How to remove EV ransomware virus

EV ransomware points its daggers to WordPress community

EV virus defines crypto-ransomware which encrypts Word Press site files. While the majority of file-target Windows users, this malware is certainly a novelty. After they succeed infiltrating the site, the perpetrators load ransomware. Then, the virus behaves like ordinary ransomware.

Aftert it encodes files and appends .ev file extension. Though the crooks promote their decrypter, IT experts warn not to pay the ransom as the malware is not fully developed which makes the decoding process quite difficult.^[1]

The malware fails to encode all files as it encrypts some while leaves others (.php, .png, *404.php, .htaccess, *.index.php, *DyzW4re.php, *index.php, *.htaDyzW4re, *.lol.php). Thus, it would be wiser to remove EV virus. Do not waste time on manual attempts but let FortectIntego or MalwarebytesMalwarebytes tools finish EV removal.

Website owners – new target

The case of this WordPress crypto-malware is indeed an alarming sign as the consequences are much severe than ordinary hack of a site.^[1] The perpetrators aimed to affect all major WP community. Luckily, the company has noticed the assault quite soon and terminated the attack. However, some users might still got affected by this virtual menace.

After encoding targetted files, the command is sent to the perpetrator‘s account — htaccess12@gmail.com. Later on, when the encryption process is finished, the malware presents ev.php file in black screen with the decryption code input option. As suggested above, the decryption system is faulty so users should not transmit the money as it is simply futile. What is more, the malware employs Rijndael 128 algorithm.^[2]

Researchers note that the signs of the malware has been spotted online already a couple of months ago on GitHub. The email address of the cyber criminals lead the traces to an Indonesian group of racketeers. Though the infection is still under development, virtual community should not let their guard down.

While WordPress crypto-malware may surely seem like a novelty, the very website has been subject to cyber felons assaults constantly. This year a significant bug was revealed which allowed the hackers make adavtange of it.^[3]

Ransomware prevention tips

Perhaps you have already heard about most popular distribution methods. Here are the most common tips to evade his type of malware:

• Do not open any email attachments receieved from tyhe unknown senders
• Install aditional secirity tool along with the anti-virus tool
• Do not click on any links with intriguing links in gaming or movie streaming sites
• Check the app and users‘ reviews before downloading it

While the tips are mostly applicable when dealing with a desktop version of the ransomware, they might come in handy in this situation as well. Additionally, Word Press users should install the security updates issued by the company. Now, let us move on EV removal section.

EV ransomware termination options

At the moment, you should apply the same termination techhniques as in the case of eliminating the ransomware from Windows. Install a securty tool and launch the scan. In case you cannot remove EV virus from the first attempt, make us of the below instructions.

After you reboot the system into Safe Mode, you will be able to bypass any ransomware interruption. After you finish EV removal you might check out data recovery suggestions. If you are a Croatian user^[4] and have been infected with the malware, you might find more information in the corrresponding version of 2-spyware.