MARS Files Virus - Ransomware Removal and Recovery Guide

by Gergana Ivanova | October 29, 2020 | 0 Comments

MARS Ransomware Virus Threat Summary Remove MARS Files Virus

MARS Ransomware Virus

MARS virus is a new ransomware that has just been identified to be live in an ongoing attack campaign. The ransomware code can be inserted in various payload carriers including application installers and malicious documents. When these malicious files are opened on a PC the associate infection begins. Then MARS virus triggers a long sequence of malicious processes that contaminate the operating system. All changes made by the ransomware make the infected PC extremely vulnerable to further malware attacks. As part of infection with MARS ransomware virus is the encryption of valuable personal data.

The nasty threat scans predefined system drives for specific commonly used types of files and encodes them all with a sophisticated cipher algorithm. As a result, encoded files appear with the .mars file extension. The access to their information is restricted due to their encrypted code. Hackers try to blackmail victims into paying a ransom fee for file decryption. For the extortion, their nasty program drops the file !!!MARS_DECRYPT.TXT and then presents victims with its content.

If your computer device was infected with this ransomware and you see your files as locked .mars files, read on through to find out how you could remove the ransomware, secure the system and potentially restore your files back to normal.

Threat Summary

Name	MARS
Type	Ransomware, Cryptovirus
Ransom Note	!!!MARS_DECRYPT.TXT
Short Description	The ransomware encrypts files on your computer machine and demands a ransom to be paid to allegedly restore them.
Symptoms	The ransomware will blackmail the victims to pay them a decryption fee. Sensitive user data may be encrypted by the ransomware code.
Distribution Method	Spam Emails, Email Attachments
Detection Tool	See If Your System Has Been Affected by malware Download Malware Removal Tool
User Experience	Join Our Forum to Discuss MARS.
Data Recovery Tool	Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

MARS File Virus – What Does It Do?

Another name of MARS ransomware is the MARS file virus. It comes from the extension this malware adds to files it encodes. It is not the first time when ransomware with this name appears on the malware scene. Back in April 2017, we at SensorsTechForum reported a strain of the Major ransomware with the same name.

For the nasty infection with this MARS ransomware to begin its payload file should land on the computer operating system. The most popular delivery tactics are probably going to be used by hackers.

The main technique remains the launch of phishing email messages. These messages are designed to imitate well-known services and companies and their representatives. Through them, various malware contents and attachments may be pushed to target PCs. A similar technique – malware sites may complement the propagation of MARS ransomware. Malicious payload files may be uploaded on various sites that serve as download portals.

Once the infection begins, the ransomware will probably start a data harvesting module which will retrieve sensitive information both about the infected machine and the victims. The gathered information can help for the generation of a unique infection ID used for the extortion step.

The MARS ransomware can also use the acquired information in order to scan the system for the presence of any security software in order to successfully bypass them. As soon as an intrusion is made various system settings will be altered. Usually, malicious software like MARS ransomware affects specific Windows Registry keys as well as restore points and backups.

Then the encryption stage takes place. By using a strong cipher target user data gets encoded by the ransomware. Commonly used types of files used by the majority of people are likely to be in the encryption list of the MARS file virus. All of the following files may be encoded: backups, databases, images, videos, music and etc. When this process is complete the .mars extension will be appended to the names of corrupted files. Then a ransom note that is made in a file called !!!MARS_DECRYPT.TXT.

Here is a copy of its text message:

All your files have been encrypted with MARS Virus.
Your unique id: –

Our virus encrypted 231 of your office files (xls, xlsx, doc, docx, ppt, pptx, odt, ods, pdf, dwg, psd, dbf, fpt, php, cdr, mdb, accdb).
You can buy decryption for 500$ in Bitcoins.
But before you pay, you can make sure that we can really decrypt any of your files.
The encryption key and ID are unique to your computer, so you are guaranteed to be able to return your files.

To do this:
1) Send your unique id – and max 3 files for test decryption to mars_dec@outlook.com or anton_ivan_8989@mail.ru
2) After decryption, we will send you the decrypted files and a unique bitcoin wallet for payment.
3) Be careful! Fakes are possible in Telegram, never pay until you receive test files after decryption!
4) After payment ransom for Bitcoin, we will send you a decryption program and instructions. If we can decrypt your files, we have no reason to deceive you after payment.

or do this(If you have not received a reply by email):

1) Download and install Telegram Messanger: hxxps://desktop.telegram.org/ (for Windows, Linux, macOS)
2) Find user mars_dec
3) Send your unique id – and max 3 files for test decryption.
4) After decryption, we will send you the decrypted files and a unique bitcoin wallet for payment.
5) Be careful! Fakes are possible in Telegram, never pay until you receive test files after decryption!
6) After payment ransom for Bitcoin, we will send you a decryption program and instructions. If we can decrypt your files, we have no reason to deceive you after payment.

FAQ:
Can I get a discount?
No. The ransom amount is calculated based on the number of encrypted office files and discounts are not provided. All such messages will be automatically ignored.
What is Bitcoin?
read bitcoin.org
Where to buy bitcoins?
hxxps://bitcoin.org/en/buy
hxxps://buy.moonpay.io
or use google.com
Where is the guarantee that I will receive my files back?
The very fact that we can decrypt your random files is a guarantee. It makes no sense for us to deceive you.
How quickly will I receive the key and decryption program after payment?
As a rule, within a few hours, but very rarely there may be a delay of 1-2 days.
How does the decryption program work?
It’s simple. You need to copy the key and select a folder to decrypt. The program will automatically decrypt all encrypted files in this folder and its subfolders.
I will complain about your Telegram account and mailbox’s..
God help you. You won’t find us anyway. But many people will be deprived of any opportunity to recover their files.

We know that you need to restore encrypted .mars files but we recommend that you refrain from transferring money to cybercriminals. Otherwise, you risk losing both your valuable files and money.

For the sake of your security, it is advisable to clean your infected computer from present malicious files and consider the help of alternative data recovery methods.

Remove MARS Files Virus

The so-called MARS file virus is a threat with highly complex code that causes damage to both essential system settings and valuable data. Hence, the only way to use your infected computer in a secure manner again is to remove all malicious files and objects created by the ransomware. For the purpose, you can follow our step-by-step removal guide.

In the event that you want to attempt to restore .mars files with the help of alternative data recovery methods, do check step five – Try to Restore files encrypted by ransomware. We remind you to back up all encrypted files to an external drive before the recovery process.

Gergana Ivanova

Highly motivated writer with 5+ years of experience writing for ransomware, malware, adware, PUPs, and other cybersecurity-related issues. As a writer, I strive to create content that is based on thorough technical research. I find joy in the process of creating articles that are easy to understand, informative, and useful. Follow me on Twitter (@IRGergana) for the latest in the field of computer, mobile, and online security.

Follow Me:

Guide 1: How to Remove MARS from Windows.
Guide 2: Get rid of MARS on Mac OS X.
Guide 3: Remove MARS in Google Chrome.

Guide 4: Erase MARS from Mozilla Firefox.
Guide 5: Uninstall MARS from Microsoft Edge.
Guide 6: Remove MARS from Safari.
Guide 7: Eliminate MARS from Internet Explorer.
Guide 8: Disable MARS Push Notifications in Your Browsers.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

How to Remove MARS from Windows.

Step 1: Boot Your PC In Safe Mode to isolate and remove MARS

OFFER

Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!

We Recommend To Scan Your PC with SpyHunter

Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter's EULA, Privacy Policy and Threat Assessment Criteria

1. Hold Windows key() + R

2. The "Run" Window will appear. In it, type "msconfig" and click OK.

3. Go to the "Boot" tab. There select "Safe Boot" and then click "Apply" and "OK".

Tip: Make sure to reverse those changes by unticking Safe Boot after that, because your system will always boot in Safe Boot from now on.

4. When prompted, click on "Restart" to go into Safe Mode.

5. You can recognise Safe Mode by the words written on the corners of your screen.

Step 2: Uninstall MARS and related software from Windows

Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it. To do that:

1. Hold the Windows Logo Button and "R" on your keyboard. A Pop-up window will appear.

2. In the field type in "appwiz.cpl" and press ENTER.

3. This will open a window with all the programs installed on the PC. Select the program that you want to remove, and press "Uninstall"

Follow the instructions above and you will successfully uninstall most programs.

Step 3: Clean any registries, created by MARS on your computer.

The usually targeted registries of Windows machines are the following:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

You can access them by opening the Windows registry editor and deleting any values, created by MARS there. This can happen by following the steps underneath:

1. Open the Run Window again, type "regedit" and click OK.

2. When you open it, you can freely navigate to the Run and RunOnce keys, whose locations are shown above.

3. You can remove the value of the virus by right-clicking on it and removing it.

Tip: To find a virus-created value, you can right-click on it and click "Modify" to see which file it is set to run. If this is the virus file location, remove the value.

IMPORTANT!
Before starting "Step 4", please boot back into Normal mode, in case you are currently in Safe Mode.
This will enable you to install and use SpyHunter 5 successfully.

Step 4: Scan for MARS with SpyHunter Anti-Malware Tool

1. Click on the "Download" button to proceed to SpyHunter's download page.

Download

Malware Removal Tool

It is recommended to run a scan before purchasing the full version of the software to make sure that the current version of the malware can be detected by SpyHunter. Click on the corresponding links to check SpyHunter's EULA, Privacy Policy and Threat Assessment Criteria.

2. After you have installed SpyHunter, wait for it to update automatically.

3. After the update process has finished, click on the 'Malware/PC Scan' tab. A new window will appear. Click on 'Start Scan'.

4. After SpyHunter has finished scanning your PC for any files of the associated threat and found them, you can try to get them removed automatically and permanently by clicking on the 'Next' button.

If any threats have been removed, it is highly recommended to restart your PC.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Get rid of MARS from Mac OS X.

Step 1: Uninstall MARS and remove related files and objects

OFFER

Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!

We Recommend To Scan Your Mac with SpyHunter for Mac

Keep in mind, that SpyHunter for Mac needs to purchased to remove the malware threats. Click on the corresponding links to check SpyHunter’s EULA and Privacy Policy

1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:

2. Find Activity Monitor and double-click it:

3. In the Activity Monitor look for any suspicious processes, belonging or related to MARS:

Tip: To quit a process completely, choose the “Force Quit” option.

4. Click on the "Go" button again, but this time select Applications. Another way is with the ⇧+⌘+A buttons.

5. In the Applications menu, look for any suspicious app or an app with a name, similar or identical to MARS. If you find it, right-click on the app and select “Move to Trash”.

6: Select Accounts, after which click on the Login Items preference. Your Mac will then show you a list of items that start automatically when you log in. Look for any suspicious apps identical or similar to MARS. Check the app you want to stop from running automatically and then select on the Minus (“-“) icon to hide it.

7: Remove any left-over files that might be related to this threat manually by following the sub-steps below:

Go to Finder.
In the search bar type the name of the app that you want to remove.
Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.

In case you cannot remove MARS via Step 1 above:

In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:

Disclaimer! If you are about to tamper with Library files on Mac, be sure to know the name of the virus file, because if you delete the wrong file, it may cause irreversible damage to your MacOS. Continue on your own responsibility!

1: Click on "Go" and Then "Go to Folder" as shown underneath:

2: Type in "/Library/LauchAgents/" and click Ok:

3: Delete all of the virus files that have similar or the same name as MARS. If you believe there is no such file, do not delete anything.

You can repeat the same procedure with the following other Library directories:

→ ~/Library/LaunchAgents
/Library/LaunchDaemons

Tip: ~ is there on purpose, because it leads to more LaunchAgents.

Step 2: Scan for and remove MARS files from your Mac

When you are facing problems on your Mac as a result of unwanted scripts and programs such as MARS, the recommended way of eliminating the threat is by using an anti-malware program. SpyHunter for Mac offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.

Click the button below below to download SpyHunter for Mac and scan for MARS:

Download

SpyHunter for Mac

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Remove MARS from Google Chrome.

Step 1: Start Google Chrome and open the drop menu

Step 2: Move the cursor over "Tools" and then from the extended menu choose "Extensions"

Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.

Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Erase MARS from Mozilla Firefox.

Step 1: Start Mozilla Firefox. Open the menu window

Step 2: Select the "Add-ons" icon from the menu.

Step 3: Select the unwanted extension and click "Remove"

Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Uninstall MARS from Microsoft Edge.

Step 1: Start Edge browser.

Step 2: Open the drop menu by clicking on the icon at the top right corner.

Step 3: From the drop menu select "Extensions".

Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.

Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Remove MARS from Safari.

Step 1: Start the Safari app.

Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.

Step 3: From the menu, click on "Preferences".

Step 4: After that, select the 'Extensions' Tab.

Step 5: Click once on the extension you want to remove.

Step 6: Click 'Uninstall'.

A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the MARS will be removed.

How to Reset Safari
IMPORTANT: Before resetting Safari make sure you back up all your saved passwords within the browser in case you forget them.

Start Safari and then click on the gear leaver icon.

Click the Reset Safari button and you will reset the browser.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Eliminate MARS from Internet Explorer.

Step 1: Start Internet Explorer.

Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'

Step 3: In the 'Manage Add-ons' window.

Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.

Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.