This article has been created in order to help you by showing you how to remove the Defender ransomware virus from your computer and how to restore files that have been encrypted with the .defender file extension added as their suffix.
A new ransomware infection known as the Defender Ransomware has been reported by malware analysts to drop a malicious executable on the computers of victims and then encrypt their files, adding the .defender file extension. The virus also aims to imitate Windows defender, adding a wall, alongside which a corny ransom note is added. If your computer has been infected by Defender Ransomware, you should read the following article in order to learn how to remove it from your computer and how to try and restore files encrypted by it.
Threat Summary
| Name | Defender Ransomware |
| Type | Ransomware, Cryptovirus |
| Short Description | Aims to encrypt the files on your computer and then holds them hostage until the victim pays a hefty ransom fee in order to get the files working. |
| Symptoms | Files are encrypted with the .defender file extension and a ransom note, looking like a wall appears on the victim PC. |
| Distribution Method | Spam Emails, Email Attachments, Executable files |
| Detection Tool | See If Your System Has Been Affected by Defender Ransomware Download Malware Removal Tool | User Experience | Join Our Forum to Discuss Defender Ransomware. |
| Data Recovery Tool | Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. |
Defender Ransomware – Infection Methods
In order to infect a computer, the Defender Ransomware may use malicious spam e-mails which aim to spread the infection files to as many computers as possible. Such e-mails often contain deceitful messages, like the one you are seeing below:
Besides via malicious e-mail attachments, that pretend to be invoices, orders, receipts, Defender Ransowmare’s infection files may also be uploaded as fake:
- Setups of programs or drivers.
- Game installers.
- Key generators.
- Software license activators.
Defender Ransomware – More Information
As soon as Defender Ransomware has been executed on yoru computer, the malware begins to check if there is an Antivirus installed on it. Then the virus begins to query the kernel debugger data in order to evade detection on the victim PC. After this, it creates various different types of malicious files which aim to modify the auto execution of the virus by creating values in the Run keys to run the file MpCmdRun.exe:
With values to run the file: “ %TEMP%\Cache\MpCmdRun.exe”
After this, the virus contacts the command and control servers of the cyber-criminals in order to possibly relay different information about the infected computer.
The activities of Defender Ransomware which follow are not of the plesent ones. The virus then targets several database and desktop.ini files for deletion, as reported in reverse.it. These files are as follows:
→ “%USERPROFILE%\Videos\desktop.ini” for deletion
“%USERPROFILE%\Music\desktop.ini” for deletion
“%USERPROFILE%\Desktop\desktop.ini” for deletion
“%USERPROFILE%\Documents\Database1.accdb” for deletion
“%USERPROFILE%\Documents\desktop.ini” for deletion
“%USERPROFILE%\Pictures\desktop.ini” for deletion
As soon as those are deleted, the virus contacts the server 46.166.139.231 via port 80 and soon after, it creates a file, that is writable in the %Temp% directory, which is naturally the MpCmdRun.exe file. Shortly after this is done, the malware creates the following mutexes:
→ “\Sessions\1\BaseNamedObjects\RasPbFile”
“RasPbFile”
Then, it contacts the host www109.zippyshare.com and from it GTs the ransom note file on the victim’s computer, named Defender_Ransomware.txt. It has the following message:
Text from image:
YOUR FILES HAVE BEEN ENCRYPTED BY DEFENDER RANSOMWARE. THE WALL WILL NOT
FALL. THIS RANSOMWARE IS NOT DECRYPTABLE. SORRY ABOUT THAT.l
In addition to this, the Defender Ransomware also performs modifications on the following Microsoft Windows system files:
→ “%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll”
“C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll”
“C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll”
“C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll”
“C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll”
“C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll”
“C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config”
“C:\Windows\Globalization\Sorting\SortDefault.nls”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\77f338d420d067a26b2d34f47445fc51\mscorlib.ni.dll.aux”
“C:\Windows\assembly\pubpol107.dat”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\System\0b2f69b43a576b9edcc807a30872bd91\System.ni.dll.aux”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\7aa0dcace3b5d10b626540709537d280\System.Core.ni.dll.aux”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\fb36278a0a934ae244f843b62229421c\System.Windows.Forms.ni.dll.aux”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\3c20a6b0ca532bcc6271bf4b7ad0b4d9\System.Drawing.ni.dll.aux”
“C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\ce9750286ad44cbfb2acf176df9df0a2\System.Configuration.ni.dll.aux”
But this is not the part where the activity ends, since Defener Ransomware also aims to modify the following Windows Registry key in order to allow it to further edit your Registry Editor:
→ HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS
Defender Ransomware – Encryption Process
The Defender Ransomware is no different than any other ransom virus out there when it comes to files encryption. The malware hunts for the most commonly used files on the victim’s computer, based on their file extensions, which may as well be the following:
→ “PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”
After the encryption is finished, you can no longer open your favorite documents, archives, images, videos and other vital files, since their data has been replaced by an advanced cipher and this procedure can be reverted by having the private decryption keys which are known to the cyber-criminals exclusively. After the encryption, the files assume the .defender file extension and begin to appear like the following:
The bad news is that researchers are yet to develop a free decrypter for this ransomware virus, since it’s not decryptable so far. However, we will update this article with decryption information if available and in the meantime we advise you to use the alternative methods to recover files while backing up all of the data.
Remove Defender Ransomware and Restore Encrypted Files
In order to remove this malware from your PC, we would suggest that you focus on follow the manual or automatic removal instructions down below. They are specifically crated in order to help you by showing step by step how to perform the elimination process while using the information stated in this article. If you lack the experience in removing Defender Ransomware manually, security analysts strongly recommend to do so automatically, preferrably by downloading an advanced anti-malware software, which will ensure automatic scan and removal plus future protection against malware as well.
After having removed this malware, you should know that there are alternative methods on how to restore as many files as you can without having to pay the ransom, but without any guarantees. You can see some of the methods we have suggested down below in step “2. Restore files, encrypted by Defender Ransomware”.
Manually delete Defender Ransomware from your Mac
Remove a toolbar from Mozilla Firefox
Remove a toolbar from Google Chrome
Remove an extension from Safari and reset it.
Automatically remove Defender Ransomware from your Mac
When you are facing problems on your Mac as a result of unwanted scripts and programs such as Defender Ransomware, the recommended way of eliminating the threat is by using an anti-malware program. Combo Cleaner offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.
