ELDAOSLA Ransomware

The ELDAOSLA Ransomware is a file-locking Trojan that's from the Phobos Ransomware family. The ELDAOSLA Ransomware encrypts media files for holding them hostage until the victim pays a ransom, which it demands through pop-ups and text notes. Users with preserved backups can ignore these demands, and Windows anti-malware tools should detect and delete the ELDAOSLA Ransomware.

A Refresher on Fearing Certain Software

The Phobos Ransomware (or, from Greek, 'fear') family remains adept at popping up at unexpected times and places. Most criminals see little point in making drastic changes to the Trojan 'product,' as malware experts find persistently-strong similarities in members like the Devoe Ransomware, the Chinz Ransomware, the Barak Ransomware and the Adame Ransomware. The ELDAOSLA Ransomware, the newest model, barely even updates the ransom note from the second-latest campaign.

Still, the ELDAOSLA Ransomware's unambitious payload is far from safe. Malware analysts confirm its encryption routine for blocking files, features for terminating processes of other programs, and ones for deleting the Restore Points. Intriguingly, the ELDAOSLA Ransomware samples also use the same installer names as MessedUp Ransomware's EXE, whose ransom note it borrows.

The ELDAOSLA Ransomware uses TXT and HTA (an advanced HTML pop-up) files for its ransom notes. The messages include memorable details such as ICQ-based communication with the attacker, claims that its encryption is more secure than sensitive diplomatic communications, and a five-file free demo for restoring any files. There isn't a free decryptor for the ELDAOSLA Ransomware's family, which bases itself on Crysis Ransomware and shares similar security. However, paying a ransom is a risky (financially and PC security-wise) method of data recovery, and malware experts can't endorse it.

Although the etymology around this threat's campaign suggests an eastern European heritage, no samples offer up its possible infection methods, exploits, or tactics.

Removing Media from a Frightful Event

Users never should depend on the Windows Restore Points as their only restoration or backup solution. This feature is nearly-universally the target of deleting through Trojans abusing Windows command-line tools. Malware experts see no ELDAOSLA Ransomware ports to non-Windows environments, but readers should recall that file-locking Trojans exist in reasonable numbers in most OSes.

Besides having other, better-protected backups, users can avoid becoming victims by scanning downloads such as e-mail-attached documents with appropriate security services. They also should avoid enabling macros, Java, JavaScript, or Flash, unless necessary. Software updates and healthy password security habits also are appropriate defenses for most users.

If all other defenses fail, dedicated PC security products can identify and remove the ELDAOSLA Ransomware in almost all cases. The same antidote applies just as equally to other members of the Phobos Ransomware family and its underlying group of the Crysis Ransomware.

The ELDAOSLA Ransomware might not do much differently from MessedUp Ransomware's strategy, including its installer's misleading name. Even so, any Windows user who looks down on it without protecting their files will come to learn that encryption routines don't care about trivial details like the words on ransom notes.