November 22, 2016
A new ransomware cryptovirus claims that Donald Trump encrypted your files. This virus will encrypt your files and display a ransom message in a window with a picture of Donald Trump. The sum of 10 US dollars is asked as payment for the decryption of your files. To see how to remove the ransomware and how you can try to restore your data, read the whole article.
Donald Trump Virus – Infection
Donald Trump ransomware could spread its infection in different ways. A popular way for the infection spread of the ransomware includes it being masked as the svchost.exe process of Windows. You can view the analysis of the executable on the VirusTotal website, from the screenshot displayed below:
Donald Trump ransomware might be spreading files with its payload on social media networks and file-sharing platforms. That malicious script might be hidden as the setup of trusted applications and presented as useful. Refrain from opening files from suspicious links and emails that have unknown origins. You should always perform a scan with a security program, first, and check their size and signatures for anything inconspicuous. You should read the preventing ransomware tips from the corresponding forum topic.
Donald Trump Virus – Technical Information
Donald Trump is the chosen theme for this new ransomware virus. The virus was discovered by the malware researcher Jasen Sumalapao, who saw it in the wild.
When your files get encrypted with this Donald Trump ransomware, the virus could create entries inside the Windows Registry to achieve a bigger level of persistence. Those registry entries will make this virus launch automatically along with each boot of the Windows operating system.
When your files get encrypted, the payment instructions and demands of the cybercriminals for the decryption of your files will be displayed in a window. In the window, the ransom message can be seen. Right here you can view a screenshot of it:
The ransom note reads the following:
The ransom price that this cryptovirus demands as payment for decrypting your files is only 10 US dollars and is demanded to pay it in Bitcoin. However, you should NOT even consider paying anything to the extortionists. That will just support them financially and probably motivate them further into creating another variant of the ransomware or a completely new cryptovirus. Besides, no one can guarantee that your data will be restored back to normal if you pay the ransom.
The Donald Trump ransomware will encrypt most of your files. The encryption algorithm that is used is not currently known. For the moment, an official list with file extensions that the virus searches to encrypt is not out yet, but it might prove to be the same as the first variant of the ransomware. You can see the list and picture of the first variant right here:
The Donald Trump cryptovirus is very likely to delete the Shadow Volume Copies from the Windows operating system by using the following command:
Continue to read and find out what kinds of methods you can try to restore at least some of your files.
Remove Donald Trump Virus and Restore Your Files
If your computer got infected with the Donald Trump ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by Donald Trump Virus.
Manually delete Donald Trump Virus from your computer
News Courtesy : http://sensorstechforum.com/remove-donald-trump-virus-restore-files/