Viruses

Razer is the name of a ransomware infection that runs encryption of data requesting victims to pay money for its return. Users infected with this virus will see their file names changed with a random string of characters, cybercriminals' e-mail address (razer1115@goat.si), and .razer extension at the end. For instance, a file named 1.pdf that went through these changes will look something like this 1.pdf.[42990E91].[razer1115@goat.si].razer and reset its icon to blank. In order to decrypt the data, virus developers offer to follow their instructions provided within the readme-warning.txt text note. It is said victims should contact the frauds using one of the e-mails (razer1115@goat.si, pecunia0318@tutanota.com, or pecunia0318@goat.si) and pay the ransom in bitcoins. To convince victims that they can be trusted, cybercriminals offer the so-called guarantee option where victims are allowed to send 2 files with simple extensions (max 1MB) and receive them decrypted for free. Many ransomware creators use this trick to prompt victims into paying the ransom and staying in contact with them. We highly recommend you avoid meeting the requests of the developers and recover your data using a backup, instead.

Discovered by a malware researcher named S!Ri, Surtr is a ransomware program developed to encrypt various types of personal data. It is always common to see popular files like music, photos, and documents affected during the virus attack. Surtr uses the cybercriminals' e-mail (DecryptMyData@mailfence.com) and .SURT extension to rename all the blocked data. For example, a file like 1.pdf will change to 1.pdf.[DecryptMyData@mailfence.com].SURT and reset its original icon to blank. The same change will be applied to other data that went through the encryption. In addition, there are also two files getting created upon successful encryption - a text note called SURTR_README.txt and SURTR_README.hta that its meant to open a pop-up window. Both these files are used to deliver ransomware instructions for victims. You can take a close look at their contents here below:

Being part of the Dharma ransomware family, Dr is another file-encryptor that blocks access to data and demands its victims to pay money for the return. As soon as encryption comes into effect, all files stored on a system will be changed with the unique ID of victims, developers' e-mail address, and .dr extension. An affected sample like 1.pdf will transform into something like this 1.pdf.id-1E857D00.[dr.decrypt@aol.com].dr, and so forth with other types of encrypted data. The only variable information is victims' IDs, so they are most likely to be different for each infected user. After successful encryption, the virus creates a text note called FILES ENCRYPTED.txt. It also force-opens a pop-up window containing the same ransom instructions as in the note. Victims are given instructions to contact extortionists via e-mail communication. Their e-mail address is also visible inside of the new extension that is added to blocked data. In case developers do not respond within 12 hours, victims should write to another e-mail stated in the note. Furthermore, crooks behind Dr Ransomware also warn their victims to not rename files or use third-party tools to decrypt them. There is also no information on how much victims should pay for the decryption of their data as this will be known while contacting the frauds.

If your files have been encrypted and altered with the .wincrypto extension, then you are likely to be a victim of WinCrypto Ransomware. It is a high-risk infection blocking access to important data stored on a PC or network. After encryption, files like "1.pdf", "1.mp4", "1.png" and others with potentially valuable extensions will reset their icons to blank and have new extensions assigned. To illustrate, 1.pdf will change to 1.pdf.wincrypto, 1.mp4 to 1.mp4.wincrypto, "1.png" to 1.png.wincrypto and so forth with other file types. Once this part of encryption is done, the virus issues a text file called README WINCRYPTO.txt that stores ransom instructions. The same instructions are also presented inside of a pop-up window that is automatically opened. The text in both pop-window and note states all documents, photos, databases, and other important data have been strongly encrypted. To revert this and regain access to files, victims are guided to purchase the private key and special decryption software. The payment should be performed after downloading the TOR browser and contacting developers via the link. After that, victims will be involved in a conversation to get further instructions. Unfortunately, no third-party tools are currently able to decrypt data compromised by WinCrypto Ransomware with a 100% guarantee.

Architek is a ransomware program that strikes important data by locking access to it. The virus, therefore, asks its victims to pay the so-called ransom to get unique decryption software and lift the assigned blockage. Infected users will also see their files changed with the .architek extension. For instance, a file like 1.pdf will change to 1.pdf.architek and reset its original icon. The ransomware also creates a text note called How to decrypt files.txt to explain decryption instructions. The note says users' network has been encrypted due to poor security. In order to return access to their files, victims should contact developers. Even though there is no estimated price written by the extortionists, it is mentioned the price of decryption depends on how fast victims contact through the given TOR link. In case you refuse to follow the listed steps, cybercriminals threaten to share your data with third parties potentially interested in it. As a guarantee that they are able to decrypt your data, extortionists offer to send a couple of files. They will decrypt them for free and so-prove that they can be trusted. Unfortunately, this is not always the case with cybercriminals as they are prone to fool their victims and not send any decryption tools regardless. Despite this, it might be impossible to decrypt the entire data completely without the help of cybercriminals.

STOP/Djvu has been one of the most popular and devasting ransomware families that target a lot of worldwide users. It is operated by experienced developers that create and issue new ransomware versions on a regular basis. Alike other malware of this type, STOP/Djvu uses strong cryptographic algorithms along with assigning custom extensions to restrict access to data. After this, users become unable to open their files as they are blocked with secure ciphers. While being depressed and mentally down after receiving the virus, cybercriminals offer a file-saving solution - to buy special decryption software that will return access to data. They show ransom instructions inside of a note (.txt, HTML, or pop-up window) that is created at the end of encryption. Victims are often instructed to contact developers and send an estimated sum of money in BTC or other cryptocurrencies. However, it is obvious that many would like to avoid it and recover the files for free or at least at a low price. This is exactly what we are going to talk about today. Follow our guide below to learn all the necessary steps you should apply to decrypt or restore files blocked by STOP/Djvu.

NRCL blocks access to data and asks its victims to pay the so-called ransom. Malware that runs data encryption and extorts money from the infected is usually categorized as ransomware. NRCL does it using strong cryptographic ciphers to prevent manual file decryption. Upon its successful encryption, files stored on a system will undergo two visual changes - the new .NRCL extension and icons reset to blank. A sample that went through these changes would look something like this 1.pdf.NRCL. In addition, NRCL creates a text file called Note.txt with instructions on how to return your data. The same information is also concealed inside of a small decryption utility that can be opened through NRCL_Decryptor.exe. The content of both files says there is only one way to recover your data - pay 300$ for the decryption. Extortionists also guide victims to not shut their PC or run manipulations with files. To complete the payment and get a special decryption key, victims have to contact developers via e-mail communication. After that, victims should receive the key, insert it into the dedicated space of the pop-up window and click on Decrypt. However, at the moment of writing this article, malware experts found that e-mails provided by NRCL are non-existent meaning this ransomware can still be under development.

Also known as Client Service Runtime Process, Csrss.exe is a legitimate system process that is essential to Windows health. It can be found running alongside other background processes in Task Manager. The native location Csrss.exe is always rooted to C:\Windows\System32\. If you find it present in other directories, more likely it is a virus infection disguised as a legitimate process. Cybercriminals take the names of Windows processes to hide trojans or similar software. By doing so, they also obscure scanning algorithms of anti-malware software, which sometimes struggles to define it as malware. Despite this, it is quite easy to determine whether this process is malicious or not. You can find it amongst the list of background processes in Task Manager, right-click on it and choose "Open file location" to see where it is. If you suspect it is a virus indeed, make sure to follow our guidelines below. The Csrss.exe process is known to be exploited by malware developers to hide malicious software that steals personal data and triggers the installation of other programs as well. This is why it is necessary to remove it as soon as possible before it deals severe privacy damage.