How to remove .sVn file extension virus

.sVn virus – an updated version of Jaff ransomware

.sVn file extension virus is a new variant of the Jaff ransomware, also known as Jaff Decryption system. The virus uses a combination of RSA and AES-128-CBC algorithms to encode files on the affected computer. Malware appends the .sVn file extension to each of the 400 different targeted files. Following data encryption, it downloads !!!!README_FOR_SAVE FILES.txt file where cyber criminals offer to purchase decryptor for $300.

Usually, malware arrives on the computer with the help of malicious spam emails. On the affected computer, malware modifies Windows Registry in order to run with Windows startup and launch the most important task – data encryption. Once it’s done, the virus starts scanning the system looking for targeted files.

Nevertheless, .sVn ransomware aims at 400 different file types; it prioritizes what to encrypt first. Malware starts with Microsoft Office documents, various image, audio, video, and other popular files. For data encryption, ransomware uses a strong combination of RSA and AES ciphers^[1] and appends .sVn file extension. As a result, victims cannot open or use their files. In order to get back access to the encrypted data, people have to obtain a private decryption key.

Following data encryption, malware drops a ransom note on the desktop and each of the folders that include encrypted files. In the !!!!README_FOR_SAVE FILES.txt cyber criminals provide a unique victim’s ID, briefly presents data recovery instructions and asks to visit a payment website.

The payment site resembles Locky’s website a lot. However, these two cyber threats are not related. In the website, cyber criminals present Jaff Decryptor and offer to use it for $300. Victims are asked to transfer this sum of money in Bitcoins and recommend links where they can buy an alternative currency. The site also gives detailed explanation how to make the transaction and use decryption software.

Unfortunately, if victims do not have backups, their chances to restore files are low. Malware is designed to delete Shadow Volume Copies of the targeted files that are crucial for data recovery. However, paying the ransom may not end up as expected. Victims might experience another malware attack or lose the money. Cyber criminals may take the money and leave the files encrypted. Thus, it’s better to remove .sVn file extension virus and look up for alternative ways to restore files.

Ransomware virus might inject malicious codes into various system processes or install malicious files. It may also open a backdoor to other malware. Thus, delaying .sVn removal is not recommended because it may lead to even bigger problems. The safest way to terminate virus and all its components from the computer is to employ a professional security program, such as FortectIntego.

Crypto-malware may enter the system after clicking on a malicious email attachment

.sVn virus mostly spreads via malicious spam emails. Such emails include an infected attachment or link that leads to the dangerous web site. Cybercriminals use social engineering techniques to trick users into clicking a malicious content. Usually, crooks use the name of well-known companies, such as FedEx or Amazon. Thus, people rarely suspect something shady.

However, phishing emails might be identified^[2]. Before rushing to open an unknown email attachment, you should:

• double-check the information about the sender;
• look up for grammar, spelling, and use of language mistakes;
• review the signature;
  be critical and think whether you should have received such email at the first place.

Removal of the .sVn file extension virus

.sVn removal has to be performed using reputable malware removal program, such as FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Trying to locate and delete ransomware-related files and components is not recommended because it may lead to irreparable system damage. Thus, in order to avoid more problems, you should rely on professional software.

Before installing security program, you may need to reboot the computer to the Safe Mode with Networking. It helps to disable the virus if it prevents from downloading or accessing malware removal tool. When in Safe Mode, you have to run a full system scan several times.

Once you remove .sVn malware from the system, you can use backups or try alternative data recovery methods presented below.