How to remove Promos ransomware

Promos ransomware is yet another variant of the infamous Djvu virus that drops “_readme.txt” ransom note after the data compromise

Promos ransomware is a file locking virus that was spotted by security researcher Michael Gillespie in mid-February 2019.^[1] The malware belongs to STOP/Djvu ransomware family – one of the most prolific crypto locker. Once the machine is infected, it uses AES cipher to lock up personal data like photos, videos, music, databases, PDF, etc. and appends .promos file extension. From that point of time, victims are unable to access any of their personal files, as a private key that is stored on a remote server is needed to decipher them. Users get all the details on what to do next right after Promos virus drops a ransom note “_readme.txt,” which explains that they need to pay $980 in bitcoin in exchange for the decryptor. Interestingly, crooks are using the same email they used in the previous version – Blower (blower@firemail.cc). While this ransomware variant is not decryptable, industry experts^[2] recommend not contacting criminals and instead use alternative file recovery methods.

Promos ransomware is most likely distributed with the help of methods that STOP virus used previously, including:

• Key generators, cracks and activators like KMSpico;
• Fake updates;
• Spam email attachments;
• Brute-force attacks;
• Exploit kits, etc.

Once in the system, Promos ransomware attempts to contact the Command & Control^[3] server. If such communication is not possible, the virus will perform offline encryption using a hard-coded key. In case of successful connection, user's ID and the decryption key is uploaded to the C2 server. Additionally, the server uploads a ransom note onto the victim's computer.

In addition to locked up files, Promos ransomware also modifies system settings and files in order to operate smoothly. It launches several processes, modifies and ads registry keys, shuts down some programs, etc. Due to such modifications, Promos ransomware removal might be sometimes complicated.

Promos virus authors demand $980 in Bitcoin for the decryptor, although they “offer” a 50% discount if the contact is made within 72 hours of the initial infection. Regardless if the sum is considered large or small by your standards, you should never pay the ransom.

Cybercriminals are known to ignore victims, even after payments are processed, so the risk of getting scammed is pretty high. Additionally, such action would only prove threat actors that Promos ransomware works, and will keep evolving malware further, infecting more victims worldwide.

Thus, remove Promos ransomware with the help of reputable anti-malware engine and then try to recover data with third-party applications, or other methods (backups, Windows Previous Version feature, etc.). Finally, we recommend you scan your device with FortectIntego in order to recover from virus damage.

Ransomware distribution methods

Ransomware authors are continually looking for new and more sophisticated methods to distribute the malicious payload in order to increase the infection rate, as well as profits obtained from this illegal business. Some distribution methods are highly advanced, such as exploit kits or brute force attacks, and special tools are needed to be successful in such schemes. Nevertheless, users can protect themselves by using strong passwords and updating their software, as well as the operating system as soon as security patches are released.

However, probably the most popular and also simple methods remain malware hosting on hacked or malicious sites, in addition to spam email attachments or malicious links. This is where users need to be extremely vigilant, as their interaction is required to get infected. Thus, never download such tools like keygens, cracks, repacked installers and similar. Additionally, avoid high-risk sites like torrent, gambling, porn, etc.

Finally, you should be particularly careful of phishing emails that might end up in your Inbox. While built-in scanners often catch suspicious messages, some of them slip through. Thus, do not open suspicious attachments or click on links.

In case you are unsure whether or not the file is safe to open, scan it with your anti-virus software or tools like Virus Total.

Promos ransomware elimination instructions

For Promos ransomware removal, you should employ anti-virus software that is capable of recognizing the threat. It is not unusual that not all AV engines detect the same malware infection, and they use separate databases. Thus, you might have to use several different tools until you find the one that can remove Promos ransomware. Nevertheless, considering the malware comes from Djvu virus family, most security applications should be able to detect the threat.

Once you are sure that no traces of Promos virus are left, scan your device with FortectIntego. This tool will ensure that your computer operates normally after the devastating ransomware infection. Finally, connect your backup device and recover all your files. In case you have no backups, check the section below for alternative solutions.