How to remove ABC ransomware virus

ABC ransomware triggers speculations about its origin

ABC virus functions as a file-encrypting virus^[1] which uses RSA and AES ciphers to complete the encryption procedure. After that, it attaches random extension comprised of 8 characters and numbers. Its activity is still low, so there are still doubts about what ransomware group it is affiliated to. Observing the appended file extension and the behavior, it refers to Globe Imposter virus.

The developers of the latter continue bothering the virtual community with new versions which only differ by attaching different file extensions to the encoded data and presented email addresses. Recent of them are .BIG1 and .kimchenyn^[2] file extension viruses.

On the other hand, the file also refers to ABCLocker emerged in summer 2017. The latter seems to be an independent crypto-virus. Such similarity might be intentional or accidental. Thirdly, the developers of ABC virus must have simply run out of creativity.

Speaking of other features of this malware, it leaves Read_IT.txt file. Since the virus is still under development, the malware may also drop README.txt or HOW_TO_DECRYPT.txt files. Since cybersecurity experts have not obtained the sample of the malware, there is little information about ABC virus and its effect on the system.

It is unlikely to delete shadow volume copies. Most likely, the malware also demands 0.3 or 0.5 BTC in ransom. Due to the spike in bitcoin price, few malware developers demand 1 or 2 BTC.

In any case, it is not recommended paying the ransom. Instead, concentrate on ABC virus removal. FortectIntego or MalwarebytesMalwarebytes accelerates the elimination process. In case the crypto-virus indeed originates from Globe Imposter group of threats, note that there is a free decryption tool available online. Note that data decryption is effective after you fully remove ABC virus.

Ransomware threats might lurk everywhere

File-encrypting viruses or their initial executable files are spread likewise:

• via spam emails
• exploit kits
• fake software updates
• browser extensions and apps

If ABC ransomware belongs to the mentioned group, it might be promoted via spam email attached files. A recent sample of the latter malware group revealed that felons use the old strategy – they pretend to be the representatives of official national institutions or even tech companies. Then, they urge targeted users to open a fake invoice.

Note that when official companies and institutions send any emails with invoices, key information is already provided in the very email message. On the contrary, fraudsters appeal to users; curiosity and urge to open the attachment. Such action only accelerates the execution of the malware. Note that updating your browser also limits the probability of ABC virus hijack in case its developers decide to use exploit kits in the distribution campaign.

Get rid of computer threats

Since the malware is still in its initial stage of development, ABC malware removal should not take long. Update your security applications and scan the device with all of them. Likewise, it will guarantee the elimination of all malware files. In case, an anti-virus or malware elimination utility is non-responsive, restart the system in Safe Mode and scan the PC.

Only when you remove ABC virus completely, proceed to data decryption. Note that this malware may divert to other domains: Norwegian^[3]. Swedish or even Chinese.