garryweber@protonmail.ch Ransomware

The 'garryweber@protonmail.ch' Ransomware is a file-encrypting Trojan that enciphers your files to block them and then profits by offering a data recovery application at a price. Since con artists-provided decryptors may be undependable recovery solutions, most PC users should ignore the ransom demand and seek alternatives, as described in this article. Traditional anti-malware protection can block or remove the 'garryweber@protonmail.ch' Ransomware either before or after it encrypts any of your files.

Brazil Suffers Another Round of File Ransoming

While the bulk of cyber security publications focus on threats either attacking English speakers or broadly compatible with them, some threat campaigns run with aims on other parts of the world. The 'garryweber@protonmail.ch' Ransomware may be the first 2017-era file-encryptor Trojan to attack Brazil, although 2016 also saw similar incidents, such as the well-disguised Anatel Ransomware. As usual, the intention is to block your files after gaining system access and then delivering ransoming notifications for encouraging payments to undo the attack.

Threat actors are disguising the 'garryweber@protonmail.ch' Ransomware's executable as FileSpy, a utility for viewing in-depth file data. After opening, the 'garryweber@protonmail.ch' Ransomware encrypts local data with an algorithm malware experts still are investigating (with AES being the most likely, but not sole suspect). It appends extensions to the files it encrypts, with the new extension including a unique ID number and the threat actor's e-mail address. Regardless of whether or not the victim changes the filename back to the original one, the encrypted file is unreadable and is only recoverable through a decryption process.

The 'garryweber@protonmail.ch' Ransomware also includes two additional components for promoting the purchase of its threat actor's decryptor. While malware experts see strong resemblances between the 'garryweber@protonmail.ch' Ransomware's Web page-based ransom note and those of the Globe Ransomware family, no hard affiliation is verifiable currently. Along with placing the local Web page on your desktop, the 'garryweber@protonmail.ch' Ransomware also hijacks the desktop's wallpaper and replaces it with a Portuguese and English message redirecting your attention to the previous file.

Opening Your Files without Paying Bitcoins for Them

Trojans disguising themselves as other programs most often distribute themselves on torrent networks and free software sites with poor hosting standards. However, Trojans of the 'garryweber@protonmail.ch' Ransomware's category also, frequently, target unprotected businesses, government systems, and NGOs, where they may compromise a PC through e-mails or gain installation through a threat actor cracking network passwords. Most of these incidents are wholly preventable by the victims using anti-malware tools for scanning new files, rotating passwords, and paying close attention to the fundamentals of their browser's security features.

At this time, no cyber security organizations are hosting free decryptors for the 'garryweber@protonmail.ch' Ransomware, but victims may consider providing samples on request to assist with the development of such software. Nevertheless, even full sample availability doesn't guarantee that the encryption algorithm is breakable, and malware experts strongly advise backing up your work to prevent threats of this category from causing any irreversible harm. Currently, slightly under half of most major brands of anti-malware protection should catch and remove the 'garryweber@protonmail.ch' Ransomware before it begins encoding your files.

Whether it's a cheap copycat of the Globe Ransomware or an actual update to it, the 'garryweber@protonmail.ch' Ransomware stands to show that even just a few minutes of backing up your files always is worth the trouble.