JSWorm Ransomware

The JSWorm Ransomware is a file-locking Trojan that can hold your digital media hostage by encrypting it. Its attacks also provide ransom notes for the threat actor's unlocking assistance, although the users should make every effort to avoid paying for what may be a fake decryption service. Victims can contact members of the cyber-security community for their data restoration help and use anti-malware products for removing the JSWorm Ransomware securely.

Criminals Forgetting the Second Half of Handling Exceptions

Samples for file-locking Trojans are showing evidence of a new kind of file-locking Trojan with vague genealogy. While the JSWorm Ransomware is wholly functional, some lapses in its exception-handling procedures may make it impossible for decryption to occur. For the victims, the consequence is paying a ransom and getting nothing back, whether the threat actor plans on helping or ignoring them.

While the JSWorm Ransomware's name implies that it's a worm, no worm-based features are available in the samples that malware experts can see. However, any victims should maintain an awareness of the vulnerability of network-mapped and unmapped drives to encryption and other, non-consensual changes to their files. What means the JSWorm Ransomware is using for locking these files is unknown, but most threats in this category will abuse AES, XOR, or RSA-derived algorithms for encrypting media quickly and securely.

Besides an HTML ransom note that the JSWorm Ransomware misappropriates from old campaigns of similar, file-locking Trojans, the other feature of importance that it includes is an e-mail-based transferal of the customized decryption information. While the author formats this function as a traditional 'try-catch' block, he omits anything in the 'catch' portion. This issue means that, if there are any problems with the sending of the e-mail, the decrypting information for unlocking the user's media is lost, possibly, forever. A classic example of such a scenario would be if the JSWorm Ransomware infected a PC with a temporarily disabled Internet connection.

Pulling the Worm Back Out of Your Files

The JSWorm Ransomware is threatening to users without more than default or localized backups for their work documents, picture collection, music libraries, and other media formats of notable popularity especially. Malware experts advise keeping backups saved to other devices as frequently as possible for their protection from both encryption and other problems, such as the endemic Shadow Volume Copy-wiping attacks. Some members of the cyber-security community do offer limited decryption help with threats like the JSWorm Ransomware, however, and could provide a last-resort restoration possibility.

There's no clear path between the JSWorm Ransomware's current infections and how it's compromising these targets. File-locking Trojans can arrive through modified (or merely misnamed) torrents, take advantage of Web-browsing exploits using JavaScript or Flash, and be delivered by criminals who brute-force their way into networks directly. Most anti-malware programs, regardless, should provide adequate protection and block or remove the JSWorm Ransomware when appropriate.

Following the instructions that the JSWorm Ransomware hands out can wind up with the victim being out of money with nothing to show for it. Paying under duress, while it's a fast way of resolving a problem supposedly, is, often, a shortcut to nowhere.