How to remove SuperB ransomware virus

SuperB appends new file-extension – .enc

SuperB is a file-encrypting virus^[1] that is designed to take user’s files to hostage and swindle the money from the users. Originally, the ransomware appends .superB file extension. However, since September 2017, the malware also adds the .enc suffix to the targeted files.

However, there is still a veil of mystery enshrouding this malware. There is no information whether it deletes shadow volume copies. Most likely it uses RSA-2048 or AES-256 algorithms to encode data.

The SuperB virus has its own website. The payment site has three sections. “pay by BTC” instructs how to purchase bitcoins. In exchange to the affected files, the perpetrators ask to buy $300 worth-bitcoins and transfer the files to the specified bitcoin address.

SuperB ransomware payment site includes several links to wikiHow to help users buy bitcoins. Interestingly, the infection also offers a video about the decrypter. However, the link redirects to a questionable YouTube site with a short message that the video is unavailable. Thus, it raises assumptions that the crypto-virus might be still under development.

In case victims run into technical difficulties, they should use the indicated form below the support section. Besides entering the ID (which is displayed in a ransom note), affected users should also disclose email address and confirm it with a captcha code.

Cyber criminals claim to contact victims within 24 hours. According to them, if the transaction is completed without any problems, users’ files, which bear .superB file extension, should be decrypted. However, in case of ransomware, it is never recommended to pay the ransom as the probability of data retrieval is always very small. Thus, it would be better to remove SuperB malware. FortectIntego or MalwarebytesMalwarebytes will help you delete the infection.

Criminals presented a new version of SuperB virus

The new version of SuperB ransomware has been detected at the end of September 2017. The virus is written in Python. During data encryption, it overwrites the files with the ransom note. It also creates copies of the original files and appends .enc file extension. It aims at pictures, videos, documents and other files stored on the targeted device.

The virus spreads as a test.exe file which is most likely to be obfuscated and attached to the email. Once users open it, the executable is dropped and loaded on the system. Once data encryption is over, users are delivered a ransom note in Word document which contains links to the payment website.

The payment website offers to obtain the SuperB decryptor. Victims are asked to transfer $300 in Bitcoins. However, doing that is not recommended because there’s no guarantee that you will be able to get access to your data.

Malware might attack computers using different strategies

Most likely, this version of crypto-virus is used to spread via corrupted sites or torrent files. There are chances that corrupted apps^[2] might facilitate SuperB hijack.

In addition, the malware may also hide in spam emails supposedly sent from official institutions. Since it functions via a trojan, bear in mind that cyber protection is vital. Besides vigilance, update security tools.

Instructions for SuperB elimination

Since the virus is still likely to be under development, SuperB removal should not cause much trouble. Nonetheless, if you cannot launch malware elimination tool (e.g., [d]1, SpyHunterCombo Cleaner), take a look at the below instructions. 

If you reboot the system in Safe Mode or perform System Restore, you will be able to remove SuperB virus. Note that data recovery should be performed after you eliminate the threat completely. Due to low activity of the malware, it is likely to target only specific, for instance, British^[3] users. Finally, it is recommended to uninstall the decrypter, if you already installed it. Even if it decrypts files, it may leave malicious files which will benefit future hijack.