How to remove Kasiski ransomware virus

Kasiski ransomware is the cryptovirus that uses unusual prefix for renaming encrypted files 

Kasiski ransomware is the virus that gets photos, documents, archives, video files, and other commonly used data encrypted to have the opportunity for a ransom demand. This ransomware spreads around the world and frustrates users with the money demanding message that appears on the desktop as a wallpaper and a text file. Criminals claim to offer the decryption tool, but that is all for faking legitimacy and trust. Cryptovirus creators only care for your money, so don't even consider paying them.

Kasiski virus is created by criminals who speak Spanish and want $500 from each victim. The threat is targetting Hispanic users, so it can be distributed around the world easily. Also, it is possible that some versions of the particular threat can aim to English-speaking users and lock files, demand ransoms. 

Kasiski virus appears to be a new type of ransomware^[1], which, surprisingly, is created for an x64^[2] version of Windows. It seems that the threat cannot even work on 32-bit devices. The name of this ransomware is derived from the appendix that the original names of corrupted files get. The virus renames files during the encryption process. Unlike other ransomware, it doesn’t add extensions but appends [KASISKI] prefix to the file names.

The virus can be installed by the user himself, without knowing what kind of file/program it is. As we have already mentioned, Kasiski malware encrypts^[3] almost all files with a strong cipher and then changes desktop background with a basic yellow picture with some text written on it.

Then the virus drops a file called INSTRUCCIONES.txt (on the desktop) which is known to be a ransom note – a message from malicious actors. Cybercriminals typically create such files on the system after corrupting victim’s data. They aim to inform the victim of how the corrupted data can be recovered, and usually, they demand money immediately.

In this ransom note, authors of Kasiski ransomware ask the victim to pay a ransom in Bitcoins. They promise to provide a “DECRYPT TOOL” for $500. Here's how the beginning of the ransom note looks:

Informacion importante

Este es su numero personal (NO LO BORRE) =

Todos sus archivos fueron encryptados (bloqueados)/

Para restaurar sus archivos usted necesita un (DECRYPT TOOL)

Nosotros le ofrecemos el (DECRYPT TOOL) para restaurar sus archivos, su costo es de ($500) quinie

However, we never advise victims to pay the ransom because obviously, cybercriminals are not the people you can count on. Therefore, we usually advise victims to remove Kasiski ransomware from the system using anti-malware tools because such software can easily find and remove the malware from the affected device.

Unfortunately, for affected system files, you should install a program designed for system repair such as FortectIntego that can help with Kasiski virus damage. Then find a backup, which is needed for data recovery. If you do not have a needed backup^[4], you can try data recovery methods provided below the article.

However, the virus is under analysis at the moment, researchers might come up with Kasiski decryption tool after a while. Until then, take care of the machine, clean virus traces, try to secure your PC from possible additional malware attacks, and try to restore all the encoded data with files stored on external devices. Make sure to double-check before adding any data on the machine, because you may lose your files if any leftover ransomware files trigger the secondary encryption round. 

Traditional ransomware distribution techniques

How ransomware crooks distribute their malicious programs depends on their programming skills. More advanced ones employ hacking skills to spread malicious files via ad networks, others use exploit kits^[5], and finally, some scammers use Trojans to infect devices with ransomware.

However, the most efficient technique that is the most used by such criminals so far is also a very basic one. Malware authors only need to compose convincing email letters and send them out to hundreds or even thousands of victims. The message typically says that the user needs to view “attached contents.” In most cases, attachments state about some kind of financial data like order information or invoices.

However, we advise users to think whether a) they know the sender personally or not; b) were they expecting to receive such an email or not. If the answer to these questions is no, better stay away from such letters and delete them ASAP. Always do so with emails you were not expecting to get or notifications that contain red flags like typos, grammar mistakes, or shortened hyperlinks. Those can also send you to macro-laced^[6] sites or trigger direct downloads of malicious files, malware.

Kasiski ransomware virus termination procedures include AV tools

If your computer was compromised, remove Kasiski ransomware immediately using proper anti-malware tools. Ransomware-type programs often come with various additional features such as an ability to install new malware, transmit personal information, and even more.

To make your PC safe again, it is recommended to use powerful anti-malware software such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Full Kasiski ransomware removal guidelines are given down below – follow them carefully, do not rush! Using those methods may help you with the proper AV scan too.

You do not want to miss infectious components because if you do so, they might weaken your PC’s security, which would allow other viruses to infiltrate the system easier. When you are done with the proper elimination of all Kasiski virus components, you can go for the data recovery solutions that are also listed below. Make sure to repair system files using FortectIntego before though.