Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove Donald Trump Virus and Restore Your Files

stf-donald-j-trump-ransomware-virus-new-variant-ransom-message-window

A new ransomware cryptovirus claims that Donald Trump encrypted your files. This virus will encrypt your files and display a ransom message in a window with a picture of Donald Trump. The sum of 10 US dollars is asked as payment for the decryption of your files. To see how to remove the ransomware and how you can try to restore your data, read the whole article.

Threat Summary

Name Donald Trump Virus
Type Ransomware, Cryptovirus
Short Description The ransomware will lock your files, making them inaccessible and ask payment for unlocking them.
Symptoms The ransomware will encrypt your files and show a ransom message window with a picture of Donald Trump.
Distribution Method Spam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Donald Trump Virus

Download

Malware Removal Tool

User Experience Join Our Forum to Discuss Donald Trump Virus.
Data Recovery Tool Data Recovery Pro by ParetoLogic Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Donald Trump Virus – Infection

Donald Trump ransomware could spread its infection in different ways. A popular way for the infection spread of the ransomware includes it being masked as the svchost.exe process of Windows. You can view the analysis of the executable on the VirusTotal website, from the screenshot displayed below:

stf-donald-j-trump-ransomware-virus-new-variant-infection-distribution-detections-on-virustotal-svchost

Donald Trump ransomware might be spreading files with its payload on social media networks and file-sharing platforms. That malicious script might be hidden as the setup of trusted applications and presented as useful. Refrain from opening files from suspicious links and emails that have unknown origins. You should always perform a scan with a security program, first, and check their size and signatures for anything inconspicuous. You should read the preventing ransomware tips from the corresponding forum topic.

Donald Trump Virus – Technical Information

Donald Trump is the chosen theme for this new ransomware virus. The virus was discovered by the malware researcher Jasen Sumalapao, who saw it in the wild.

When your files get encrypted with this Donald Trump ransomware, the virus could create entries inside the Windows Registry to achieve a bigger level of persistence. Those registry entries will make this virus launch automatically along with each boot of the Windows operating system.

When your files get encrypted, the payment instructions and demands of the cybercriminals for the decryption of your files will be displayed in a window. In the window, the ransom message can be seen. Right here you can view a screenshot of it:

stf-donald-j-trump-ransomware-virus-new-variant-ransom-message-window

The ransom note reads the following:

You Have Been Fucked Mate

Hello User all your files have been encrypted by
Donald J. Trump Pay 10$ in Bitcoin to the adress in
the textbox to Decrypt your PC, you can Buy
Bitcoins on https://localbitcoins.com Now You have
72 Hours left to pay or your Decrypt Key will be
Deleted and you Cant get your files Back.

The ransom price that this cryptovirus demands as payment for decrypting your files is only 10 US dollars and is demanded to pay it in Bitcoin. However, you should NOT even consider paying anything to the extortionists. That will just support them financially and probably motivate them further into creating another variant of the ransomware or a completely new cryptovirus. Besides, no one can guarantee that your data will be restored back to normal if you pay the ransom.

The Donald Trump ransomware will encrypt most of your files. The encryption algorithm that is used is not currently known. For the moment, an official list with file extensions that the virus searches to encrypt is not out yet, but it might prove to be the same as the first variant of the ransomware. You can see the list and picture of the first variant right here:

→.7z, .alts, .assets, .avi, .bukkit, .cfg, .css, .csv, .csv, .dat, .dat_mcr, .dll, .doc, .docx, .flv, .gif, .html, .icarus, .ico, .ini, .Ink, .itl, .jar, .java, .jpeg, .jpg, .js, .json, .litemod, .log, .lvl, .m3u, .mca, .mdbackup, .menu, .mp3, .mp4, .odt, .pak, .php, .png, .ppt, .pptx, .psd, .pub, .rar, .raw, .resource, .rtf, .sav, .sidn, .sk, .sln, .swf, .tax, .tex, .txt, .vb, .wma, .wmv, .wolfram, .xcf, .xml, .yml, .zip

stf-donald-trump-ransomware-virus-files-locked-ransom-message-window

The Donald Trump cryptovirus is very likely to delete the Shadow Volume Copies from the Windows operating system by using the following command:

→vssadmin.exe delete shadows /all /Quiet

Continue to read and find out what kinds of methods you can try to restore at least some of your files.

Remove Donald Trump Virus and Restore Your Files

If your computer got infected with the Donald Trump ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by Donald Trump Virus.

Manually delete Donald Trump Virus from your computer

Note! Substantial notification about the Donald Trump Virus threat: Manual removal of Donald Trump Virus requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Donald Trump Virus files and objects
2.Find malicious files created by Donald Trump Virus on your PC

Automatically remove Donald Trump Virus by downloading an advanced anti-malware program

1. Remove Donald Trump Virus with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by Donald Trump Virus
Optional: Using Alternative Anti-Malware Tools

Berta Bilbao

Berta is the Editor-in-Chief of SensorsTechForum. She is a dedicated malware researcher, dreaming for a more secure cyber space.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.