PassLock ransomware – a cyber virus that alters Windows OS settings while seeking to encrypt files
PassLock ransomware, found by S!Ri,[1] is claimed to be a serious cyber infection that targets English-speaking users who employ Windows computers. The malware starts with altering the Windows Registry and Task Manager sections. When new malicious processes and registry keys are added to those locations, including the main PassLock.exe process, the virus is able to lock up all files that are discovered on the infected device. The encryption process begins when launching the AES-256 cipher and targetting all types of files and documents that are found on the infected Windows machine.
When PassLock ransomware finishes the encryption process, it applies the .encrypted appendix to each filename in order to mark its activity. When all files are renamed, the malware loads a pop-up message that provides the victims with information on what has just happened. The note claims that the ransomware virus has locked up all files and you can only restore them from a backup. However, this ransom message is not a regular ransom-demanding note as it does not provide any information on the fee that needs to be paid for receiving the decryption software.
Crooks are likely to scare the victims and leave them with no choice of file recovery. They claim that the files should be deleted from the infected device as they only take space. Also, hackers state that the victims are free to get rid of the virus now. However, if you are ever provided with any type of ransom demand by PassLock virus, you should not agree to pay any monetary fee as there is a big risk of getting scammed by criminals.
| Name | PassLock ransomware |
|---|---|
| Category | Ransomware/malware |
| Encryption | This malicious cyber infection performs the encryption process on all types of files, including photos, audios, videos, databases, word documents, etc. The malware uses the AES-256 cipher to lock up all the data that is found on the infected Windows computer system. Afterward, the .encrypted appendix gets attached to each filename |
| Related file | When the ransomware virus enters the computer system, it brings the PassLock.exe executable that has been detected as malicious and unsafe by 50 different AV tools, according to VirusTotal |
| Message | PassLock ransomware virus provides a pop-up window that introduces the victims to what had just happened. Users are threatened that there is no way to restore the locked files unless they own backups |
| Distribution | The malware often escapes to different computer systems through p2p networks such as The Pirate Bay, hacked RDP that includes weak configuration, and email spam messages that hold malicious attachments or infectious hyperlinks |
| Removal | If you have been dealing with the cyber threat lately, you should get rid of it ASAP. Employ reliable antimalware software that can help you to terminate the virus properly |
| Fix | If you have discovered any compromised or damaged areas on your Windows device, you can try repairing them with the help of FortectIntego |
| Data recovery | Rather than taking any risks and paying demanded ransoms, you should try other data recovery alternatives that have been included to the end of this article |
According to VirusTotal,[2] PassLock ransomware and has been detected through its main malicious payload – the PassLock.exe executable. 50 different types of antivirus programs have spotted this malware string. Some of the detection names include Win32:Malware-gen, Generic.Ransom.Small.00188FAB, Malware@#3881l2isic0n1, Mal/Generic-S, etc.
Even though PassLock ransomware does not provide any particular ransom demands in the ransom message, you still should be aware of any types of payment requests that cybercriminals might still outline later. Crooks can urge for a ransom price starting anywhere from $50 to $2000 or even more. Also, the sum needs to be transferred in cryptocurrency.
Cryptocurrency payments such as Bitcoin,[3] Ethereum, Monero, Litecoin, and others are often required due to the anonymity if the process that is guaranteed while paying in this type of digital currency. If PassLock ransomware developers would urge for a ransom price, they would also want to ensure their anonymity because of illegitimate monetary requirements.
Even though PassLock ransomware does encrypt files and adds the .encrypted extension to the filenames, criminals seem to be more interested in ruing things for the victims by scaring them and not leaving any possibility to get out of this situation. The provided informative message states that there is no way of restoring files if there are no backups available:
PassLock
Stop, your files have been encrypted!
What happened?
Some of your files have been encrypted. Photos, videos, documents and other files
are not accessible because they have been encrypted with the AES-256 algorithm.
Don't waste time trying to recover encrypted files because you won't be able to.
Can I recover my files?
No, you can't recover your files if you don't have a backup. The files cannot be decrypted.
Note
You can safely get rid of the virus.
Once deleted, the computer will no longer be infected.
You will never be able to get your original files back if you don't have a backup.
You can safely delete your encrypted files, they only take up memory.
Your system files have not been damaged.Exit
PassLock ransomware can target any types of files such as videos, audios, photos, powerpoints, word document, excel sheets, etc. When all of these components get locked, criminals often store both encryption and decryption keys on remote servers that are only accessible for the owners themselves.
Some file-encrypting cyber threats seek to harden the data recovery process by eliminating the Shadow Volume Copies of encrypted documents and PassLock ransomware might also not be an exception. It might run specific PowerShell commands and prevent the victims from employing file restoring software that requires safe Shadow Copies.
In addition, PassLock ransomware might be programmed to act as a backdoor for other malware infiltration. The ransomware might be able to disable antivirus protection on the Windows device and let various parasites such as trojans, worms, spyware, bots, or other ransomware virus settle on the vulnerable computer system.
You can avoid this type of consequence by rushing the PassLock ransomware removal. You need to take action against the malware as soon as you see the locked files and spot the criminals' provided message. Beware that using automatic antimalware software is the only proper option that will help you to complete the process safely.
However, if you are having some trouble to remove PassLock ransomware from Windows, you should boot your computer in Safe Mode with Networking to diminish all malicious changes on your devices. Afterward, get rid of the parasite and scan for possible machine damage. If you have spotted any altered areas, try repairing them with software such as FortectIntego.
When PassLock ransomware is gone, it is time to start thinking about your files. Since crooks have left you with no clear possibility of file restoring, there are some alternative techniques that you can try. Go to the end of this page where you will find three different pieces of software that might be capable of recovering some of your files and documents.
Vulnerable RDP configuration is a “game on” for hackers
Technology experts from LesVirus.fr[4] are warning all users to take more care of their passwords that are securing the RDPs. If the person ads a very weak one or none at all, remote hackers can easily misuse them for pushing malware such as ransomware. It is known that cybercriminals are likely to abuse the TCP port 3389.
Also, ransomware viruses are delivered through email spam messages and the attachments that come clipped to them or the hyperlinks that come included in the note's content itself. Developers of the malware pretend to be from reliable healthcare, banking, or shipping organizations and falsely ten to deliver some type of crucial information. A piece of advice would be to stay away from any content that you were not expecting to receive recently.
To continue, malware developers often abuse unsecured downloading sources such as p2p networks, i.e. The Pirate Bay, BitTorrent. These places include cracked games, videos, films, and other types of products. Get all of your software and services only from original developers and trustworthy sources, otherwise, you can accidentally download a virtual parasite to your computer system.
Finally, always take care of automatical protection on every electronical device that you are using for browsing the Internet. This included downloading a reliable and effective antimalware program that is capable of scanning the system, protecting from malware infections, and alerting if something wrong is going on. Of course, you need to keep the tool updated if you want it not to run in various flaws.
Automatical PassLock ransomware removal guidelines
You should take care of the virtual parasite as soon as you find it lurking in the computer system. The first signs of infection are encrypted files and a ransom message that comes provided by cybercriminals. When you get hold of such information, you can start performing PassLock ransomware removal. Our point is that you should take this case seriously and employ only trustworthy antimalware software that would be capable of eliminating the ransomware virus.
Remove PassLock ransomware from all of the infected directories of your Windows device. If you are having any trouble with this process, activate Safe Mode with Networking as shown at the end of this article. Also, try using FortectIntego repair software that might be able to fix all the damage that was done by the cyber threat to your computer system.
When you have wiped out your computer from PassLock ransomware and it is damage-free, you can start thinking about possibilities to recover your files. Below we have provided some restoring software that might be very helpful.
Did this guide help?
Be the first to comment