What is Viagra ransomware? And how does it carry out its attack?
Viagra ransomware is a data-encrypting virus that’s discovered in the last week of August 2019. It has the ability to leave files inaccessible by encrypting them with sophisticated encryption algorithms. It attaches a custom extension to every file it encrypts. Some parts of the custom extension contain the victim’s ID.
The instant it infects a computer, it starts to execute its attack by dropping its malicious payload and performing a series of modifications in the system. It connects the infected machine to a remote server where it downloads the rest of its malicious components. After that, it gathers information using a data gathering module. It also utilizes stealth protection in order to prevent any program from interfering with its attack. It then scans the entire drive of the computer for files that are commonly user-generated like:
.txt, .doc, .docx, .xls, .xlsx, .pdf, .pps, .ppt, .pptx, .odt, .gif, .jpg, .png, .db, .csv, .sql, .mdb.sln.php, .asp, .aspx, .html, .xml, .psd, .frm, .myd, .myi, .dbf, .mp3, .mp4, .avi, .mov, .mpg, .rm, .wmv, .m4a, .mpa, .wav, .sav, .gam, .log, .ged, .msg, .myo, .tax, .ynab, .ifx, .ofx, .qfx, .qif, .qdf, .tax2013, .tax2014, .tax2015, .box, .ncf, .nsf, .ntf, .lwp
Once it finds its targeted files, it encrypts them using the AES 256 and RSA 4096 encryption algorithms and adds a custom suffix to every file it encrypts. After the encryption, it changes the desktop wallpaper of the infected computer and releases a file named “Help Viagra Ransomware.html” which contains the following message:
“YOU BECAME VICTIM OF THE VIAGRA RANSOMWARE!
What happened to my files?
Your files were encrypted with AES-256 and RSA-4096. This combination is cryptographically secure and cannot be cracked. There are no flaws in the encryption method. Tools like Recuva, or Shadow Copies will fail as soon as they are launched. But, your hope is not to lose. Every file with the “.E3m7” extension was encrypted (you can verify by yourself that, just, go into your user profile folders, for example, or, into your connected drives).
How do I decrypt my files?
To decrypt your files, you will need to pay a certain amount of money to us, in an anonymous manner.
First step, is to create an Bitcoin account (if you don’t have one), use the following URL:
Crypto Runner guide.
InvestoPedia guide.
Send a payment to the following BitCoin address of 0.4 BTC ~ 403.60 USD, and keep the transaction / payment ID:
1Bqca3tn3Yco6SftgHeyYQUxqb2MPtwFBj
After, contact one of the following e-mail addresses present below. If you do not get a reply from one, send to the other one, until you get a reply (this happens in less than 24 hours, in normal conditions); check also your spam folder. Use your real E-mail address, and use the subject “Decryption”; add as attached file this HTML document, and add to the body the payment ID. We do not give decryption for test service, so, don’t request for free decryption on the e-mail. We will tell the rest of istructions after the e-mail was sent.
Do what you’re told. Don’t try to swear on us, or we will block you and your ID forever. Don’t try to fool us into using 10MinuteMail or similar services,
use them for later.
E-mail addresses:
First address (“youngthug412”)
First address (“hparrockneverstop”)
After decryption, your E-mail address and your ID will be wiped off our servers, don’t fear for your life.
Is there a time limit?
Yes, three months from now (day, month, year; 22 Aug 2019, 09:11:35). Date was added to the ID, and is not removable from it (will make us ignore you forever). Be quick to pay, after 1,5 months from now, the price will be raised of the 50%, and, after three months, your ID will be blocked, that will happen also to your real e-mail address.
— N*gga livin life like vulcano and this only the beginnin’ —
ID: -”
If you are one of the victims of Viagra ransomware, you have to eliminate it from your computer right away even if it’s still in its development phase. Remember that it can still encrypt files so before it infects the other files in your computer, you need to eliminate it as soon as you can.
How is the malicious payload of Viagra ransomware disseminated online?
Viagra ransomware spreads the web via spam emails. Crooks usually use this distribution method as it is one of the most effective ways to deliver ransomware threats. This is why you need to be more cautious in downloading attachments from your emails and make sure to double-check them first before opening them. Moreover, you also have to keep both your security programs and system updated.
To successfully eliminate Viagra ransomware from your infected computer, follow the removal guide laid out below as well as the advanced steps that come next.
Step_1: First, boot your computer into Safe Mode with Networking, and afterward, you have to terminate the malicious processes of Viagra ransomware using the Task Manager and to open it, tap Ctrl + Shift + Esc keys.
Step_2: Go to the Processes tab and look for the malicious processes of Viagra ransomware and then right-click on it and select End Process or End Task.
Step_3: Close the Task Manager and open Control Panel by pressing the Windows key + R, then type in “appwiz.cpl” and then click OK or press Enter.
Step_4: Look for dubious programs that might be related to Viagra ransomware and then Uninstall it/them.
Step_5: Close Control Panel and then tap Win + E to launch File Explorer.
Step_6: After opening File Explorer, navigate to the following directories below and look for Viagra ransomware’s malicious components such as a file named “Help Viagra Ransomware.html” and a “[random].exe” file as well as other suspicious-looking files and then erase them all.
- %TEMP%
- %APPDATA%
- %DESKTOP%
- %USERPROFILE%\Downloads
- C:\ProgramData\local\
Step_7: Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech-savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you trouble and time, you can just use Restoro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then by all means go on to the next steps.
Step_8: Tap Win + R to open Run and then type in Regedit in the field and tap enter to pull up Windows Registry.
Step_9: Navigate to the listed paths below and look for the registry keys and sub-keys created by Viagra ransomware.
- HKEY_CURRENT_USER\Control Panel\Desktop\
- HKEY_USERS\.DEFAULT\Control Panel\Desktop\
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Step_10: Delete the registry keys and sub-keys created by Viagra ransomware.
Step_11: Close the Registry Editor.
Step_12: Empty your Recycle Bin.
Congratulations, you have just removed Viagra Ransomware in Windows 10 all by yourself. If you would like to read more helpful articles and tips about various software and hardware visit fixmypcfree.com daily.
Now that’s how you remove Viagra Ransomware in Windows 10 on a computer. On the other hand, if your computer is going through some system-related issues that have to get fixed, there is a one-click solution known as Restoro you could check out to resolve them.
This program is a useful tool that could repair corrupted registries and optimize your PC’s overall performance. Aside from that, it also cleans out your computer for any junk or corrupted files that help you eliminate any unwanted files from your system. This is basically a solution that’s within your grasp with just a click. It’s easy to use as it is user-friendly. For a complete set of instructions in downloading and using it, refer to the steps below
Perform a full system scan using Restoro. To do so, follow the instructions below.
