How to remove Vassago ransomware

Vassago ransomware – a cryptovirus that prevents from accessing files after encrypting them

Vassago ransomware is a file-locking parasite that encrypts victim files on a targeted computer and demands a ransom for a necessary decryption tool. This cryptovirus also creates a ransom note, titled readme-warning.txt, and leaves it on the desktop, so victims could easily find it. Its main goal is to scare you into contacting the assailants by two provided emails (vassago_0203@tutanota.com and vassago0203@cock.li) and to succumb to their demands.

While this malware encrypts all personal data of the victim, it renames it by appending an assigned user ID, one of the criminal's emails, and .vassago extension to original filenames. If you had a file named a.pdf, it would now look like a.pdf.[XXXXXXXX].[vassago_0203@tutanota.com].vassago (Xs' stand for the appointed ID).

Vassago virus is a part of the Makop ransomware family. If you think that your device got infected with this file-locker, the most important thing is not to panic. The files might be inaccessible, but their contents aren't changed. There might be other data recovery options instead of paying the criminals.

Compared to other ransomware families, the Makop family is small and isn't as productive. Still, new file-locking parasites from this lineage are created almost every month. Members like Moloch virus, Fair virus, Fireee virus, and others have many resemblances but differ too.

The ransom note of the Vassago virus is quite instructive. First, the assailants explain what happened, then they claim that the only way to regain access to locked data is by purchasing their decoder program with cryptocurrency Bitcoins.

Then they provide two emails to get in touch with them and offer free decryption of two locked files from the infected machine to prove that the necessary tool exists. The last part contains threats not to use AV tools, not to rename files, etc. The whole Vassago file virus message states:

::: Greetings :::
Little FAQ:
.1.
Q: Whats Happen?
A: Your files have been encrypted and now have the “vassago” extension. The file structure was not damaged, we did everything possible so that this could not happen.

.2.
Q: How to recover files?
A: If you wish to decrypt your files you will need to pay in bitcoins.

.3.
Q: What about guarantees?
A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities – nobody will cooperate with us. Its not in our interests.
To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc… not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.

.4.
Q: How to contact with you?
A: You can write us to our mailbox: vassago_0203@tutanota.com or vassago0203@cock.li

.5.
Q: How will the decryption process proceed after payment?
A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.

.6.
Q: If I don’t want to pay bad people like you?
A: If you will not cooperate with our service – for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice – time is much more valuable than money.

:::BEWARE:::
DON'T try to change encrypted files by yourself!
If you will try to use any third party software for restoring your data or antivirus solutions – please make a backup for all encrypted files!
Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

There are no details about the ransom amount. Whatever it might be, if your device is infected with Vassago virus, please don't pay the hackers. The FBI states,^[1] that the forwarded funds would motivate them to attack more innocent people, develop new malware, and research more efficient distribution techniques.

The responsible thing to do is to remove Vassago ransomware from your computer immediately. The best results are achieved when eliminating infections with professional anti-malware software such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes, as these apps can take care of this issue with a click of a button.

Based on a report^[2] from VirusTotal, 47 out of 71 AV tools have identified the cryptovirus in question and prevented it from infecting the machine. Here are a few examples of its detection names:

• Win32:RansomX-gen [Ransom]
• Malware.AI.1003518073
• Trojan.Win32.DelShad.fvi
• Trojan:Win32/Ditertag.A
• ML.Attribute.HighConfidence

Once you're finished with Vassago ransomware removal, you should take care of your device. File-lockers often modify system host files, registry, and other key system aspects, which may result in BSoD, lag, and other issues. Use the FortectIntego app to repair any system irregularities and enjoy your pc anew.

Refrain from using torrent sites to avoid malware

File-sharing platforms are a great way to share files with your friends or colleagues, but cybercriminals tend to exploit their lack of security by uploading malware there. In particular, they take advantage of torrent sites to spread ransomware to a wider audience.

Popular torrent portals have tons of various illegal material, from movies to software. Our research suggests that file-locking parasites were usually camouflaged as pirated games or software – especially hidden within popular game illegal activation tools, more commonly known as cracks.^[3]

People shouldn't search for ways to trick the system by getting licensed products for free, or they could get in a lot more trouble than they ever thought. Support your desired game or other software developers by purchasing their products directly from them.

Vassago ransomware removal options from Windows computers

If your device got infected with Vassago virus, it's not the end of the world. If you had backups, you could restore your data without any problems. If you didn't, then export all essential files to an offline storage device and wait for a decryption tool to be made available to the public. If you can't wait, then try our suggestions at the bottom of the page.

For Vassago ransomware removal, you'll need professional anti-malware software. If you had one, it clearly failed you, so get a trustworthy app like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Make sure you keep either of those security tools updated at all times so they can prevent the latest malware from infecting your device.

To remove Vassago ransomware, open your AV tool and run a full scan. Eliminate all suspicious files and entries that the app recommends. Once that's done, run system diagnostics to locate and fix any system irregularities. Cybersecurity experts^[4] highly advise using the powerful FortectIntego tool for this task.