Purge Ransomware

Posted: August 18, 2016
Threat Metric
Threat Level: 10/10
Infected PCs 753,690

Purge Ransomware Description

The Purge Ransomware is a Trojan that blocks your files by encrypting them and uses pop-ups to ask for money for their restoration. You can restrict the scope of most file encryption-based threats by keeping sufficiently-secure backups of their information. Although you should use anti-malware tools for uninstalling the Purge Ransomware, they can't perform decryption functions, and malware analysts encourage exercising preventative security measures particularly, when possible.

When 'the Purge' Comes for Your Savings

Although purging is a term one might associate with everything from eating disorders to cathartic, spiritual self-cleaning rituals, a new threat campaign soon may make it most closely linked to Trojan-based theft. The Purge Ransomware is a recently-detected file encryption Trojan with claims of using RSA encryption to lock the information of its victims. The campaign also incorporates social engineering techniques malware experts saw popularizing themselves in old attacks.

The Purge Ransomware uses a simple file-scanning content to isolate content not necessary for the basic maintenance of the Windows OS, such as JPG images. The Purge Ransomware then uses an encryption algorithm malware experts still are identifying to encrypt each file and adds a '.the Purge' extension to the end of each name. These extensions don't replace any preexisting extensions, which remain intact.

Malware experts also found the Purge Ransomware's ransom note, which it loads after the encryption routine, to be of particular interest. While shallower Trojans (such as most versions of the Troldesh Ransomware) restrict themselves to displaying an e-mail address, the Purge Ransomware provides an interactive HTML pop-up. This Web page offers customizable contact addresses (including a Bitmessage-based alternative to conventional e-mail) and a personalized ID field. It also includes multiple time-based warnings regarding not paying the Purge Ransomware's ransom, after which its administrators claim they will delete the key required for restoring your encrypted content.

Purging an Attempt at Extortion from a PC

The Purge Ransomware embodies the dualism inherent in any file encryption attack. Although a remote threat actor may claim that no alternatives can restore your data safely, the same ransom messages also warn against taking even minor delays before sending payments. The continual popularity of the Purge Ransomware and other threats of its category also is a clear sign for PC owners to continue keeping stringent backups of any important information, with which they can ignore decryption as a supposed necessity.

Although anti-malware products traditionally don't provide decryption options, some reputable PC security organizations do offer decryption services for major Trojan families at no charge. However, these services aren't always available, and malware experts recommend, instead, taking steps to keep the Purge Ransomware from being installed. Active anti-malware solutions also may remove the Purge Ransomware before it finishes encrypting your hard drive, when relevant.

The work put into the Purge Ransomware's extortion message is more than just an attempt to collect money efficiently, but also a sign of con artists needing to force their victims into self-destructive actions with a minimum of forethought. Taking a moment to pause and inspect your security and recovery options before paying a threat author may pay more than one would assume.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Purge Ransomware may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%LOCALAPPDATA%How to restore files.hta File name: How to restore files.hta
Size: 4.58 KB (4580 bytes)
MD5: 31a9745b4ea451a72e08518c4f6d7b21
Detection count: 10,938
Mime Type: unknown/hta
Path: %LOCALAPPDATA%
Group: Malware file
Last Updated: September 30, 2016

More files

Home Malware Programs Ransomware Purge Ransomware

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.