Syrk Ransomware

The Syrk Ransomware is a file-locking Trojan that encrypts your media for keeping it from opening. The Syrk Ransomware also can maintain aggressive system persistence and delete your files on a timer. Users should disable the threat through traditional security guidelines and restore from a backup after their anti-malware solution removes the Syrk Ransomware immediately.

The Jigsaw Ransomware Gets Some 'Anonymous' Competition

The Jigsaw Ransomware's modest empire builds itself on a foundation of looping, timer-based deletion as an intimidating backup for its encryption attacks. Such features aren't standard among file-locking Trojans, but a new one without any links to Jigsaw Ransomware is implementing a variation of this tactic. The Syrk Ransomware is a possibly-in-development project that can hold content hostage or wipe it off the drive.

The Windows-based the Syrk Ransomware claims no membership to any previously-operational family of Trojans and isn't available as a Ransomware-as-a-Service. However, its attacks include such traditional features as encrypting documents or pictures, adding 'syrk' extensions to their names, and creating ransom messages. Malware analysts see two variants of the latter: a Notepad file and a pop-up. Only the second of the two includes the timer.

This countdown is critical for being the prerequisite that triggers the Syrk Ransomware's deletion function. Just like the Jigsaw Ransomware, at zero, it starts erasing files. Unlike the previous threat, however, the Syrk Ransomware attacks specific locations, such as the desktop. The escalating design of this looping file eraser is a powerful psychological tool. As with Jigsaw Ransomware, it encourages victims into paying a vague ransom in a questionable currency – without considering that it may get them nothing.

Terminating Trojans before They Do the Same to Your Processes

Encryption and ramping-up file deletions are more than sufficient dangers for any computer owner without a backup. Unfortunately, the Syrk Ransomware's payload has more features that malware experts verify as endangering the system's security. The Trojan can auto-terminate memory processes associated with various tools. Most of these applications are related to monitoring your PC or controlling the programs running on it – such as Task Manager or Process Hacker.

Users should reboot their machines through peripheral devices, such as an appropriate USB, or use Safe Mode for terminating the Trojan's persistence immediately. After regaining control, they can proceed with total system disinfection. Different versions of Windows include various means of accessing Safe Mode; consult Microsoft for the appropriate procedure.

Infection prevention through safe browsing habits remains critical for all Windows users. While anti-malware products of three out of four brands will delete the Syrk Ransomware, decryption and file recovery remains speculative.

The Syrk Ransomware comes as a surprise to an illegal industry that's, mainly, run by big-name families. It's an up-and-comer, but the payload it wields should give anyone motivation for double-checking their backups.