.Defender Files Virus (Ransomware) – How to Remove and Restore Files

.Defender Files Virus (Ransomware) – How to Remove and Restore Files

This article has been created in order to help you by showing you how to remove the Defender ransomware virus from your computer and how to restore files that have been encrypted with the .defender file extension added as their suffix.

A new ransomware infection known as the Defender Ransomware has been reported by malware analysts to drop a malicious executable on the computers of victims and then encrypt their files, adding the .defender file extension. The virus also aims to imitate Windows defender, adding a wall, alongside which a corny ransom note is added. If your computer has been infected by Defender Ransomware, you should read the following article in order to learn how to remove it from your computer and how to try and restore files encrypted by it.

Threat Summary

NameDefender Ransomware
TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on your computer and then holds them hostage until the victim pays a hefty ransom fee in order to get the files working.
SymptomsFiles are encrypted with the .defender file extension and a ransom note, looking like a wall appears on the victim PC.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by Defender Ransomware

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Defender Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Defender Ransomware – Infection Methods

In order to infect a computer, the Defender Ransomware may use malicious spam e-mails which aim to spread the infection files to as many computers as possible. Such e-mails often contain deceitful messages, like the one you are seeing below:

Besides via malicious e-mail attachments, that pretend to be invoices, orders, receipts, Defender Ransowmare’s infection files may also be uploaded as fake:

  • Setups of programs or drivers.
  • Game installers.
  • Key generators.
  • Software license activators.

Defender Ransomware – More Information

As soon as Defender Ransomware has been executed on yoru computer, the malware begins to check if there is an Antivirus installed on it. Then the virus begins to query the kernel debugger data in order to evade detection on the victim PC. After this, it creates various different types of malicious files which aim to modify the auto execution of the virus by creating values in the Run keys to run the file MpCmdRun.exe:

HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
With values to run the file: “ %TEMP%\Cache\MpCmdRun.exe”

After this, the virus contacts the command and control servers of the cyber-criminals in order to possibly relay different information about the infected computer.

The activities of Defender Ransomware which follow are not of the plesent ones. The virus then targets several database and desktop.ini files for deletion, as reported in reverse.it. These files are as follows:

→ “%USERPROFILE%\Videos\desktop.ini” for deletion
“%USERPROFILE%\Music\desktop.ini” for deletion
“%USERPROFILE%\Desktop\desktop.ini” for deletion
“%USERPROFILE%\Documents\Database1.accdb” for deletion
“%USERPROFILE%\Documents\desktop.ini” for deletion
“%USERPROFILE%\Pictures\desktop.ini” for deletion

As soon as those are deleted, the virus contacts the server 46.166.139.231 via port 80 and soon after, it creates a file, that is writable in the %Temp% directory, which is naturally the MpCmdRun.exe file. Shortly after this is done, the malware creates the following mutexes:

→ “\Sessions\1\BaseNamedObjects\RasPbFile”
“RasPbFile”

Then, it contacts the host www109.zippyshare.com and from it GTs the ransom note file on the victim’s computer, named Defender_Ransomware.txt. It has the following message:

Text from image:
YOUR FILES HAVE BEEN ENCRYPTED BY DEFENDER RANSOMWARE. THE WALL WILL NOT
FALL. THIS RANSOMWARE IS NOT DECRYPTABLE. SORRY ABOUT THAT.l

In addition to this, the Defender Ransomware also performs modifications on the following Microsoft Windows system files:

→ “%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll”
“C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll”
“C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll”
“C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll”
“C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll”
“C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll”
“C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config”
“C:\Windows\Globalization\Sorting\SortDefault.nls”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\77f338d420d067a26b2d34f47445fc51\mscorlib.ni.dll.aux”
“C:\Windows\assembly\pubpol107.dat”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\System\0b2f69b43a576b9edcc807a30872bd91\System.ni.dll.aux”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\7aa0dcace3b5d10b626540709537d280\System.Core.ni.dll.aux”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\fb36278a0a934ae244f843b62229421c\System.Windows.Forms.ni.dll.aux”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\3c20a6b0ca532bcc6271bf4b7ad0b4d9\System.Drawing.ni.dll.aux”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\ce9750286ad44cbfb2acf176df9df0a2\System.Configuration.ni.dll.aux”

But this is not the part where the activity ends, since Defener Ransomware also aims to modify the following Windows Registry key in order to allow it to further edit your Registry Editor:

→ HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS

Defender Ransomware – Encryption Process

The Defender Ransomware is no different than any other ransom virus out there when it comes to files encryption. The malware hunts for the most commonly used files on the victim’s computer, based on their file extensions, which may as well be the following:

→ “PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”

After the encryption is finished, you can no longer open your favorite documents, archives, images, videos and other vital files, since their data has been replaced by an advanced cipher and this procedure can be reverted by having the private decryption keys which are known to the cyber-criminals exclusively. After the encryption, the files assume the .defender file extension and begin to appear like the following:

The bad news is that researchers are yet to develop a free decrypter for this ransomware virus, since it’s not decryptable so far. However, we will update this article with decryption information if available and in the meantime we advise you to use the alternative methods to recover files while backing up all of the data.

Remove Defender Ransomware and Restore Encrypted Files

In order to remove this malware from your PC, we would suggest that you focus on follow the manual or automatic removal instructions down below. They are specifically crated in order to help you by showing step by step how to perform the elimination process while using the information stated in this article. If you lack the experience in removing Defender Ransomware manually, security analysts strongly recommend to do so automatically, preferrably by downloading an advanced anti-malware software, which will ensure automatic scan and removal plus future protection against malware as well.

After having removed this malware, you should know that there are alternative methods on how to restore as many files as you can without having to pay the ransom, but without any guarantees. You can see some of the methods we have suggested down below in step “2. Restore files, encrypted by Defender Ransomware”.

Manually delete Defender Ransomware from your computer

Note! Substantial notification about the Defender Ransomware threat: Manual removal of Defender Ransomware requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Defender Ransomware files and objects
2.Find malicious files created by Defender Ransomware on your PC

Automatically remove Defender Ransomware by downloading an advanced anti-malware program

1. Remove Defender Ransomware with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by Defender Ransomware
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...