How to remove qkG ransomware virus

qkG encrypts MS Word files only

qkG ransomware is a unique example of file-encrypting malware. It is written in Visual Basic for Applications (VBA) macro and is designed to encrypt Microsoft Word documents only using XOR cryptography.^[1] The virus has been first spotted on the 12th of November.

According to Trend Micro blog post,^[2] the first samples of the ransomware was uploaded from Vietnam. However, the active distribution has not started yet, and it’s still in development stage. However, security experts think that qkG virus might be an experimental ransomware.

However, if you ever encounter this cyber threat, you should not transfer demanded $300 in Bitcoins. You should remove qkG from the computer with FortectIntego or another reputable malware removal program to keep the system virus-free.

The analysis of the virus revealed some unique features of the qkG:

• It encrypts only one type of file – MS Word documents. Typically, ransomware-type cyber threats targets as much as possible popular file types.
• Malware employs Auto Close VBA macro – the same technique has been used by a Lukitus, one of the latest versions of Locky ransomware. This feature allows executing malicious macro when victims close the document.
• The virus encrypts the content of the infected document, but leave the file structure and filename the same.
• It is designed to corrupt only ActiveDocument – only opened Word files will be encrypted.
• Ransomware can be activated from the infected document on a clean computer.

The crypto-malware program is most likely to spread via spam emails that include Word documents with malicious VBA code. Once a user opens it, it asks to enable editing feature, and if a user agrees to do it, the malware is dropped on the system. Then qkG modifies Windows Registry keys and lower’s Word’ security settings in order to activate malicious macro commands without interruptions and starts corrupting files.

The unseen data encryption procedure

On the affected device ransomware injects malicious code to normal.dot file that is a basic Word template. qkG malware also adds Document_Open() autostart macro command to the targeted document and makes a copy of itself. Then crypto-malware uses XOR cipher and the same key to corrupt Word files. The encryption procedure starts when a victim closes the document.

At the end of the each compromised document, the virus adds a short ransom note that includes the main information: the size of the ransom and Bitcoin wallet address. Victims are asked to pay the ransom, and most likely they receive qkG decryptor via email. However, researchers tell that currently, the malware uses the same hardcoded password: “I’m QkG@PTM17! by TNA@MHT-TT2”.

Additionally, malware is self-replicating. It means that it makes a copy of itself to normal.dot file and can spread with the help of it. It means that if an encrypted document is opened on non-infected PC or laptop, the malicious program sneaks inside it and starts its activities.

Therefore, if your colleague gives you a USB with a bunch of Word files or sends you an important document, first of all, you should scan it with anti-virus and make sure that its safe to open. Additionally, you will have to spend time with qkG removal and data recovery procedure.

The Word-encrypting malware tricks users into opening malicious document

At the moment of writing, the major distribution campaign hasn’t started yet. However, researchers assume that qkG is most likely spread via malicious spam emails and with the help of social engineering tricks people into downloading Word document with malicious macro commands.

The content of the e-letter might seem legitimate and express the urge to open the attachment. It might be presented as invoice, statement or other important documents. When a user opens it, the malicious Word file asks to enable macros to view the content. Hitting the “Enable Editing” button runs VBA code and installs malware on the system.

Even though malware is not actively spread yet, cyber security experts from Les Virus^[3] suggest staying vigilant with received emails. Before opening email attachment always make sure that you can trust the sender and the provided issue is real.

Removal of the qkG

qkG removal is performed the same way as other crypto-viruses. You have to employ a reputable malware removal program, such as FortectIntego or MalwarebytesMalwarebytes and eliminate this cyber threat automatically. Attempts to eliminate this parasite manually may lead to irreparable damage to the system. Thus, you should not risk.

However, the virus might block security software. In order to bypass these restrictions, you have to reboot the computer to the Safe Mode with Networking or use System Restore method. Both methods are explained below and help you to remove qkG automatically.