How to remove Spora ransomware and decrypt your files

March 3, 2017 Tim Kas 1

Spora Ransomware is file encryption virus possibly originating in Russia. It encrypts user files, documents, photos, videos using RSA encryption. Spora does not rename encrypted files. During the process virus generates private key, that, in turn, encrypted with AES encryption. Spora Ransomware is complex infection and certain efforts needed to break it encryption. Currently antivirus companies are unable to find decryption key, and the only way to restore files infected by Spora is backup.

How to remove Shade Ransomware and decrypt .no_more_ransom files

January 23, 2017 Tim Kas 2

Shade is a ransomware that is very similar to Wildfire, Hades Locker, CryptFIle2 (or CryptMix) and MarsJoke (or JokeFromMars). Once Shade ransomware has infected your computer, it encrypts various data. After finishing encrypting process, this ransomware adds .no_more_ransom extension (what an irony) to the name of all the encrypted files. It will create a text note named nomoreransom_note_original.txt / YourID.txt / hacked.txt in each folder with the encrypted data and on your desktop.
There are two features of this ransomware that differs it from other ransomware programs. First, it’s the fee for decrypting files. 30$ is rather smaller ransom in opposition to 500-1000$ (usually ransomware developers demand this amount of money).

How to remove PayDay ransomware and decrypt .sexy files

December 20, 2016 Tim Kas 0

Payday is a ransomware based on HiddenTear source code and developed by Portuguese hackers. Payday derives its name from popular game of the same name. The purpose of the infection is to deny access to the personal data so it encrypts them using complex AES cipher. At the time of encryption, Payday appends the names of encrypted files with the .sexy extension. Although, the data encryption is a time-consuming process, the users usually don’t notice nothing suspicious. The whole procedure runs in stealth mode. Once encrypted, virus creates HTML file saving it on the desktop.

How to remove Osiris ransomware and decrypt .osiris files

December 6, 2016 Tim Kas 5

Osiris is new crypto-virus, that belongs to Locky ransomware type. After finishing the process of encrypting files, malware adds .osiris extension and alters filenames. Your files get such names: [8_random_characters]-[4_random_characters]-[4_random_characters]-[8_random_characters]-[12_random_characters].osiris. Virus blackmails user to pay ransom of 2.5 BitCoins (~$1880) for file decryption. Osiris ransomware creates 3 files on users computers: OSIRIS.html, OSIRIS_[4_random_characters].html and OSIRIS.bmp and copies them to the folder with encrypted files. Those files contain instructions for users to pay the ransom on Bitcoin wallet.