Smrss32 Ransomware

Posted by Max Lehmann on August 19, 2016

What is Smrss32 Ransomware?

Smrss32 Ransomware is a dangerous ransomware infection that seems to be all over the place. It encrypts a whooping 6,674 file types, so one would think that with this infection on-board, the affected computer could be rendered inoperable. However, the program still leaves the basic system files because it still needs to extort your money out of you, right? Before that happens, you have to close all the notifications delivered by this infection, and then look for other potential intruders. Malicious programs seldom travel on their own, so you have to do everything in your power to protect your system from a severe infection that never ends.

Where does Smrss32 Ransomware come from?

Computer security specialists suggest that this program could be associated with Troldesh, Apocalypse, and Bucbi ransomware applications. Thus, the distribution method applied by Smrss32 Ransomware should be similar to that used by the previously released infections.

Usually, ransomware programs spread through spam emails and website exploit kits. However, this new infection here is of a different kind. It makes use of the Remote Desktop Protocol (RDP) to enter target computers. In other words, if you have a remote desktop client on your PC, there is already a risk that you could get infected with this particularly dangerous program.

Also, as this ransomware spreads via RDP, the hackers behind this infection can access your computer themselves and drop the installer file on your system. This is not an automated process, everything happens manually. Thus, we believe that it might be one of the reasons this program is not too widespread yet, but it does not mean that you should ignore it. Smrss32 Ransomware is just as dangerous as all the other ransomware applications out there.

What does Smrss32 Ransomware do?

To encrypt your files, the program uses the AES symmetric encryption. Technically, this encryption method is not as complicated as the RSA encryption algorithm, but it still does not mean it is easy to guess the decryption key on your own. In fact, given all the potential variables, it is plain impossible.

As mentioned, Smrss32 Ransomware affects more than 6000 file types, but it leaves the .bmp files alone. That is mostly because the decryption instructions file it drops has that file extension. Also, it skips files in most of the program files and system files directories. Again, if the program was to encrypt all those files, it would not be possible to access the Internet and transfer the payment.

Smrss32 Ransomware expects you to pay 1 bitcoin for the decryption key. One bitcoin is more than $500USD, so this infection does not come cheap. However, even if you were to pay, no one can guarantee that the criminals behind this program would actually issue the decryption key. After all, their main objective is to get the money, and once they do it, why should they bother what happens to your files?

How do I remove Smrss32 Ransomware?

Here comes the tricky part. You do not have to remove Smrss32 Ransomware because the malicious program deletes itself from your system the moment it drops its payload. You just need to delete a few files left behind, but other than that, there are not program leftovers to take care of.

Thus, your main concern is restoring your files. Unfortunately, at the moment, there is no free decryption tool available, but it should still be possible to restore your files from a backup. A backup can be a cloud storage drive or an external hard drive where you keep additional copies of your files. Also, there might be copies of important documents in your inbox, on your mobile device or on some flash drive. Think of all the places where you could have stored your files, there is always hope!

As far as your computer’s security is concerned, it should be obvious that you have to invest in a licensed antispyware tool that would protect your PC from various infections in the future. Of course, it is also important to steer clear from unfamiliar that could be part malware distribution networks. Do yourself a favor and take the matter of your computer’s security seriously.