Malicious encryption software called GlobeImposter has been around long since. Here comes its edition named after the extension it adds, the .725 GlobeImposter. The ransomware adds .725 at the end of the names of the files it has scrambled.
Ransomware distributors are not limited in the schemes to propagate their infection. However, they tend to stick to rather few patterns. In the case of .725 GlobeImposter, there is one that clearly dominates. It features a spam campaign that circulates a message of empty subject and body, hence the name: Blank State Spam.
The spam letter infecting component is its attachment. This has typically a zip extension and starts with the following string: EMAIL. The recipients are likely to suppose the message has been zipped and attached instead of being available immediately in the subject line and the message body. The infecting file, instead of the alleged message, contains a malicious JavaScript. Unzipping the malicious attachment downloads and executes a file with .js extension.
The JS file aims at downloading the ransomware from the remote server. It contacts one of the two websites according to its internal algorithm. The other attempt only occurs if the initial attempt fails to complete the download.
The download drops a 1.dat, which is an executable that installs the .725 file virus. The encryption targets most of the file extensions that you would use. It omits several essential extensions only so that the system could survive. The measure ensures the victims read the ransom note as it is dropped immediately onto computer system affected.
The ransom note indicates the email the victims are supposed to contact. It also says the user may perform a test decryption for one of the files affected. Instructions on how to buy bitcoins are available.
There is no ultimate solution against .725 GlobeImposter ransomware. Meanwhile, there are some smart workarounds below that hopefully recover the damages caused by the invader.
Automatic removal of .725 File Virus
The benefits of using the automatic security suite to get rid of this infection are obvious: it scans the entire system and detects all potential fragments of the virus, so you are a few mouse clicks away from a complete fix.
- Download and install recommended malware security suite
- Select Start Computer Scan feature and wait until the utility comes up with the scan report. Proceed by clicking on the Fix Threats button, which will trigger a thorough removal process to address all the malware issues compromising your computer and your privacy.
Restore files locked by .725 File Virus
new Locky variant aka .725 File Virus represents a unique category of malicious software whose attack surface reaches beyond the operating system and its components, which is why removing the virus itself is a part of the fix only. As it has been mentioned, it encrypts one’s personal information, so the next phase of the overall remediation presupposes reinstating the files that will otherwise remain inaccessible.
-
Launch data recovery software
Similarly to the rest of its fellow-infections, .725 File Virus most likely follows an operational algorithm where it erases the original versions of the victim’s files and actually encrypts their copies. This peculiarity might make your day, because forensics-focused applications like Data Recovery Pro are capable of restoring the information that has been removed. As the virus further evolves, its modus operandi may be altered – in the meanwhile, go ahead and try this.
-
Take advantage of Volume Shadow Copy Service
This technique is based on using the native backup functionality that’s shipped with Windows operating system. Also referred to as Volume Snapshot Service (VSS), this feature makes regular backups of the user’s files and keeps their most recent versions as long as System Restore is on. 725 File Virus ransomware hasn’t been found to affect these copies therefore the restoration vector in question is strongly recommended. The two sub-sections below highlight the automatic and manual workflow.
- a) Use Shadow Explorer
Shadow Explorer is an applet that provides an easy way of retrieving previous versions of files and folders. Its pro’s include an intuitive interface where the computer’s entire file hierarchy is displayed within one window. Just pick the hard disk volume, select the object or directory to be restored, right-click on it and choose Export. Follow the app’s prompts to get the job done.
- b) Use file properties
Essentially, what the above-mentioned Shadow Explorer tool does is it automates the process that can otherwise be performed manually via the Properties dialog for individual files. This particular approach is more cumbrous but just as effective as its software-based counterpart, so you can proceed by right-clicking on a specific file, which has been encrypted by .725 File Virus, and selecting Properties in the context menu. The tab named Previous Versions is the next thing to click – it displays available versions of the file by date of the snapshot creation. Pick the latest copy and complete the retrieval by following the prompts.
-
Data backups work wonders
Ransomware like .725 File Virus isn’t nearly as almighty and destructive in case you run regular file backups to the cloud or external data media. The virus itself can be completely removed in a matter of minutes, and the distorted information can then be just as easily recovered from the backup. Luckily, this is a growing trend, so ransom Trojans are hopefully going to become less subversive in the near future.
Verify thoroughness of the removal
Having carried out the instructions above, add a finishing touch to the security procedure by running an additional computer scan to check for residual malware activity
