Category: Ransomware

What is Jhgn ransomware

Jhgn is an illegal program classified as ransomware. This means that it is a virus that makes money by encrypting files on victims’ computers and demanding pay for decryption. You can learn more about ransomware in general here, while this guide will focus on Jhgn ransomware in specific – how it behaves, how to remove it, how to decrypt files that it encrypted.
The first thing important to note is that Jhgn belongs to the STOP/Djvu ransomware family. This is good news – STOP/Djvu is well-studied, which makes it more likely that you will be able to decrypt the files for free. It also means that Jhgn behaves in a very predictable manner – all STOP/Djvu strains are fairly similar (compare Zfdv, for example).
Jhgn leaves a ransom note on the victim’s desktop – a file named “_readme.txt” (the full text of the note is available on the image above). In the note, the virus asks for $980, or $490 if the victim pays within three days after infection.
When encrypting the files, Jhgn gives them the .jhgn extension. This means that a file “1.png” would be renamed “1.png.jhgn”. This is done to make sure the victim doesn’t dismiss what has happened as an error.
Below you can find a step-by-step instruction that will help you remove Jhgn ransomware and decrypt .jhgn files.

What is Eijy ransomware

Eijy is a malicious program that encrypts all files on the victim’s computer. These types of viruses are called ransomware, because the hackers who made the virus will offer to decrypt the files – for a price. Eijy, in particular, belongs to the STOP/Djvu ransomware family. Most ransomware programs in this family are virtually indistinguishable from each other – for example, Zfdv is another virus in this family and it behaves almost identically.
The hackers communicate their ransom demands by making the virus leave a note on the victim’s desktop. As expected, the note is very similar to STOP/Djvu ransomware programs’ notes, and is called “_readme.txt”. It asks for $980 in ransom, through the price is halved during the first 72 hours after infection (a manipulative tactic to make the victims more likely to pay by creating a sense of urgency). The image above contains the full text of the note – that said, there’s not much more to it.
Eijy ransomware (and indeed most ransomware programs in general) change the extension of the files they encrypt to make sure the victim notices that something has happened. Eijy gives the files the .eijy extension – this means that a file called “1.jpg” would be renamed to “1.jpg.eijy”.
The guide below will offer you practical advice on dealing with this threat. It will explain how to remove Eijy ransomware and how to decrypt .eijy files.

What is Nqedrmt ransomware

Nqedrmt ransomware is an illegal program that is a part of the Magniber ransomware family. It is known to spread through malicious websites that mimic the look of Windows Update, as well as by exploiting the flaws in the Internet Explorer browser. It is, of course, possible for it to infect computers in other ways as well – these are just the most common ones. It mainly targets people in Asian countries like China, South Korea, and Singapore.
Ransomware in general, in case you’re not familiar, is a class of viruses that generate money for the hacker through extortion. The ransomware virus, once on the victim’s computer, will encrypt all the data, and then demand ransom to decrypt it via a ransom note. The image above contains Nqedrmt’s ransom note if you’re interested in reading it. Otherwise, here’s a summary.
The ransom note is called “README.html”. It contains no important information – instead, the victim is asked to download Tor Browser and navigate to their personalized page.

Here is an example of such a page. As you can see, the hackers appear to be asking for 0.18 BTC, or 0.09 BTC if paid within first five days. Note that that these prices may change from victim to victim.
The ransom web page correctly says that 0.18 BTC is $5466 – and that’s quite a lot of money. With this guide, however, you will be able to remove Nqedrmt ransomware without paying a dime. It will be a little bit harder to decrypt .nqedrmt files, and you may not be able to recover everything – but it might be possible, too.

What is Nnuz ransomware

Nnuz is a virus that encrypts every file on the infected computer. This is not done out of pure malice – the cybercriminals then offer to decrypt your data for a significant sum of money. This behavior has earned Nnuz, as well as every other malicious program that behaves in this fashion, the name of ransomware. Many different “families” of ransomware exist – all viruses within one family are essentially the same virus, with only minor differences between each other. Nnuz belongs to the STOP/Djvu ransomware family – you can read our articles on Zfdv or Ribd, other viruses in this family, to see just how similar they are to each other.
The encrypted files are given the .nnuz extension, so that the victim can see that something is wrong with their files. Once it’s done encrypting the files, Nnuz creates a file named “_readme.txt” on the victim’s desktop. This file is a ransom note – the image above contains its text. It demands $980 to restore the data, or $490 if paid within the first 72 hours after infection.
Our article will help you deal with this threat. It will explain how to remove Nnuz ransomware, and will tell you what you can do to decrypt .nnuz files.

What is LV ransomware

LV ransomware (also known as 0nzo8yk ransomware) is a modified version of another ransomware program, REvil. The ultimate goal of any ransomware virus is to generate money for the cybercriminals. This is done via ransom – LV (as well as every other ransomware program) encrypts the victim’s data and demands a payment to decrypt them.
LV’s ransom note is called “EDGEWATER-README.txt”, which you can read on the image above. One thing is absent from this note, and that is price. The price varies depending on the profile of the victim, so the hackers are using their Tor website to communicate this information (see example). This is important because it means that LV most likely focuses on a small number of valuable targets such as companies. This does not rule out the possibility of private individuals being targeted with LV – they could be targeting both.
Either way, this guide will show you how to remove LV ransomware from your computer, and will give you tips on how to decrypt .0nzo8yk files.

What is Zfdv ransomware

Zfdv is a new strain of the STOP/Djvu ransomware. For this reason, it is very similar to other ransomware programs in this family, such as Ribd or Ygkz. Ransomware, as you probably already know, is a class of illegal programs that make hackers money by encrypting files and asking for payment to decrypt them.
Zfdv in specific asks for $980, though the ransom note also states that victim who act quickly will get a 50% discount and will only have to pay $490. This, too, is typical for STOP/Djvu. Speaking of the ransom note, it is called “_readme.txt”, and is placed on the Desktop. For those that are interested in details, the image above contains the full text of the note – though once you’ve seen one STOP/Djvu ransom note, you’ve seen them all.
When Zfdv encrypts the files, is also changes the files’ extensions. Many ransomware programs do this, presumably to make it more evident to the victim that an attack has happened. The files Zfdv encrypts are given the extension .zfdv – hence the name.
The “good” thing about being infected with Zfdv is that STOP/Djvu is a well-known ransomware family that is relatively easy to get rid of. This article will explain how to remove Zfdv from your computer and how you can try to decrypt .zfdv files.

What is Horsemagyar ransomware

Horsemagyar is a newly discovered ransomware program. Most ransomware programs are merely “strains”, new variations of previous viruses. However, Horsemagyar appears to be an exception, as there is no evidence it belongs to any major ransomware family. As with any other ransomware program, Horsemagyar’s goal is to extort money via ransom – if it did anything else, it wouldn’t be called ransomware. It encrypts all files on the victim’s computer and leaves the note in which the victim is told that they have to transfer money to a certain address if they want their files decrypted.

Industrial Spy, originally an illegal dark web marketplace for stolen data (such as commercial and military secrets), has recently expanded the scope of its operations. While the previous version of viruses distributed by Industrial Spy’s hacker team simply stole the data, the new strain also encrypts it to extort ransom from the victim. By definition, this makes it a ransomware.
While many, if not most ransomware programs change the extension of the files they encrypt to make the hack more obvious to the victim, Industrial Spy Market’s virus does not.
The ransom note is named “readme.html”. A copy of it is placed it each folder on the infected computer. Overall, it is a fairly typical ransom note, though a few things do stand out. The note specifically addresses companies – perhaps unsurprising for an industrial espionage operation. Whether private individuals are at risk or not is unknown. The note also doesn’t specify how much money the victim should transfer, or where to transfer it. This, again, is unusual but makes sense for a virus targeting a small amount of high-profile victims.
The article below will help you remove Industrial Spy Market ransomware and outline general strategies on recovering the files.

What is BlackToxic ransomware

BlackToxic is a virus that is based on Chaos ransomware. As with every other ransomware program, BlackToxic exists to make money for the person who created it. This is accomplished via a multi-step process. First, the virus infects the victims’ computers and encrypts all data. Then, the victim is told that they have to pay (typically in cryptocurrency like BitCoin) a certain amount of money to the hacker if they want the data back.
In BlackToxic’s case, the encrypted files are given the “.KsiRu0w2” extension. So if you had a file named “video.mp4”, it will be renamed to “video.mp4.KsiRu0w2”. This will prevent them from being opened in any program, but renaming them back wouldn’t help, as the files are encrypted.
The ransom note is a file called “read_it.txt”, which is placed on the victim’s desktop. The image above contains the text of the note – as you can see, it is very unprofessional, even by hackers’ low standards. It has also been reported that the virus changes the victims’ desktop background – the new background is a modified Razer logo, rendered in red instead of green.
This guide will explain how to remove BlackToxic ransomware and decrypt .KsiRu0w2 files. Sadly, when it comes to the decryption, your options are limited – you may not be able to recover all of your data.Nonetheless, by using the options listed below, you should be able to recover as much as possible.

What is ZOZL ransomware

ZOZL ransomware is part of the Phobos ransomware family. ZOZL virus encrypts private files of frequent use, adding the extension .ZOZL to them to mark inaccessible files. READ MORE