The .RIDIK files virus is a ransomware from the Crysis/Dharma family. It is extremely dangerous ransomware due to the fact that it encrypts personal files located on the local drives as well as shared network directories. The primary goal of Dharma .RIDIK ransomware is to extort a hefty ransom fee from infected users. The extortion happens via a ransom note file named FILES ENCRYPTED.txt
Security experts strongly advise all victims against paying the demanded ransom to hackers. Otherwise, cyber criminals will be encouraged to continue developing vicious ransomware infections like .RIDIK files virus and harassing online users. Keep up with this ransomware removal guide and find out how to clean malicious files from infected PC as well as how to potentially recover .RIDIK files.
|Short Description||A ransomware dsigned to corrupt valuable files and extort a ransom free for their decryption.|
|Symptoms||Important files cannot be opened due to changes of their code. They are all renamed with .RIDIK extension.|
|Distribution Method||Spam Emails, Email Attachments|
|Detection Tool|| See If Your System Has Been Affected by .ROGER Virus |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss .ROGER Virus.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
A new release of the Dharma ransomware family has been uncovered, this time being known as the .RIDIK virus. It is named after the extension it places on the victim data. The initial report which we received about it shows that only a sample of viruses are released in the wild. This could indicate that a beginner hacking group may be behind the attacks. The Dharma ransomware code is easily obtainable on the underground markets which makes the creation of custom variants very easy.
Such releases are usually delivered to the target users via phishing campaigns that rely on both email messages and websites that are created with the intention of spreading the virus.
The virus samples will be attached or linked in the email messages — they themselves will often imitate the notifications and frequent messages that are sent in by well-known companies or web services. On the other hand the hacker-operated websites that spread the virus are often disguised to appear as safe download portals or product landing pages. The dangers associated with visiting these sites is that they can insert virus infection content in different sections — pop-ups, banners, the main content, in links, redirects, scripts and etc. The .RIDIK virus code can easily be made part of different types of infected payload carriers. They can be anything from macro-infected documents down to app installers of popular software. They are very suitable for such ransomware infections as they can be easily made to look like a safe file. In addition they can be uploaded to various file-sharing networks like BitTorrent where both pirate and legitimate data can be shared.
Whatever the case the .RIDIK virus will probably exhibit typical Dharma ransomware behavior. Based on previous releases and their attacks we suspect that the most popular modules will be launched. The list of the most popular malicious actions which can be run is the following:
- Data Retrieval — Many of the Dharma ransomware samples have the ability to hijack sensitive information from the victim hosts. This includes any data that can reveal the identity of the users or a detailed profile of their machine’s hardware. This can be used to generate an unique identifier for each individual machine.
- Persistent Infection — This particular ransomware can be installed in a way which will automatically start it once the computer is powered on. It can also disable access to the recovery boot options.
- Data Removal — The main virus engine can identify important user files and delete them. This can also affect system data like the Shadow Volume Copies and backups.
- Other Malware Installation — Ransomware infections of this family are commonly used to infect the machines with other threats such as Trojans, cryptocurrency miners and etc.
- Windows Registry Changes — The main engine can be used to create new entries to the Windows Registry or change existing ones with the intention of causing system-wide issues. They can range from performance issues, unexpected errors and data loss to the inability to access certain features of applications and/or the operating system.
The initial sample analysis shows that once everything has completed running the ransomware engine will be run. Based on a built-in strong algorithm the virus engine will process target user data and make it inaccessible and locked. Commonly the most frequently accessed files will be affected: backups, archives, documents, multimedia files and etc. The affected data will be renamed with the .RIDIK virus. To extort the victims for a decryption fee payment an associated ransom note will be presented to them.
Remove .RIDIK Virus Files and Restore Data
The ransomware associated with .RIDIK extension is a threat with highly complex code that plagues not only your files but your whole system. So you should clean and secure your infected system before you could use it regularly again. Below you could find a step-by-step removal guide that may be helpful in attempting to remove this ransomware.
Choose the manual removal approach if you have previous experience with malware files. If you don’t feel comfortable with the manual steps select the automatic section from the guide. Steps there enable you to check the infected system for ransomware files and remove them with a few mouse clicks.
In order to keep your system safe from ransomware and other types of malware in future, you should consider the installation of a reliable anti-malware program.