The beginning of September 2017 has brought multiple new ransomware viruses on the block. One such virus is Pendor ransomware. It’s end goal is to encrypt the files on your computer after it has infected it and then demand from you to pay a hefty ransom fee in order to access them again. The virus uses the AES encryption for the files which makes them no longer able to be opened and after encryption, adds the .pnr file extension. If you have been infected by Pendor ransomware, we advise you to read this article thoroughly.
|Short Description||Aims to encrypt the files on your computer and then demand a hefty ransom “fee” to decrypt them and make them work again.|
|Symptoms||Attacks the most often used files, they become no longer openable and appends the .pnr file extension.|
|Distribution Method||Spam Emails, Email Attachments, Executable files|
|Detection Tool|| See If Your System Has Been Affected by Pendor |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Pendor.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Pendor Ransomware – Distribution Methods
In order for this ransomware virus to be spread, the creators of it have used the same strategy as with most ransomware infections out there – malicious e-mail spam. Such spam messages are often sent to unsuspecting victims and their primary purpose is to trick them to open the objects attached to the e-mails. These are usually:
- Archives (.zip, .rar) that contain malicious files used for the infection.
- Malicious documents that are used to infect a user PC via macros.
- Malicious web links which cause drive-by downloads and hence infect.
The infection objects that spread Pendor ransomware are usually accompanied by convincing statement that the attachments or web links are important invoices, bank statements or other such documents.
Pendor Ransomware – More Information
As soon as one becomes infected by this virus, it immediately runs malicious processes in a hidden manner. This results in the virus extracting or downloading it’s files on your computer. They are generally located in the following Windows folders:
After the Pendor ransomware drops it’s malicious files, it may also modify the Windows registry editor of the infected computer system. It may use it to modify different actions that the computer performs automatically, like change the wallpaper, force restart the computer and primarily to make it so that it runs automatically on system start. To do this, Pendor ransomware may modify the Run and RunOnce registry sub-keys, adding value strings with data in them that point to the actual location of the file-encryption file on the infected PC. The malicious entries are located in the following sub-keys:
In addition to this activity, the Pendor virus may also delete the backups on your computer by using the vssadmin and bcedit commands in Windows Command Prompt without you noticing it:
After the virus has done this, it may also drop it’s distinctive ransom note which looks like the following:
The ransom note leads the user to a TOR-based web page which is anonymous and the victim can pay the ransom there in BitCoin. This is an untraceable method often used by cyber-criminals.
Pendor Virus – Encryption Process
For this virus to succeed in encrypting the files and make it very difficult to decrypt them directly, it uses the AES encryption algorithm which translates to Advanced Encryption Standard. This cipher aims to generate a unique decryption key which is asymmetric. This key is known to the cyber-criminals only, making them the sole possessors of your files. They demand $50 in BTC (BitCoin) to be paid to them to give you a crafted decryption software.
The files which are attacked by the Pendor ransomware infection are multiple. The malware primarily targets often used types of files, such as:
- Audio files.
- Often used file types (.pdf, .vmd, etc.).
Once it has already encrypted the files, Pendor ransomware adds it’s unique file extension to them, making them look like the following:
Pendor Virus – How to Remove and Decrypt Files
The first thing you should do after experiencing an infection by this ransomware virus is to backup all the .pnr encrypted files on a flash drive or somewhere else and create copies of them. After doing so, you can proceed with the removal of this virus. To remove Pendor, you can go ahead and follow the removal instructions down below. They are crafted so that you have the options to remove the virus files and objects manually or automatically. Malware researchers often suggest to use a ransomware-specific removal tool In order to automatically remove all the objects created by Pendor on your computer and secure it against future threats as well.
In order to reverse as much of the damage done by Pendor ransomware as possible, you should try the alternative methods for file recovery below, located in step “2. Restore files encrypted by Pendor”. They are not 100% guarantee you will be able to recover all your data, but aim to help you restore as many files as possible without having to pay the ransom to the cyber-criminals.