.onion file extension virus (Decryption Methods Included) - Free Guide
.onion virus Removal Guide
What is .onion file extension virus?
.onion file extension virus wreaks havoc on compromised computers
.onion file virus is a malicious computer program that can be associated with a couple of ransomware families – Dharma, Amnesia, and Cry128 (CryptON). The ransomware was dubbed as Onion file virus due to the extension it adds to encrypted data. The extension might also contain criminals' email address or victim's ID. The aim of the virus is to encrypt files on the target system to make them inaccessible and then demand a ransom.
This ransomware[1] family has been spotted in November 2016 and has been updated several times since then. Malware researchers have recently spotted this cyber infection and found connections to several ransomware families. Below, you can see the list of viruses that use the .onion extension as a file marker.
- Cry128 ransomware virus. It is a version of CryptON virus that marks files with id-_[qg6m5wo7h3id55ym.onion.to].[random characters] file extensions. The virus may use .onion or .onion.to_ extension to add at the end of the encrypted file name. Usually, this virus calls its ransom notes as _DECRYPT_MY_FILES.txt or -DECRYPT-MY-FILES.txt.
- Amnesia ransomware virus. The malware completely distorts the file names and marks them with onion extension as well. To provide a ransom-demanding statement, the ransomware creates HOW TO RECOVER ENCRYPTED FILES.TXT document.
- CrySiS/Dharma ransomware virus. The virus appends id-[victim's ID].volantem_diem@aol.com.onion, .id-[id].[Gladius_Adeptus@aol.com].onion file extension to encrypted files. The ransom note is usually hidden in Info.hta file.
This Dharma ransomware family seems to be the most prevalent one, so we are going to discuss it in this article. The virus is known for corrupting various types of files; however, not all attempts to take data to hostage were successful. Some versions of the Dharma is decryptable,[2] and users can free their files without paying the ransom.
This new parasite is known for adding .onion file extension to the corrupted files. It’s still unknown whether victims can restore encoded data or not. New versions of the ransomware often are improved. Thus, authors may have fixed some flaws and developed a stronger virus.
However, if you ever encounter this pest, you should not focus on data recovery first.[3] The most important task is to remove .onion from the computer in order to protect your device and personal data. For this task we recommend FortectIntego.
The purpose of all file-encrypting viruses is the same – to swindle the money from computer users. Thus, .onion malware is also used as a blackmailing tool to continue the illegal work of the predecessors. Crooks are willing to get your money for the possibility to use a decryption software and recover your files.
Lesvirus.fr team[4] states that no matter how much Bitcoins you are ready to pay, this deal may not end up as you planned. They may take your money and leave you without promised decryptor because they may not have it or they may not have any intentions to keep their word[5].
Thus, after the attack, we recommend .onion removal and looking for alternative data recovery ways. Bear in mind that previous versions of Dharma are decryptable, so, chances to get back your files for free are high.
Ways to avoid ransomware attack
The new variant of Dharma is suspected of spreading similarly as its predecessors – via malicious email attachments. Crooks might pretend to be representatives from various institutions, organizations or companies and find numerous reasons to convince people to open the attached document. It might be hard to recognize a hoax at first glance because criminals might falsify credentials or signature.
However, if you suddenly receive an email that asks to check details in the statement or other provided document and send it back immediately, you should suspect that something is not right here. Look for grammar mistakes, check sender’s email address, [6] and be critical – do you expect to get this kind of email? If not, delete it from your inbox immediately.
Clicking on the attached document might cause .onion file virus or other malware attacks. This ransomware distribution technique is popular and widely used among hackers. Thus, if you want to protect your data, you should not take harsh actions in your inbox and backup your files regularly.
Remove .onion file virus and try available data recovery options
Getting infected with ransomware requires acting fast. Do not consider taking a shady deal to obtain a decryption software from cyber criminals for few Bitcoins. It may not end up good, and you might become just another sponsor for the cyber crimes.
Thus, without thinking too much, you need to remove .onion file virus using a reputable software. File-encrypting viruses are dangerous and complicated; thus, you need to rely on professional security tools. We suggest using FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes. These programs are capable of detecting malicious entries and deleting them from the system.
However, .onion removal may not be easy and smooth. These cyber infections are often designed to block antivirus or anti-malware programs. However, you can disable the virus by rebooting PC to the Safe Mode with Networking and then access necessary software.
Getting rid of .onion virus. Follow these steps
Manual removal using Safe Mode
If you cannot install or access antivirus program, you need to disable the virus. Follow the steps below and then run your preferred to tool to remove the virus automatically.
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Remove .onion using System Restore
If the previous method did not help to access security software, try this one:
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of .onion. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Bonus: Recover your data
Guide which is presented above is supposed to help you remove .onion from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.Onion file recovery can be tough. We suggest trying the methods described below.
If your files are encrypted by .onion, you can use several methods to restore them:
Data Recovery Pro might restore files encrypted by .onion file virus
This professional tool helps to recover corrupted, deleted and encrypted files. It has already helped numerous victims of ransomware, so you should give it a try as well.
- Download Data Recovery Pro;
- Follow the steps of Data Recovery Setup and install the program on your computer;
- Launch it and scan your computer for files encrypted by .onion ransomware;
- Restore them.
Use Windows Previous Versions feature to copy individual files
If System Restore function has been activated before ransomware attack, follow the steps below and copy previously saved versions of the encrypted files.
- Find an encrypted file you need to restore and right-click on it;
- Select “Properties” and go to “Previous versions” tab;
- Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.
Try ShadowExplorer to restore files encrypted by .onion file extension virus
If malware hasn't deleted Shadow Volume Copies of the targeted files, this recovery method may help you. Follow the steps below to restore onion files.
- Download Shadow Explorer (http://shadowexplorer.com/);
- Follow a Shadow Explorer Setup Wizard and install this application on your computer;
- Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
- Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.
.onion decryptor
We are sorry, but there is no way to decrypt Onion virus at the moment. You can check for updates on NoMoreRansom.org site.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from .onion and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Choose a proper web browser and improve your safety with a VPN tool
Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online. One of the basic means to add a layer of security – choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features. However, if you want true anonymity, we suggest you employ a powerful Private Internet Access VPN – it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.
Lost your files? Use data recovery software
While some files located on any computer are replaceable or useless, others can be extremely valuable. Family photos, work documents, school projects – these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur: power cuts, Blue Screen of Death errors, hardware failures, crypto-malware attack, or even accidental deletion.
To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, Data Recovery Pro can be your only hope to retrieve your invaluable files.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
- ^ William Joy. Ransomware: The computer threat you should worry about. Wawe3. Louisville, KY's source for news, weather and sports.
- ^ Lucian Constantin. Free decryption tools now available for Dharma ransomware. PC World. Laptops, Tablets, iPads, Desktop PCs, Printers & More.
- ^ What to do after ransomware attack. Jefferson Bank. Internet banking, telephone access to online and offline accounts, and other financial services.
- ^ LesVirus. LesVirus. Malware Removal Tutorials.
- ^ Hospital learns the hard way why you don’t pay ransomware crooks. Kaspersky blog. The blog covers information to help protect you against viruses, spyware, hackers, spam & other forms of malware.
- ^ Do You Know How to Recognize Phishing?. Adobe blogs. The official blog by Adobe.