How to remove HACKED ransomware virus

HACKED virus  –  a Jigsaw version that returns in a new form

HACKED virus originates from Jigsaw ransomware family. In December 2016, it came as a screenlocker [ref en-1] and appending file extensions. As you may already know, it is not the first time Jigsaw developers are trying their luck with new ransomware versions. CryptoHitman virus, Payransom virus, and Payms virus are just a few variants of the virus that the malware analysts have discovered.

Recently, malware researchers have identified its latest version which adds .hacked file extension to the affected data. Interestingly, the malware also presents several ransom notes in different languages: Italian^[1], English, Spanish, and Turkish.

The ransom note differs depending on the language, e.g. @readme_English.txt^[2]. Unfortunately, the developers managed to wrap the malware in a disguise of Windows update. If you suspect the presence of this malware, make a rush to remove HACKED ransomware.

How the original version works

It turns out that this new variant of the virus has been obfuscated via AutoIt – a free Windows scripting tool ^[3]. The first traces of the malware were detected before December last year. Since then, the malware has been changing its veneer — lock screen images and payment GUI. Here is an extract from a prevalent version of the virus.

Your computer has been encrypted
You must pay .25 Bitcoins within 24 hours
Or .35 after 24 hours
To get your files back
After 48 hour your computer will be destroyed if you have not paid
HACKED
Your Bitcoin payment address is:
[Bitcoin_payment_address]

As you can see, the developers have become extensively more aggressive, putting the victim under deadlines and threatening to “destroy” not only the encrypted computer files but the device itself. The hackers don’t go into much detail about how this payment should be issued and how the decryption tool (if there is one) will be delivered to the victim.

In addition to the lockscreen, the ransomware automatically connects the victim to a malicious URL with more detailed ransom payment instructions. The good news is, access to the browser may help remove the lock screen and access your desktop.

On the other hand, the files remain encrypted even if the screen lock command is deactivated. Unfortunately, there is no guarantee that the promised data decryption key will be granted to you either, that is why we suggest carrying out the thorough virus removal without any delay. We suggest using automatic antivirus software like SpyHunterCombo Cleaner, MalwarebytesMalwarebytes for this process to go as smoothly as possible.

Another interesting feature that has changed in the HACKED version is the addition of .locked and .Locked extensions. These new extension variants add to .versiegelt, .encrypted and .payrmts ^[4] ones that have already been used by the previous Jigsaw versions.

Could these new extensions be regarded as an allusion to Locky virus, which was the first one to introduce them? Could Jigsaw and Locky ransomware be joining forces? The experts are yet unsure. Nonetheless, they are certain that the sooner Hacked removal is completed the better. 

September 2017: the latest version impersonates Windows update

The latest edition exhibits an interesting feature to impersonate Windows update. The malware also presents random note in different versions. Unfortunately, the felons did a good job counterfeiting the update as the screen looks identical to the real one. 

However, there are minor flaws that indicate the malicious origin of the update. The entire process takes place in a new window. Note that the logo of your Windows version is absent as well. For instance, in case of a genuine update, you should see the percent indicator and the logo of your used OS, e.g. Windows 7 Professional or Home. Interestingly, this latest version of HACKED also displays a tendency to occupy only Windows 7 systems. 

For instance, in case of a genuine update, you should see the percent indicator and the logo of your used OS, e.g. Windows 7 Professional or Home.

Interestingly, this latest version of HACKED also displays a tendency to occupy only Windows 7 systems. Unfortunately, the malware still evades multiple security applications. At the moment, it is identified as Win32.Malware.Bucaspys.C and UDS:DangerousObject.Multi.Generic^[5]. The malware also drops the How_to_decrypt_files.txt file.

However, installing the latest anti-virus updates may significantly lower the probability of a hijack. If you notice its Hk Inc file, hacked.exe running in the Task Manager or the discussed update window, reboot the system and initiate the elimination procedure.

Ransomware revives its distribution campaign

Observing its specifications, it is likely to travel via malicious spam campaigns, corrupt ads or infected links like most infections in this category ^[6]. Potential victims receive this virus in their email as Word document, spreadsheet or PDF file. Unaware of the potential dangers, users download these files in hopes to find the promised invoice information, legal document or other supposedly important content. 

As soon as such email attachments are downloaded and opened, the malicious script does its job and downloads HACKED crypto-malware on the computer. Of course, data backups ^[7] are always a good solution and most of the time guarantees a successful file recovery in case the computer gets corrupted.

Ways to eradicate HACKED malware

Discussing HACKED removal options, unfortunately, few of them remain. Unless you are an IT expert, manual elimination might be futile as the infection roots in the system. Update your security application and run the scan. You can also try SpyHunterCombo Cleaner or MalwarebytesMalwarebytes, if you have no options. In case you cannot exit the lock screen (press ALT+F4) or launch the tool, restart the system in Safe Mode.  

Then, you should be able to remove HACKED virus and its components. Note that data recovery would be effective only when you eliminate the crypto-virus entirely. Do not forget about virus damage that can trigger issues with the machine. Run FortectIntego and repair affected files and functions.