Remove WORM Ransomware

The WORM Ransomware is a variant of the Dharma Ransomware family of file-encryption Trojans. Unfortunately, it uses a flawless file-locking mechanism. This means that it is impossible to reverse the damage it causes to files unless you own the decryption key that the WORM Ransomware generates for each of its victims. This piece of information is transferred to the servers of the attackers as soon as the file-encryption task is accomplished – recovering it from there is impossible without asking the criminals for assistance.

Of course, the creators of the WORM Ransomware offer to sell the decryption key that victims need – as long as they agree to pay a Bitcoin ransom fee. The exact amount of Bitcoin that the criminals demand is not listed anywhere, but you can rest assured that they will not settle for anything less than a few hundred dollars. In many case, the ransom fees that attackers ask for may reach thousands of dollars.

Dealing with the WORM Ransomware Attack

Recognizing the WORM Ransomware attack is easy, because of the unique suffix that this locker adds to files – '.id-<VICTIM ID>.[psworm@keemail.me].WORM.' Another notable change related to this ransomware attack is the creation of the ransom note 'WORM_MANUAL.txt.'

The document contains a short message from the criminals but, unfortunately, it does not reveal much to victims. It simply advises them to send an email to psworm@keemail.me and psworm@onionmail.org to get more information about how they should proceed. We suggest not getting in touch with the cybercriminals behind the WORM Ransomware attack, because they will never agree to assist you without monetary compensation. Paying a ransom fee to crooks is never a good idea – it will sponsor their future projects, and there is a high chance that you will be left empty-handed. Instead, use an antivirus scanner to make sure that WORM Ransomware is gone for good. Once the threat is eliminated, explore popular data recovery options.