Unusual Trojan Behaviour Detected In Spread of Trojan.Ramvicrype

One of the most recent security issues that we have discovered in regards to a computer parasite is a Trojan horse called Trojan.Ramvicrype that uses different methods for spreading.

Trojan.Ramvicrype has uncommon "Trojan behavior" because it encrypts data files on the compromised computer but does not ask the user to visit a Website to get the solution to decrypt the data. This particular Trojan renames the files with a new 'vicrypt' extension which is rather unheard of from other well-known Trojan parasites.

Trojan.Ramvicrype looks for links in the "Recent" folder in Windows and renames all the files in the particular folders that are pointed to by links and encrypts the head section of each file. This will in return lock the affected files. After that, Trojan.Ramvicrype shows the following security notification:

'Vicrypt error! Please Restart Windows'.

Unlike other malicious software that we have seen in the past, Trojan.Ramvicrype doesn't require purchase to get the parasite to decrypt the keys. Trojan.Ramvicrype assumes that the user of a vulnerable computer is going to look for information for helping them to unlock the files. The search usually leads to a deceitful company which provides a malware removal tool but requires a payment for obtaining the software program.

You may be asking, what happens after Trojan.Ramvicrype has infected a computer system and locked multiple files? If a file in the Windows system folder has been opened recently, then all the files in the system folder will be encrypted and the user may not be able to access the Internet to search for any tools, free or shareware versions.

The solution to this issue is utilizing a tool which can be used to fix this security issue instead of manual removal of each infected file. Users are strongly recommended to a reputable spyware removal tool to safely remove the Trojan.Ramvicrype parasite as to not cause any further damage to system files.