.ACTUM File Virus - How to Remove and Restore Encrypted Files

.ACTUM File Virus – How to Remove and Restore Encrypted Files

This article has been created to show you how to remove .ACTUM file ransomware and restore files that have been encrypted by this virus on your computer system.

The GlobeImposter ransomware family of viruses has been on the rise since the beginning of August 2017. First, the virus began with malicious e-mail spam campaigns that carry 3-digit file extensions which they add to the files, encrypted by this ransomware virus. Then, the virus switched to words in it’s “.astra file” variant which is also increasing in popularity. And now the virus is here once again with the .ACTUM file extension which it again ads to the files that have been encrypted by the virus. Then, the .ACTUM file virus aims to extort it’s victims for a hefty ransom fee in the cryptocurrency BitCoin. If you are one of the victims of .ACTUM GlobeImposter variant, we would suggest that you read this article thoroughly.

SensorsTechForum is currently looking into .ACTUM ransomware. Stay tuned for an update in the next 12 hours.

Threat Summary

Name.ACTUM Virus
TypeRansomware, Cryptovirus
Short DescriptionGlobeImposter variant. Encrypts the files on the computer it has previously infected and then asks the owner to pay a ransom to get their important files back.
SymptomsDocuments, audio files, videos, images, archvies are encrypted. The .ACTUM file extension is added along with a ransom note.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .ACTUM Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .ACTUM Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

How Does .ACTUM Ransomware Spread

The cyber-criminals behind the latest iterations of GlobeImposter ransomware, including the .ACTUM variant use the same method to spread the ransomware – via e-mail spam that carries malicious e-mail attachments. The spammed e-mail messages may contain various different types of topics and e-mail bodies. The most often used one is the message, pretending that the malicious attachment within the e-mail address is actually a form of a receipt for a purchase the victim has not made. This is very effective, especially when it comes to the average users who get tricked into this and actually download and open the malicious file, which causes the infection.

More Information on .ACTUM File Virus

Once an infection with the .ACTUM GlobeImposter variant takes place, the virus may immediately attack your Windows Task Manager. In it, .ACTUM file virus runs malicious system processes which give it total control (administrative permissons) over your computer. This results in the .ACTUM file virus performing different malicious activities on your computer, like deleting your shadow volume copies by using the vssadmin command:

→ vssadmin delete shadows /for={DrivePartition} /oldest | /all | /shadow={Identification of the shadow copies}] /quiet

In addition to this, the .ACTUM file virus may also attack the Windows Registry Editor of the affected computer, more specifically it may add value strings in the Run and RunOnce registry keys of Windows. This results in the malware running automatically on Windows start up. The sub-keys have the following location:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

How Does .ACTUM File Virus Encrypt Files

The encryption used by the .ACTUM variant of GlobeImposter is conducted via the RSA (Rivest-Shamir-Adleman) algorithm with a 2048-bit strenght. This cipher makes sure that each encryption generates a separate encryption keys – public and private one. The public one can be factorized, however without the private key, you cannot unlock the files even if you wanted to. The .ACTUM file virus targets the following types of files to encrypt them:

→ .$er .4db .4dd .4d .4mp .abs .abx .accdb .accdc .accde .accdr .accdt .accdw .accft .adn .adp .aft .ahd .alf .ask .awdb .azz .bdb .bib .bnd .bok .btr .cdb .cdb .cdb .ckp .clkw .cma .crd .daconnections .dacpac .dad .dadiagrams .daf .daschema .db .db-shm .db-wa .db2 .db3 .dbc .dbf .dbf .dbk .dbs .dbt .dbv .dbx .dcb .dct .dcx .dd .df1 .dmo .dnc .dp1 .dqy .dsk .dsn .dta .dtsx .dx .eco .ecx .edb .emd .eq .fcd .fdb .fic .fid .fi .fm5 .fmp .fmp12 .fmps .fo .fp3 .fp4 .fp5 .fp7 .fpt .fzb .fzv .gdb .gwi .hdb .his .ib .idc .ihx .itdb .itw .jtx .kdb .lgc .maq .mdb .mdbhtm .mdf .mdn .mdt .mrg .mud .mwb .myd .ndf .ns2 .ns3 .ns4 .nsf .nv2 .nyf .oce .odb .oqy .ora .orx .owc .owg .oyx .p96 .p97 .pan .pdb .pdm .phm .pnz .pth .pwa .qpx .qry .qvd .rctd .rdb .rpd .rsd .sbf .sdb .sdf .spq .sqb .sq .sqlite .sqlite3 .sqlitedb .str .tcx .tdt .te .teacher .tmd .trm .udb .usr .v12 .vdb .vpd .wdb .wmdb .xdb .xld .xlgc .zdb .zdc

If you have files that have the file extensions below, blocks of data on them, like their headers, is encrypted and they can no longer be opened. After the encryption process has completed, this ransomware virus adds the .ACTUM file extension to the encrypted files. The files appear like the following example:

→ New Text Document.txt.ACTUM

Remove .ACTUM GlobeImposter and Restore Encrypted Files

For the removal process of the .ACTUM file virus it is important to know that you must perform a backup of your important files beforehand. After doing so, we would suggest to follow the instructions below as they are specifically designed to help you remove this virus from your computer system either manually or automatically. Be advised that the best method to remove this virus is to do it automatically using a ransomware-specific removal tool. Such will fully and swiftly remove .ACTUM ransomware and ensure future protection as well.

If you want to restore files that have been encrypted by this ransomware virus, we suggest that you focus on trying out our alternative file recovery options below in step “2. Restore files encrypted by .ACTUM virus”. They are specifically designed to help you restore as many files as you can, without paying the ransom.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share