payments and TOR websites, makes it difficult to find location of malefactors.