How to remove .block ransomware

.block ransomware creators perform many malicious tasks in order to get paid

Ransomware attacks have increased by 150% since 2020,^[1] and threat actors do not seem to be stopping any time soon. The virus' destructive nature makes it very worthwhile for cybercriminals to keep creating new malicious programs that lock peoples' personal files. The potential reward for ransomware developers can vary from as little as $50 to as big as $10 million (if the target is a big company) from a single PC.

There is almost nothing else that compares to the danger ransomware currently poses. If big corporations do not have good security systems in place they can become susceptible to these kinds of attacks and even get sensitive data leaked online if they do not pay huge sums of money in cryptocurrency. 

Block ransomware is one of the most recent strains detected by 36 security vendors^[2] that seem to be developed by Russian hackers because the ransom note is written in Russian or maybe that is done in order to throw off the authorities. This particular malicious program encrypts files and appends them with the .block extension. So, if the file was previously names picture.jpg, now it would be named picture.jpg.block, and the icons get changed to white pages. Because of that, users quickly notice that something is very wrong.

Shortly after the encryption process is done, a ransom note by the name readMe!.txt is generated on the victims' computer to inform them about what steps they should take. Although it might be tempting, we strongly advise against contacting the cybercriminals responsible for the attack, as many previous ransomware victims report that they have never received a response after paying the asked amount, so they not only lost their data but their files too.

Block virus in detail

Malware researchers from JoeSandbox^[3] have done a complete analysis on this malicious program – how it works, what tasks it performs in the background, and other properties it has. One of the things they found is that the malicious file includes an icon from a different legit application in order to fool users or make it harder to notice the virus. Another thing is that this malware has machine learning coded into it, which means it can avoid detection. One of the ways it does that is by creating files in the recycle bin. Thanks to machine learning, malware can also avoid removal – disable antivirus protection.

One of the most worrying things Block ransomware does is delete the shadow drive data, which makes it very difficult or even impossible to restore the data after the infection as that deletes all backups from the system itself. Besides locking files on a target computer, we can also suspect according to abnormal high CPU usage (in some cases over 98%) that the malicious program does something called cryptojacking.^[4] This is another way threat actors could be generating revenue with ransomware. It uses the victim's electricity and computing power to mine cryptocurrencies.

The most important thing you should be asking yourself is – how did it end up on my computer? And there are multiple possible answers to that question. One of the most common ways home users infect themselves with ransomware is by installing “cracked” software. We know that paying for software licenses can add up quickly, but it can pay off in the long run if you keep your system safe and not damaged to a point where various malicious programs have messed it up to the point of making it unusable.

Another way cybercriminals prefer to deliver malware is by email. This method is more used for corporate targets. Hackers attach a malicious file or insert a malicious link^[5] in the email in the hopes that at least one employee will open it. If that happens, from then on, they can infect all the computers that are connected to the same network, potentially making a business lose all data, which could destroy it. That is why it is important to be cautious in your workplace and open attachments only if you were expecting them. Even if you received an email from someone you know, it is better to double-check if it was them through another platform, as threat actors can infiltrate your email friend list.

The ransom note

English translation of readMe!.txt:

Attention! Your files are encrypted. Be sure to email one of the files to yaga.babushka@yahoo.com for instructions. Attempts to decrypt files on your own will lead to their irrecoverable damage. ALWAYS provide your ID –

Unlike many other ransom notes, like from Payransom500, Doydo, and Marlock, this one keeps it short and simple. All the victims learn is that their files are encrypted and that apparently, alternative attempts to recover files can result in permanent damage. Almost all ransomware developers include this or a similar sentence in their note to discourage people from searching for other ways to get their files back. It is a scare tactic used in the hopes that you will act immediately without thinking and will just send them the asked amount in cryptocurrencies.

Threat actors choose crypto as a form of payment because it is harder to track than regular currency, and it is anonymous – as long as you do not deposit it into a bank account because that requires an identity to be provided. Keep in mind that there are no refunds in the cryptocurrency world – once you complete a transaction there is no going back.

Start the removal process

The important thing to do is disconnect the affected machine from the local network as we talked about the dangers of that previously. For home users, disconnecting the ethernet cable should do the job. If this happened at your workplace, doing that might be complicated, so we have instructions for corporate environments at the bottom of this post.

If you try to recover your data first, it can result in permanent loss. It can also encrypt your files the second time. It will not stop until you remove the malicious files causing it first. You should not attempt removing the malicious program yourself unless you have experience. Manual removal of ransomware is extremely complicated and is suitable for people with advanced IT skills.

Use anti-malware tools like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes to scan your system. This security software should find all the related files and entries and remove them automatically for you. In some cases, malware does not let you use antivirus in normal mode, so you need to access Safe Mode and perform a full system scan from there:

Windows 7 / Vista / XP

1. Click Start > Shutdown > Restart > OK.
2. When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
3. Select Safe Mode with Networking from the list.

Windows 10 / Windows 8

1. Right-click on Start button and select Settings.
   
2. Scroll down to pick Update & Security.
3. On the left side of the window, pick Recovery.
4. Now scroll down to find Advanced Startup section.
5. Click Restart now.
6. Select Troubleshoot.
7. Go to Advanced options.
8. Select Startup Settings.
9. Click Restart.
10. Press 5 or click 5) Enable Safe Mode with Networking.

Repair corrupted system files

Performance, stability, and usability issues, to the point where a full Windows reinstall is required, are nothing unusual after malware infection. These types of viruses can alter the Windows registry database, damage vital bootup, and other sections, delete or corrupt DLL files, etc. Once a system file is damaged by malware, antivirus software cannot fix it.

Manual troubleshooting of such damage is also very complicated and can take a long time. This is why FortectIntego was developed. It can fix a lot of the damage caused by an infection like this. Blue Screen errors,^[6] freezes, registry errors, damaged DLLs, etc., can make your computer completely unusable. By using this maintenance tool, you could prevent yourself from having to reinstall WIndows completely.

• Download the application by clicking on the link above
• Click on the ReimageRepair.exe
  
• If User Account Control (UAC) shows up, select Yes
• Press Install and wait till the program finishes the installation process
• The analysis of your machine will begin immediately
• Once complete, check the results – they will be listed in the Summary
• You can now click on each of the issues and fix them manually
• If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.

Try recovering data with third-party software

Only hackers hold the decryption key,^[7] which can unlock your files, so if you did not back them up previously, there is a good chance that you will never get them back. You can try using data recovery software, but keep in mind that third-party programs cannot always decrypt the files. Whatever the situation may be, we suggest at least trying this method. Before you proceed, copy the corrupted files and place them in a USB flash drive or another external storage device. And remember – only do this if you have already removed the .block ransomware.

Before you begin, several pointers are important while dealing with this situation:

• Since the encrypted data on your computer might permanently be damaged by security or data recovery software, you should first make backups of it – use a USB flash drive or another storage.
• Only attempt to recover your files using this method after you perform a scan with anti-malware software.

Install data recovery software

1. Download Data Recovery Pro.
2. Double-click the installer to launch it.
3. Follow on-screen instructions to install the software.
4. As soon as you press Finish, you can use the app.
5. Select Everything or pick individual folders where you want the files to be recovered from.
6. Press Next.
7. At the bottom, enable Deep scan and pick which Disks you want to be scanned.
8. Press Scan and wait till it is complete.
9. You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
10. Press Recover to retrieve your files.

Keep your data safe by doing this:

• Keep backups of your data on multiple storage devices
• Do not click on unsafe links
• Do not disclose your personal information to strangers or post it on the Internet
• Do not open suspicious email attachments
• Update your operating system and software as frequently as possible
• Have trusted professional security tools in your system to add an additional layer of safety