Academia.eduAcademia.edu

Cerber virus -a new audio message ransomware

This article is about how you can protect yourself and your computer from Cerbe virus.

Cerber virus - a new audio message ransomware The Cerber PC virus is a new ransomware infection that is used to encrypt the person' files and dokuments. The Cerber PC virus adds the extension .cerber to every file that the virus encrypts. After encryption some of the files of the people, the Cerber virus demands the payment of in Bitcoin in exchange for the decryption key. According to Cerber virus's ransom note, PC users have only one week to pay the money before their amount is doubled. After the Cerber virus encrypts the person's files, it creates TXT, HTML, and VBS files named 'DECRYPT MY FILES' with instructions on how to pay the Cerber virus's money. These files are dropped on every folder that contains files that were encrypted by Cerber virus. According to these paying notes, the only way to decrypt the files is by using the 'Cerber Decryptor,' provided by the persons responsible for the Cerber virus. The VBS file contains an audio message with this same information. According to the Cerber virus attack, people must pay 1.24 BitCoin to get access to the decryption utility (in 2016, this amount is $500 USD on average). After one week, the amount will be doubled. The Cerber virus demands the payment to be made through a special internet TOR. The Cerber PC virus is very similar to other viruses, including Mischa Ransomware and Locky Ransomware. Their attacks are nearly identical, only differing in small details, and it is highly likely that they work together. PC users must avoid paying the Cerber virus ransom for two reasons: first of all, pc users have no guarantee that the people responsible for the Cerber virus attack will make their part of the bargain and give the decryption key after the payment has been made. Secondly, paying the Cerber virus ransom enables these people to continue making these attacks and financing the development of new viruses. We have found that the Cerber PC virus targets and encrypts files with the following extensions: .doc, .docx, .jnt, .jpg, .msg, .oab, .ods, .pdf, .pps, .ppsm, .ppt, .pptm, .prf, .pst, .rar, .rtf, .txt, .wab, .xls, .xlsx, .xml, .zip, .1cd, .3ds, .3g2, .3gp, .7z, .7zip, .accdb, .aoi, .asf, .asp, .aspx, .asx, .avi, .bak, .cer, .cfg, .class, .config, .css, .csv, .db, .dds, .dwg, .dxf, .flf, .flv, .html, .idx, .js, .key, .kwm, .laccdb, .ldf, .lit, .m3u, .mbx, .md, .mdf, .mid, .mlb, .mov, .mp3, .mp4, .mpg, .obj, .odt, .pages, .php, .psd, .pwm, .rm, .safe, .sav, .save, .sql, .srt, .swf, .thm, .vob, .wav, .wma, .wmv, .xlsb,3dm, .aac, .ai, .arw, .c, .cdr, .cls, .cpi, .cpp, .cs, .db3, .docm, .dot, .dotm, .dotx, .drw, .dxb, .eps, .fla, .flac, .fxg, .java, .m, .m4v, .max, .mdb, .pcd, .pct, .pl, .potm, .potx, .ppam, .ppsm, .ppsx, .pptm, .ps, .r3d, .rw2, .sldm, .sldx, .svg, .tga, .wps, .xla, .xlam, .xlm, .xlr, .xlsm, .xlt, .xltm, .xltx, .xlw, .act, .adp, .al, .bkp, .blend, .cdf, .cdx, .cgm, .cr2, .crt, .dac, .dbf, .dcr, .ddd, .design, .dtd, .fdb, .fff, .fpx, .h, .iif, .indd, .jpeg, .mos, .nd, .nsd, .nsf, .nsg, .nsh, .odc, .odp, .oil, .pas, .pat, .pef, .pfx, .ptx, .qbb, .qbm, .sas7bdat, .say, .st4, .st6, .stc, .sxc, .sxw, .tlg, .wad, .xlk, .aiff, .bin, .bmp, .cmt, .dat, .dit, .edb, .flvv We think that the best solution of this problem is to restore the encrypted files is from a backup or use a good antimalware tool.