How to remove Vortex ransomware virus

Vortex ransomware – crypto malware that is still actively infecting users

Vortex ransomware is a dangerous crypto-virus^[1] which is believed to belong to Polish hackers. The original variation of this ransomware is called Polski ransomware. The file-encrypting threat employs AES-256^[2] cipher to encode victim’s photos, documents, videos, and other potentially important data. When encrypting files, the malware adds .aes file extension to every file affected file. All three variations: Vortex, Polski, and Flotera are known to append the same extension.

Vortex virus corrupts files in all computer drives but skips system folders to keep the computer running. Once the virus is done with the encryption process, it immediately saves some text into a ransom note, which it names as ODZSZYFRUJ-DANE (stands for DECRYPTION DETAILS in the English language). It also gets a random 40-char password from sethcardoza[.]com/api/rest/tools/random_password_generator/length:40/complexity:alphaNumeric site. 

The latest version of Vortex ransomware reportedly uses #$# JAK-ODZYSKAC-PLIIKI.txt name for the ransom note. In this text file, the virus calls itself P_o_l_s_k_i – – r_a_n_s_o_m_w_a_r_e. It demands $100 as a ransom (if the victim pays immediately) or $200 after 4 days.

The first signs of the malware were detected in March, 2016. However, after a month, researchers noticed a hike in its activity again. Flotera ransomware uses the same ransom note and file extension to mark affected files. It exclusively targets Polish^[3] users.

The virus subsided for a couple of months, but it got active again in summer months, particularly, June, 2017. The virus hides under pg_ctl.exe or any other randomly named file. Most of anti-virus tools detect the threat as Trojan.Ransom.Vortex, TR/FileCoder.mshfm, and Trojan.GenericKD.5465013, etc. It is not recommended to pay the ransom as the decrypter is already created.^[4]

Vortex virus does not create any fancy-looking .html-based ransom notes like Spora virus does^[5]. It simply saves the information in a simple .txt file and drops it on the desktop. It is possible that such ransom notes are stored in every folder with encrypted files, too. 

It turns out that Vortex ransomware virus wants to get $299 from the victim in exchange for a decryption tool. It provides two email addresses for the victim and asks to write to them to get further instructions regarding data recovery. This crypto-virus is associated with these email addresses: rsapl@openmailbox.org, polskiransom@airmail.cc, Hc9@2.pl or Hc9@goat.si.

According to the ransom note, the victim has four days to get in touch with the criminals and pay the money they demand; otherwise, cybercriminals promise to lift the ransom price by 100%. We do not recommend you to deal with cyber terrorism by following cybercriminals’ commands. You should not pay the ransom, especially because the chances of recovering your files are low.

Even if you paid, you would get no guarantees regarding data restoration^[6]. Since your files are encrypted, there is nothing you can do to force cybercriminals to help you. Therefore, instead of writing a letter to ransomware developers, remove Vortex ransomware with FortectIntego or another trustworthy anti-malware software. If you have never experienced a ransomware attack, read Vortex virus removal instructions first.

You can find the instructions right below the post. It is very important to eradicate all malicious files from PC because leaving some ransomware remains automatically makes your system more vulnerable to malicious attacks.

A new look – Flotera ransomware

It seems that Polski ransomware developers have decided to step up their ransomware game one more time and release a slightly improved version of Vortex. This time, they dubbed the virus as Flotera ransomware, or, as the virus calls itself, Ŧl๏tєгค гคภร๏๓ฬคгє.

This version is not significantly different compared to the original version – it still uses !!!-ODZYSKAJ-DANE-!!!.TXT as a ransom note and encrypts files using the same encryption routine. Two email addresses provided in the ransom note are flotera@2.pl and flotera@protonmail.ch. Flotera also adds .aes extensions to encrypted files and seeks to extort money from the miserable computer users who accidentally allow Flotera ransomware to be installed on the system.

Victims are advised to rely on data backups. Of course, data recovery measures should be taken only after Flotera virus removal. Luckily, virus researcher Michael Gillespie has found a decryption tool^[7].

Known distribution methods

Ransomware viruses do not get into computer system out of thin air. Certain circumstances are needed in order for such malicious virus to hijack the PC system. The first reason allowing malicious programs sneak into your system easily is a lack of computer protection. If you do not have an anti-malware or anti-spyware software installed on your PC, nothing can stop the malicious program from infecting your PC.

Furthermore, the ransomware succeeds in infiltrating the system partially due to users' interaction. Malware is mostly distributed via email. As a result, cyber criminals manage to convince victims to open malicious email attachments just by using basic social engineering skills^[8].

Finally, the ransomware can slither into the device with the help of exploit kits, but in such case, the victim needs to have some outdated software on the system. Security vulnerabilities in old programs allow exploit kits to execute code, and that is why you should keep all your programs up-to-date.

Remove Vortex virus today and recover your files

If either of previously-mentioned variations occupied your PC and your files are corrupted, do not waste any time and remove Vortex virus. Update the security program and perform the scan. If the virus blocks you from accessing it, take a look at the below instructions. It will help you regain access to the system and complete Vortex ransomware removal. After the malware is fully eradicated, proceed to data recovery.