SGUARD Ransomware

The SGUARD Ransomware is a variant of the Outsider Ransomware, a file-locker Trojan. Like its ancestor, this Trojan may block your media by encrypting it and leave behind ransom notes in Notepad TXT formats. Users should ignore the Bitcoin ransom and recover through other solutions after having a trusted anti-malware program remove the SGUARD Ransomware.

The Program 'Guarding' Files from Their Owners

A variant of the little-known Outsider Ransomware is attacking users in Europe. Like hundreds of others, it keeps up the tradition of weaponizing encryption as a get-rich-quick scheme. The new Trojan, the SGUARD Ransomware, contains the previous, working attack for locking media, but also affects programs' essential files. While its profitability is an unanswered question, malware experts do confirm activity related to its campaign payment account that might indicate that its assaults on unprotected Windows systems aren't in vain.

The SGUARD Ransomware leverages what malware researchers estimate as an AES-based encryption routine, one of the most popular tactics among Trojans, for blocking the user's files. Such attacks, usually, limit themselves to JPG pictures, DOC documents, and other data. The SGUARD Ransomware is somewhat more invasive for including EXE or executables content in its list of appropriate targets, which could require reinstalling any affected programs.

Besides the above and adding the 'sguard' to filenames, malware experts are confirming one, last symptom: the updated Notepad message. The SGUARD Ransomware uses a variant of the Outsider Ransomware's instructions, with a different title bar and updated ransom credentials. The latter, still, depends on Bitcoins, and the Trojan's wallet is showing activity that may correlate with ransoms or other, legally-dubious transactions. Victims should remember that paying the Bitcoin fee leaves them without recourse for criminals who don't oblige their targets with the promised decryption help.

Defeating a Guardian Protected by Cryptographic Armor

No freeware is compatible with all of the world's file-locking Trojans universally, and the SGUARD Ransomware belongs to a small family that, unfortunately, has limited solutions available. Precautionary guidelines against threats of this classification, therefore, stress maintaining one's backups securely and keeping at least one backup location external from any Internet-connected device. USB drives, CDs, DVDs, and cloud services are examples of backup options that can protect your files from the SGUARD Ransomware.

Users also should avoid leaving their PCs vulnerable to drive-by-downloads and other attacks that distribute file-locker Trojans commonly. Disabling browser features like Java or Flash, installing updates only from their official sources, and scanning possibly-unsafe content (such as e-mail attachments or torrents) can protect the majority from indiscriminate infection vectors. Server administrators also should take precautions against potential RDP and brute-force attacks.

There are no notable self-defensive features in the old Outsider Ransomware or its new the SGUARD Ransomware variant as per malware experts' last reports. Most security programs with threat-detection functions should remove the SGUARD Ransomware as soon as they detect it.

All that the SGUARD Ransomware is guarding is one threat actor's 'right' to make money by keeping people from the data on their computers. Unfortunately, that information includes core program files, which makes the SGUARD Ransomware a little more deadly than the average, extortionist Trojan.