.adobe ransomware removal and files recovery [Dec 2018 upd.]

A new variant of the Dharma/CrySiS ransomware is out, appending the .adobe extension to encrypted files and dropping FILES ENCRYPTED.txt ransom note.

Ransomware is one of the very few strains of malicious code that causes things to get out of hand completely. As opposed to the overwhelming majority of malware, it targets one’s irreplaceable asset – personal data. Surreptitious infiltration into a computer, a scan for valuable files, implementation of cryptography to lock down all spotted items, and outright ransom demands – all of these are common components of every such attack. The sample, or rather lineage thereof, dubbed Dharma (CrySiS) doesn’t deviate from this incursion chain at all. The only novelty its latest version has introduced comes down to the .adobe extension added to encrypted files, while the ransom note named FILES ENCRYPTED.txt is shared with the previous editions, including the .combo variant.

Having been executed on a computer, the .adobe ransomware traverses all disks reflected in the system structure as separate drive letters. If a removable drive is currently inserted, it is subject to this routine as well. The goal of this scouring is to find all bits and pieces of information that matters to the victim. The file formats Dharma looks for include all types of Office documents, images, videos, and databases, to name a few. Once the scan ends, the cryptographic module of the infection enters the game. It scrambles the located files at a deep level, applying an uncrackable mix of AES and RSA ciphers. This technique causes a denial of access to all of the user’s important data, replacing the file icons with blank ones unidentifiable by the operating system.

Not only can these items no longer be opened or accessed whatsoever, but they also undergo filename changes. The original filenames become concatenated with strings in the following format: id-{victim ID consisting of 8 hexadecimal characters}.[extortionists’ email address].adobe. So far, the victims have reported the following email strings that appear in square brackets: payransom@qq.com, stopencrypt@qq.com and btcdecripter@qq.com. Therefore, a sample file named 1.bmp will become a badly broken entity similar to this: 1.bmp.id-BA2157C1.[payransom@qq.com].adobe.

While the attackers’ contact information embedded right in the filenames is an unambiguous clue on what to do next, the .adobe ransomware gets more obvious with its demands by also leaving ransom notes. Those are two objects – one is an HTA file, and the other is a TXT document. The former, Info.hta, is actually an application triggered automatically whose window title matches the felons’ email address. It blames the unauthorized encryption on a “security problem” with the PC and instructs the user to send an email to the malefactors. The subject field of this message is supposed to include the unique victim ID. The logic of this interaction is to receive a detailed recovery walkthrough. The other edition of the ransom note, FILES ENCRYPTED.txt, contains the same crudely composed message as before, except that the email address is different. It says, “All your data has been locked us. You want to return? Write email stopencrypt@qq.com” – again, the contact details may vary.

At the end of the day, the victim will be coerced to send about 0.2 Bitcoin (worth some 700 USD) to the black hats’ wallet. It’s not until the payment is made that the decryption key and recovery software will allegedly become available. None of this would be the case if users exercised more caution with the way they handle RDP connections. As a matter of fact, the Dharma/CrySiS ransomware, including its newest .adobe file variant, does the rounds exclusively by means of hacking remote desktop services. Default access credentials or weak passwords are the typical entry points for the trespass. By avoiding suspicious email attachments and keeping your software up to date, you will steer clear of most ransomware strains, but the .adobe virus may still pollute your machine as long as you aren’t a very prudent RDP user. Keep that in mind. For those already attacked, the following sections of this guide will come in handy as they provide alternative file recovery methods and effective removal steps.

.Adobe ransomware automated removal and data recovery

When faced with ransomware like .Adobe, one of the best shortcuts in terms of removal is to use Combo Cleaner, a lightweight and incredibly effective application with PC security and optimization features under the hood. It detects and thoroughly deletes threats while giving you insights into the overall health of your computer.

This program’s protection power spans modules that forestall all known types of malware, including ransomware and browser hijackers, and take your online security to the next level by blocking phishing sites and other suspicious web pages. Follow these simple steps to eliminate the infection for good:

1. Download Combo Cleaner installer.

Download .Adobe remover

^{Combo Cleaner scans your PC with no strings attached, but you’ll have to buy its fully functional version to remove the threats it detects. The disk optimization tools that find large files and duplicates are free to use.}

2. Open the CCSetup.exe file to get started. Several subsequent screens will allow you to make initial customizations so that the program works exactly as you need from the get-go.

3. The installation will be followed by an update of malware signatures. Once this process is through, click the Start Scan button in the left-hand sidebar.

4. Combo Cleaner will then check system locations that are most often polluted by Windows malware. The first scan can take a while to finish.

5. Combo Cleaner will display a system tray notification as soon as the scan is over. Click the Resolve found threats button to view the results.

6. The scan summary shows the names and types of the detected threats as well as their statuses and locations. Click the Remove all threats button and follow further on-screen prompts to get rid of these items.

Data recovery toolkit to the rescue

Some strains of ransomware are known to delete the original files after the encryption routine has been completed. As hostile as this activity appears, it can play into your hands. There are applications designed to revive the information that was obliterated because of malfunctioning hardware or due to accidental removal. The tool called Stellar Data Recovery features this type of a capability and therefore it can be applied in ransom attack scenarios to at least get the most important files back. So use the app to get an idea of what data can be restored and let it do the recovery job. Here is a step-by-step walkthrough:

1. Download and install Stellar Data Recovery.

Download Stellar Data Recovery

2. Open the application, select the types of recoverable files to look for, and click Next.

3. Choose the areas you want the tool to recover from and click the Scan button.

4. Having scanned the specified locations, the program will display a notification about the total amount of recoverable data. Close the dialog and click the Recover button. This will hopefully help you get some of your valuable files back.

.Adobe ransomware manual removal and file recovery

Some ransomware strains terminate themselves after completing the encryption job on a computer, but some don’t. Furthermore, the .Adobe virus may prevent victims from using popular antimalware tools in order to stay on board for as long as possible. Under the circumstances, it may be necessary to utilize the Safe Mode with Networking or System Restore functionality.

Be advised that even after the ransomware is removed, files will still be encrypted and inaccessible. The malicious code cleanup part, however, is important because it keeps a relapse of the infection from occurring further on and eliminates all opportunistic malware.

Ways of non-ransom recovery of .adobe files

Cracking the crypto used by this ransom Trojan is more of a science fiction thing rather than an attainable prospect for the masses. This is why the troubleshooting in predicaments of this sort is a matter of two approaches: one is to pay the ransom, which isn’t an option for many victims; and the other is to apply instruments that take advantage of the ransomware’s possible weaknesses. If the latter is your pick, the advice below is a must-try.

Ransomware Prevention Tips

To avoid .Adobe ransomware and other file-encrypting infections in the future, follow several simple recommendations:

These techniques are certainly not a cure-all, but they will add an extra layer of ransomware protection to your security setup.

Revise your security status

Post-factum assessment of the accuracy component in malware removal scenarios is a great habit that prevents the comeback of harmful code or replication of its unattended fractions. Make sure you are good to go by running an additional safety checkup. Another benefit of using the antimalware tool is that it will keep ransomware threats from intruding on your computer further on.

Download .Adobe removal tool