How to remove Kaandsona ransomware virus

Kaandsona ransomware fails to run smoothly, therefore fails to encrypt files as well

A new in-development ransomware dubbed Kaandsona virus has been spotted in January 2017^[1]. The virus is also known as Käändsõna ransomware or RansomTroll virus because malware researchers believe it was developed only to troll malware analysts. The word Käändsõna stands for nominals(or declinable word) in Estonian, so virus’ authors might be from this country. This crypto-ransomware appears to be created by a not-so-experienced developer because thanks to bugs in the Kaandsona’s source code the virus crashes^[2] before it encrypts anything. The virus is set to scan the entire system for files that have a matching extension (the virus has a list of file types to encode), and during this process, it also adds .kencf file extensions to encrypted data^[3]. The virus also creates a document with information on how to restore encrypted files. In the ransom note that the ransomware drops on the system, crooks set out their requirements: they demand 1 BTC in 24 hours, and if the victim refuses/fails to pay up within one day, fraudsters promise to delete victim’s files for good.

If this virus managed to encrypt your files with ease, it is likely that you won’t be able to access your personal records any longer. Of course, if you have a backup^[4], you can use it to restore corrupted data, however, before you do that, make sure you remove Kaandsona malware entirely. For that, you should run a system scan with anti-malware software, for example, FortectIntego, but you can also use programs like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. In case you have never been victimized by a ransomware attack, we suggest you read Kaandsona removal guidelines attentively.

Why did I get infected with this virus?

Kaandsona ransomware strikes via infected emails^[5] or fake downloadables available online. Therefore, beware of suspicious content on the Internet. In the majority of cases, computer users get infected with ransomware only because they were unaware of ransomware distribution techniques or simply forgot to follow their common sense while browsing online. If you ever get redirected to a website that is full of download links as well as ads posing as “download” buttons, better quit it. Otherwise, you risk clicking on a wrong link, which will take you onto a vague or even hazardous third-party page. What is more, you should never open suspicious video links that claim to be hiding a compromising video of you. If you are sure that you have never been videotaped in such way, do not click on the link! It is simply a clickbait title to lure you into a malicious website.

How can I remove Kaandsona ransomware virus?

Kaandsona virus must be eliminated successfully if you want to use a safe and virus-free computer ever again. However, this malicious virus could have brought additional malware pieces into the system, so that is why we suggest scanning the entire computer system with anti-malware tools and command them to remove Kaandsona malware entirely. For successful Kaandsona removal, start your PC in a Safe Mode with Networking, then download a recommended malware remover, update it and run a system scan with it. You can find a detailed removal tutorial as well as several data recovery solutions described below.