Worm ransowmare ransomware: what it is and how to remove it

From our report of Oct 2019 · not reviewed since

More from our earlier report on Worm ransowmare

• #_ABOUT_YOUR_FILES_#$=$$.html ransom note is dropped on the desktop and all the folders where the locked files are located
• Scan your machine in Safe Mode with reputable anti-malware software in order to terminate all malicious entries made by malware

From our report of Oct 2019 · not reviewed since

Worm ransomware is a file locking virus that uses extortion tactics after locking all the data on the host machine

Worm ransomware is a variant of Paradise virus - a relatively old strain that is also used as a Ransomware-as-a-Service (RaaS).

This version was analyzed by a security researcher Michael Gillespie at the end of October 2019. Just like its predecessors, malware is designed for money extortion after locking all personal files on the infected machine.

Worm ransomware enters computers by using one of the multiple distribution methods (such as spam email attachments, software vulnerabilities, fake updates, software cracks, etc.) and starts a scan that looks for pictures, videos, documents, databases, and other personal data. After that, Worm virus encrypts each of the files by using RSA cipher and marks them with - .[corpseworm@protonmail.com].worm appendix.

Victims can also spot a ransom note #_ABOUT_YOUR_FILES_#$=$$.html, which is dropped on the desktop and all the affected folders. The content of the message states that users have to pay a ransom in Bitcoins if they want their data back. While there is no Worm ransomware decryptor developed yet, victims are advised staying away from file locking malware developers.

As soon as users interact with a malicious dropper if Worm ransomware, several files are dropped into %AppData%, %UserProfile%, and Desktop folders. From there, several processes are launched, the Windows registry is modified, and all automated Windows backups are deleted with the help of vssadmin.exe Delete Shadows /All /Quiet command.

The changes to the system are made for the file encryption process to be performed uninterrupted and to complicate encrypted file recovery after Worm ransomware removal.

Soon after that, the Worm virus scans the computer's hard drive and all the connected drives, looking for files to encrypt. In most of the cases, the most commonly-used file types are targeted, such as .pdf, MS Office files, videos, and others.

Users then cannot open the data anymore, although system files are spared for malware to operate (the goal or Worm ransomware authors is not to corrupt victims' machines but rather lock data so that they would pay the ransom). The ransom note, which is dropped into several locations on the computer, states the following:

Even though the attackers claim that no other decryption method is possible, you should not listen to them. It is in their best interest for you to pay the ransom, that is why they are even providing a test decryption service - they are trying to create a false sense of security. However, please remember that they are cybercriminals and might not send you Worm ransomware decryptor as promised.

Instead, remove Worm ransomware and try alternative file recovery methods we provide at the bottom section of this post. While there is no decryptor currently available, you might be successful in restoring at least some of your files using recovery software or other methods. However, remember that you have to terminate the infection first with anti-malware. After that, we also advise you use to fix crippled Windows system files.

From our report of Oct 2019 · not reviewed since

Protect your machine from future ransomware infections

Paradise ransomware is one of many file-locking virus families that are dominant currently.

For example, Djvu, Phobos, Scarab, and many others are lurking in the wild, actively trying to infect unsuspecting users. The truth is, most of the infections with ransomware happen due to negligence from users' side - they are not careful enough when browsing the internet, updating their software, opening emails, and doing other daily tasks.

The main precautionary measure against ransomware and other malware is caution, as most distribution methods rely on some sort of social engineering. Here are a few tips from security experts from novirus.uk - these will help you to keep your computer away from ransomware:

Be aware that no protection means can guarantee full protection, so you should always ensure that personal files are stored on a remote server or external drive as a backup.

• Update your OS and all the installed software regularly - do not postpone the updates infinitely;
• Equip your computer with anti-malware and anti-virus software with real-time protection feature;
• Never use a default RDP port and disable the connection as soon as it is not required anymore;
• Treat each unsolicited email as a threat - never open attachments that ask you to enable macro function;
• Enable ad-blocker, firewall, and other additional protection features;
• Use robust passwords for RDP and all other accounts or employ a password manager;
• Watch out for website spoofing: making a copy of a legitimate website is easy, and crooks often do so in order to make users download a malicious executable disguised a legitimate program;
• Never visit torrent or warez sites that host pirated applications or software cracks/keygens.

From our report of Oct 2019 · not reviewed since

Remove Worm ransomware and then attempt data recovery using third-party tools or other methods

Be aware that, as long as Worm virus is present on your machine, all the incoming files and those on external storage will be encrypted as well.

Therefore, make sure you never connect USB Flash drives, external HDDs, or other devices to your computer until you remove Worm ransomware. Unfortunately, the process might sometimes be a little bit complicated, as malware is often set to intercept anti-virus software to prevent its elimination.

However, you can bypass those measures by accessing Safe Mode with Networking - check out the instructions on how to enter it below. Once there, employ a powerful anti-malware program and thoroughly scan the infected computer - successful Worm ransomware removal is almost guaranteed this way.

After that, you should employ PC repair so software to fix the damage done by the virus. Finally, you can attempt to recover data as per methods described below. In unsuccessful, make a copy of all compromised files and wait till security experts deploy a working Worm ransomware decryptor.

[GI=method-1]Worm ransomware may interfere with your security software. Access Safe Mode with Networking to bypass this functionality:

[GI=method-2]System Restore might sometimes work when trying to eliminate the virus:

Windows Previous Versions feature might work in some cases

If you had System Restore enabled, sometimes it might be possible to recover files one-by-one.

ShadowExplorer might sometimes recover all the affected data

If Worm virus failed to delete Shadow Volume copies, your best bet is to try ShadowExplorer.

No decryptor is currently available