VIRUS Ransomware

The VIRUS Ransomware is a file-locking Trojan from the family of the Crysis Ransomware or the Dharma Ransomware. Besides blocking content by encrypting it, the VIRUS Ransomware can change file names by adding on extensions, destroy backups, and create ransom messages, besides other possibilities. Having a responsible recovery system for your files, and anti-malware products for removing the VIRUS Ransomware on sight, are strongly advised.

Catching a Viral File Problem

A file-locking Trojan with pretensions of being a virus is out and targeting users in the wild, with infection methods remaining uncertain to the cyber-security industry. While malware researchers confirm the new Trojan's family group as being the ever-numerous Crysis Ransomwar (or the Dharma Ransomware), many of its other factors are up in the air. What's tangible, however, is the degree of danger that it poses to any careless user's files.

The VIRUS Ransomware is Windows software whose executable takes up less than a megabyte. After opening, it sets a Registry key for itself and creates various processes using Windows tools, such as CMD. It then deletes the Restore Points with a hidden command and begins encrypting the user's files – such as documents – with a secure combination of algorithms.

Users can find which files aren't working by looking for the all-caps 'VIRUS' extension that the VIRUS Ransomware adds, along with an AOL e-mail address. However, they shouldn't take this symptom as an indicator of the threat's classification type. Unlike a 'true' virus, the VIRUS Ransomware can neither insert its corrupted body of code into other files nor self-reproduce. Accordingly, it holds no more dangers than those represented by other Ransomware-as-a-Service Trojans from its family, such as the Asus Ransomware, the Uta Ransomware, the Wiki Ransomware and the long-ago Sepsis Ransomware.

The Medical Treatment for an Extortionist Disguised as an Illness

The VIRUS Ransomware operates on the same basis as all of its relatives: taking files hostage for forcing victims into paying a ransom for the unlocking service. Modern versions of the Dharma Ransomware are, regrettably, not decryptable by any practical means and are expected to remain so indefinitely. Since this issue is so common among file-locking Trojans, malware researchers recommend all users on Windows devices, especially, make extra backups.

Threat actors can take advantage of a hired Ransomware-as-a-Service Trojan by propagating it through multiple means, many of which are in heavy use this year. The VIRUS Ransomware may have its installer inside of an e-mail attached document that runs macros or use a third-party Exploit Kit from within the victim's Web browser. Avoiding macros in documents and disabling JavaScript, Java, and Flash will curtail many of these dangers.

Paying ransoms has just as much chance of resulting in nothing as it does in giving the victim any help for recovering files. However, this family has few stealth advantages, and malware experts are rating most security solutions adept at identifying it. Such anti-malware utilities should remove the VIRUS Ransomware before it becomes a problem.

While users knowing the difference between a virus and the VIRUS Ransomware is helpful, most PC owners shouldn't brush next to the Trojan's campaign, in the first place. Browsing the Web with common-sense safety habits intact will keep your files exactly as you want them to be: unencrypted.