Remove Spook Ransomware
The Spook Ransomware is an advanced file-locker, which does not leave its victims with many data recovery options. After infiltrating a machine and encrypting its files, it will attempt to limit the victim's ability to restore any of their files by:
- Specifically seeking for local backups to encrypt.
- Disabling the Windows System Restore service.
- Deleting Shadow Volume Copies, which could help to recover from ransomware attacks.
- Ensuring the full encryption of specific file formats by disabling software that could prevent the ransomware from modifying their contents.
Victims of the Spook Ransomware typically end up interacting with this threat because of phishing emails. However, its creators may also opt to use alternative malware propagation mechanics – fake downloads, software activators, malicious/misleading ads, game cracks, and pirated content.
Spook Ransomware Authors Invite Victims to TOR Chatroom
The Spook Ransomware marks the names of the victim's files by applying the unique victim ID as a suffix' It also drops the ransom messages 'RESTORE_FILES_INFO.txt' and 'RESTORE_FILES_INFO.hta.' Surprisingly, this malware's executable also abuses the Windows Notifications setting to show a ransom note for the victim. If a victim clicks the notification, they will see the HTA ransom note.
The criminals ask the victim to visit a TOR-based chat room where they can found more about their options. Of course, the criminals ask for a ransom payment, and they want the victim to use Bitcoin to complete it. They state that the victim's data was stolen prior to encrypting it and that they will publish the files online if the victim does not co-operate.
Although Spook Ransomware's attack can be very devastating, paying the ransom fee is not the right call. The criminals may decide to ask for a second transaction after you complete the first one, effectively scamming you. Because they use Bitcoin for these payments, it would be impossible for you to cancel/reverse the transaction.
Victims of the Spook Ransomware need to run an antivirus tool to eliminate the intruder, protecting your files. Once they ensure the threat's removal, they can experiment with alternative data recovery options.
