Vurten Virus – Remove and Restore .improved Files

Vurten Virus – Remove and Restore .improved Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

Vurten virus is a new ransomware that has recently been discovered by virus researchers, it encrypts target data with the .improved extension. At the moment the collected so far samples seem to be test versions of the malware. Further updates to the Vurten virus can include additional components.

Threat Summary

Short DescriptionThe Vurten virus is a newly discovered malware that encrypts the target data with .improved extension.
SymptomsThe victims will find that their files are encrypted with the .improved extension.
Distribution MethodSpam Emails, File Sharing Networks, Exploit Kits
Detection Tool See If Your System Has Been Affected by Vurten


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Vurten.

Vurten Virus – Infection Spread

The Vurten virus can be distributed using various methods depending on the end targets. The hackers can optimize the malware delivery by using the most appropriate strategy for the desired scale of attacks.

A common way is to create spam messages that utilize various social engineering techniques in order to blackmail targets. The criminals can opt to use malware hyperlinks that link to the Vurten virus files hosted on hacker sites. Usually the criminals take text and graphics from well-known Internet services and sites. The messages are customized in order to appear as being sent by the companies rather than computer criminals. Another strategy would be to directly attach files to them.

The Vurten virus can be embedded in various payloads that are widely available through various sources. Usually the two most common ways are the following:

  • Infected Installers — The Vurten virus can be inserted into software installers that have been taken from their official vendor sites. Usually the criminals target popular instances such as creativity apps, system utilities and games.
  • Malware Documents — The hackers behind the Vurtue virus can embed the malware code into files of different types: presentations, spreadsheets and rich text documents. Once the recipients open the associated files they will be greeted by a notification prompt which asks them to enable the built-in scripts. If this is done then the virus will be downloaded from a remote location and executed on the compromised machine.

The criminals can make use of another method that has become popular in the last few years — browser hijackers. They represent malware browser plugins that are usually distributed on the plugin repositories operated by the major browsers. The instances are listed using elaborate descriptions and counterfeit developer credentials and user reviews. They are usually made compatible with the most popular web browsers: Mozilla Firefox, Google Chrome, Microsoft Edge, Opera, Safari and Internet Explorer.

Vurten Virus – Technical Data

The security analysis of the Vurten virus does not reveal a correlation with any of the known malware families. At the moment the full analysis is not yet complete and the captured samples contain only basic functionality. It is possible that the threat is still in development or preliminary testing before being released once again.

Future versions of it can include various additional components. An example is an information gathering which can be started once the malware has infiltrated the systems. It is programmed to extract data of different kinds from computers. It is usually classified into these two groups:

  • Personal Data — It is composed of information that can directly expose the victims identity. Their name, address, interests, location, account credentials and passwords.
  • System Data — This type of data usually consists of information related to the installed hardware components and certain operating system and software configuration files.

The gathered information can then be used for analysis and stealth protection. By analyzing the harvested data the Vurten virus can counter applications that can interfere with its execution. Examples include anti-virus software, virtual machine hosts and sandbox environments. If any of them are found their engines can be stopped or the application may altogether be removed. In advanced cases the malware strains can be programmed into deleting themselves to avoid detection.

Further updates to the base version of Vurten virus may include a variety of different system modifications. An example one is the removal of the recovery menu. This is the result of boot menu options manipulation which prohibits the users from using this manual recovery method. Another issue is the modification of the Windows Registry which can result in application failure and overall system stability issues. If the virus impacts any system services, they might be rendered partially non-working or even disabled.

Some malware also have the ability to institute a permanent network connection to a hacker-controlled server. It can be used to gather the harvested data and send arbitrary commands to the infected hosts. An interesting proposition is the remote control capabilities that are very similar to standalone Trojans.

Vurten Virus — Encryption Process

Once all malware components of the Vurten virus have executed correctly the ransomware module is launched. Like other similar threats it uses a built-in list of target file type extensions. Typically it seeks to target the following data:

  • Backups
  • Music
  • Videos
  • Images
  • Documents
  • Databases

The following extensions are being targeted (taken from a recent malware sample):

.$db, .001, .002, .003, .08, .09, .10, .11, .7z, .ab, .abk, .accdb, .accde, .accdr, .accdt, .accdw, .accft, .ade, .adi,
.adl, .adn, .arc, .arm, .arz, .asd, .ate, .ati, .bac, .bak, .bak2, .big, .bkp, .bkup, .bup, .c, .cal, .cat, .cbs, .cbu, .cc,
.cls, .cmf, .cnf, .conf, .cpp, .crypt12, .crypt5, .crypt6, .crypt7, .crypt8, .crypt9, .cs, .csv, .cxx, .dat, .db, .db3, .dbf,
.dbs, .dbt, .dbv, .ddl, .def, .dex, .doc, .docm, .docm, .docx, .docx, .docxml, .dot, .dot, .dov, .dqy, .dropbox, .dsc, .dsk,
.dsn, .eml, .emlx, .fdb, .fpt, .frm, .frt, .gho, .ghs, .grv, .gz, .gzip, .h, .hc, .hdi, .hds, .hfs, .hfv, .hlog, .htm, .html,
.ib, .ibc, .ibd, .ibz, .imm, .ism, .jpg, .kdb, .kdbx, .latex, .ldf, .ltr, .maf, .map, .maq, .mar, .maw, .mbf, .mcd, .mdb, .mdbhtml,
.mdbx, .mdf, .mdf, .mdn, .mig, .mpp, .mrg, .msg, .mwb, .myd, .myi, .mysql, .nbf, .ndf, .nvram, .obk, .odif, .odm, .odp, .ods, .odt,
.one, .opt, .ori, .orig, .ort, .pages, .pdf, .pdf, .phl, .pla, .pln, .ppt, .pptx, .pst, .pub, .pvm, .qbquery, .rar, .rtf, .rul, .sal,
.scn, .sco, .sdf, .sln, .sqb, .sql, .sqlite, .sqlitedb, .sqr, .tar, .tc, .tc, .tib, .tmd, .tmd, .trc, .txt, .txt, .vbk, .vbm, .vbox-prev,
.vdi, .vhd, .vhdx, .vmcx, .vmdk, .vmem, .vmsd, .vmsn, .vmss, .vmtm, .vmwarevm, .vmx, .vmxf, .volarchive, .vpcbackup, .vrb, .walletx, .wbb,
.wdb, .wim, .win, .wks, .wrk, .xld, .xlk, .xls, .xlsm, .xlsx, .xml, .xps, .zip

All target data is renamed with the .improved extension. The malware engine uses a strong cipher that encrypts the user files. It can only be recovered by first removing the virus.

A ransomware note is created in a file called UNCRYPT.README.txt which contains the following message:

Your entire network sensetive data was encrypted with our strong algorithm.
To recover your data send $10000 to the bitcoin address: 1Ln9RxSRuDqqFhCTuqBPBKRMeyhVhRaUG4
If you do not send money within 7 days, payment will be increased double.
After payment you will receive decryption software.
Contact email:

Remove Vurten Virus and Restore Your Files

If your computer got compromised and is infected with the Vurten ransomware virus, you should have some experience with removing viruses before tampering with it. You should get rid of the ransomware fast before it can spread further on the network and encrypt more files. The recommended action for you is to remove the ransomware completely by following the step-by-step instructions written below.


Martin Beltov

Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.

More Posts - Website

Follow Me:
TwitterGoogle Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share