How to remove nasty Darus Ransomware from your system

How to remove nasty Darus Ransomware
from your system?
Guide to Remove Darus Ransomware
Darus Ransomware is another menacing member in the arsenal of the infamous
Stop Djvu Ransomware family. Just like other siblings, Darus has been generated
with strong financial motive. It spreads its infection mostly via spam e-mail
campaigns & unreliable software download sources.
Once the system is infected, it looks for the targeted user & system files as such
documents, image files, video files & audio files. When found, it encrypts them by
adding a malign Darus extension to the filenames, hence making them inaccessible
to the victims.
One can understand the infuriation & agitation caused to the victims by .Darus file
virus & its siblings such Horon, Gehad, Madek, Godes, Dutan & the list goes on…
So, is there any way of restoring the data encrypted by Darus Ransomware? Is
there any Darus decryption tool or software? How can one stop Darus
Ransomware from infecting the system? Read on to find the answers Threat SummaryName
Type
Category
Operating System Impacted
Symptoms
Darus
Ransomware
Malware
Windows
Encryption of files with .darus extension &
appearance of ransom-demanding message.
Threat Behavior of Darus Ransomware Alike its siblings, Darus Ransomware has been developed to generate illicit
revenue by extorting ransom from the victims of .Darus file virus.
The attack of Darus begins with common internet services. Some of the spread
channels employed by the hackers include spam e-mail campaigns, unreliable
software download sources, torrent websites & fraudulent online advertising.
Upon entering the system, Darus scans the infected system for targeted user &
system files. When found, it encrypts them with RAS (Rivest–Shamir–Adleman)
& AES (Advanced Encryption Standard) Encryption methods. These
cryptographies are highly-complex. They also generate a unique private decryption
key for each infected user & store them on the hacker-controlled server.
The encrypted files are renamed with .Darus extension & hence, instantly made
unusable to the victims.
A file “image.jpg” might be renamed as “image.jpg.darus” after the encryption.
The file extensions that are at the target of the Darus Ransomware include:
 Document files (.docx, .doc, .odt, .rtf, .text, .pdf, .htm, .ppt)
 Audio Files (.mp3, .aif, .iff, .m3u, .m4u, .mid, .mpa, .wma, .ra, .avi,
.mov, .mp4)
 Video Files (.3gp, .mpeg, .3g2, .asf, .asx, .flv, .mpg, .wmv, .vob)
 Images (.jpg, .jpeg, .raw, .tif, .gif, .png)
 Backup Files (.bck, .bckp, .tmp, .gho)
Insight into the Ransom Note & Amount Demanded by Hackers
Following the successful encryption, it drops a ransom-demanding message in
every folder than contains Darus infected files. This ransom note is in text format
& named “_readme.txt”.
The ransom note appears every time a victim tries to access the encrypted file. It
contains the present situation of the system & certain instructions to the victims.
The note conveys that decryption of data is not possible without hacker’s
interference. The restoration of data requires a unique private key & Darus
decrypter that is stored on the hacker’s server.
To purchase the Darus decryption tool & key, the victim must contact the hackers
on their e-mail - gorentos@bitmessage.ch & gorentos2@firemail.cc. In addition
to that, victims must pay a ransom of $980 in bitcoins.
It suggests that the victims reaching out to hackers within 72 hours of the
encryption, will be given 50% in the ransom amount i.e., $480 (in bitcoins).
Fake Claims by Hackers
In order to guarantee the decryption, hackers ask victims to send them one file first
via e-mail. The file should not contain any valuable information, the note says.
The file will be decrypted for absolutely no cost & sent back to the victims.
Fearing to lose their sensitive data, may victims contact the hackers & send them a
file to decrypt.
However, please note that these claims are false. The research has revealed that
victims often stop receiving response from the hackers after receiving the ransom
amount.
Therefore, instead of panicking & contacting the hackers, the victims should act
smart & do not let the hackers extort money from them.
They can download Darus Ransomware removal tool or implement manual
removal steps given below to get rid of Darus Ransomware.
Distribution Techniques of Darus Ransomware –
Sources state that Darus is spreading its infection through various distribution
channels at an alarming rate. No wonder why Djvu Ransomware family is
considered as the most wide-spread malware infection.
The most prevalent spread method employed by the hackers is Spam E-mail
Campaigns.
Users often tend to click on the e-mail with luring subject lines without discerning
that content in the e-mail may be malicious. The hackers take the leverage of this
careless attitude of computer users.
Hackers send out colossal amount of e-mails containing infected links &
attachments. They suggest the receiver about an undelivered shipment from legit
shipping services like DHL & FedEx.
A mere click on these attachments, links & files installs Darus Ransomware on the
system.
Other distribution techniques that Darus is using to proliferate are






Online Advertising/Luring Discount Coupons
Malware Laden sites- Torrent sites, Adult content sites
Unreliable software download sources
Fake software updaters/Cracks
Peer-to-Peer Networks
Exploit kits
Zipped Java Script Attachments
How to remove Darus Ransomware infection from the systemSTEP A: Reboot your system to Safe Mode
STEP B: Delete the suspicious key from the Configuration Settings
STEP C: Remove Malicious Program from Command Prompt
STEP D: Restore the System Files & Folders
How to prevent Darus Ransomware from infecting your system-