Ordinal Ransomware

What is Ordinal Ransomware?

Ordinal Ransomware might still not be able to do everything its developers intend it to do. Judging from what we know, this program is still being developed. So if you got infected with this ransomware, it means that you are a test subject for its creators. The bad news though is that the program can still encrypt most of your personal files, even though it is not fully developed. Hence, you need to scramble to remove Ordinal Ransomware from your system, and then look for ways to restore your files or make sure this does not happen again.

Where does Ordinal Ransomware come from?

As it happens often with ransomware, it is hard to say how exactly they enter target systems. Unless we are dealing with some world-wide infection, random in-development applications often go unnoticed, and security researchers do not pay much attention to them. So we can only offer you the details we have uncovered during our research.

The most common ransomware distribution method is spam email attachments. However, work-in-progress programs are more often distributed directly, by infecting target systems individually. For that, cyber criminals tend to exploit unsafe remote desktop protocol connections. Thus, systems that often employ such connection tools are more vulnerable to ransomware infections.

What does Ordinal Ransomware do?

Albeit the program has not been fully developed, it functions as a proper ransomware infection. Therefore, if you know what happens when a computer gets infected with such a type of program, you will recognize the same infection patterns with Ordinal Ransomware, too.

The program that is coded in the .NET coding language comes forth and encrypts targeted files using the AES-256 encryption algorithm. Like most of the ransomware programs, Ordinal Ransomware also appends a new extension to the affected files. For example, if you had a file flower.jpg, then after the encryption, your filename will look like “flower.jpg.Ordinal.” It goes without saying that after the encryption, the system will no longer be able to read the affected files, and it is not just because of the appended extension.

Aside from encrypting your files, Ordinal Ransomware is also very persistent in displaying the ransom note that is supposed to push you into paying the ransom. Most of the ransomware programs either change the desktop background into their ransom note or display the notification in a pop-up. This program also displays the note in a pop-up that takes up your entire screen, and there is no way to close it unless you do it via Task Manager. The message displayed by this infection says the following:

ORDINAL RANSOMWARE
Follow the instructions to unlock your data

YOUR FILES AR ENCRYPTED
All your files have been encrypted with AES-256 Military Grade Encryption

INSTRUCTIONS
Your files have been encrypted, the only way to recover your files is to pay the fee. Once you have paid the feel all your files will be decrypted and return to normal.

The ransom fee is quite ridiculous because Ordinal Ransomware expects you to pay 1 Bitcoin for your files. Based on the conversation rate at the time of writing, 1 BTC approximately equals 7000 USD, so it is clear that no regular individual user would be able to pay that much at short notice. With this, we can also assume that perhaps the main target of these criminals are not individual computer users, but corporations that store a lot of important data, and who would be more willingly pay for the decryption.

Needless to say, paying the ransom does not guarantee that the encrypted files will be decrypted. Not to mention that the email address given in the ransom note might not even work. So what one should do?

How do I remove Ordinal Ransomware?

It is clear that you need to remove Ordinal Ransomware from your computer, and we will give you the manual removal instructions for that. However, when it comes to your files, the best way to get them back is to rely on an external file backup (if you have one). Also, quite a few of your files should be saved on your mobile device or perhaps on a cloud drive. Whichever it might be, you have to delete the infected files first before transferring the healthy copies back into your system.

Manual Ordinal Ransomware Removal

1. Press Ctrl+Shift+Esc to open Task Manager.
2. Click the Processes tab and highlight the malware process.
3. Press the End Process button and exit Task Manager.
4. Open your Downloads folder and remove the most recent files.
5. Press Win+R and enter regedit. Press OK.
6. Open HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
7. Right-click the Main value on the right and delete it.
8. Run a full system scan with a security tool of your choice. Download Removal Tool100% FREE spyware scan and
   tested removal of Ordinal Ransomware*

Stop these Ordinal Ransomware Processes: