RoshaLock is a virus that has appeared on the radars in February of 2017. Now it has been updated, and we know that there are already at least two versions of this malware. We have received many reports about RoshaLock 2.0 which is considered to be more dangerous than the previous iteration.
RoshaLock’s behavior is a bit different than you would expect from typical ransomware viruses. Of course, it still messes up your personal files in order to extract some money from your wallet. However, when other ransomware apps are going for the encryption method, this locker puts your personal files into archives protected with a password.
Furthermore, RoshaLock ransomware goes beyond most popular file extensions and grabs files of 2634 different types. Needless to say that after the virus does its job, there will be practically nothing left in place. The ransomware creates locked archives – All_Your_Documents.rar – on each drive and leaves a ransom note in a txt-file named All Your Files in Archive!
The victim is asked to download WinRAR and the TOR browser to access the website with instructions how to get a password for the aforementioned archives. Malicious programs like RoshaLock Ransomware often suggest using Bitcoin wallets to pay for the key that will bring your files back to normal. Hackers promise to fix your files for 1.05 Bitcoin (the first versions demanded only 0.35 BTC) implying that there is no other way to recover them. Furthermore, if the ransom is not paid within three days after accessing the site, the sum grows up by 0.05 Bitcoin daily.
Despite this fact, we suggest you never attempt to contact the developers of the ransomware or trying to pay for the password. There is a high risk that you will be ignored once money is transferred. No one is actually going to unblock your files and restore the data. Plus, you will become a sponsor for next attacks contributing to the development of newer viruses and malicious software like this one. Files damaged by RoshaLock’s actions can be restored from a backup, so it is advisable to have one. If your PC is infected by this malware, it is important to delete RoshaLock Ransomware immediately. For additional details read the paragraphs below.
We still don’t know all distribution methods for this ransomware. According to latest reports, it might be disguised as a fake repair program. We also think that general techniques are also in use:
– Software installers: malware programs often come bundled with other software you might need. Unchecking all unneeded boxes during the installation is a must. Be careful with the programs that come from untrusted sources.
– Malware spam: emails are still one of the most popular methods of distributing malicious software like this one. Suspicious attachments, unknown links, executable files, etc. in emails should not be opened. It is always a risk to get infected in one click.
– Redirects: sites are getting hacked each day, and malicious ads and hijackers are there for unsuspecting users ready to infect users with viruses and other malware.
We must admit that RoshaLock is a very dangerous virus that has no effective countermeasures when it comes to restoring hostage files. We recommend making a backup of the most valuable files and store them separately, so you can import them back after removing RoshaLock ransomware. As for deleting the malicious app, just run an anti-malware program that will do all the job for you. Or you can try doing it manually using the Safe Mode with Networking described in our guide below.
Symptoms of RoshaLock Ransomware infection on your computer can be: computer crashes, unusual homepage or search engine on your browser, unwanted pop-up ads and advertising banners. We recommend to download our automatic removal tool. This removal tool has been tested for RoshaLock Ransomware threat removal and it is easy to use.
After performing all of the steps above you should have all of your web browsers clean of the ROSHALOCK RANSOMWARE and other suspicious add-ons and extensions. However to complete the removal procedure we strongly advise to scan your computer with antivirus and anti-malware tools like SpyHunter, HitmanPro 32-bit, HitmanPro 64-bit or Malwarebytes Anti-Malware. Those programs might help to you find registry entries of malware and remove them safely.