Do you know what Divine Ransomware is?
What happens when Divine Ransomware invades your operating system? The infection encrypts files, delivers a ransom message, and then deletes itself. The attack is quick and aggressive, and you are unlikely to stop it in time. You might be able to eliminate this threat only if you notice it right after its execution, and since it is silent, you are unlikely to notice it. Once the attack is complete, the infection reveals itself because it was created to collect money. The attackers behind the infection expect victims to pay for a “decryptor,” whose existence cannot even be confirmed. Needless to say, we do not advise paying the ransom or paying attention to the information introduced to you via the ransom note at all. What we recommend focusing on is the removal of Divine Ransomware.
According to our malware experts, Divine Ransomware is a new variant of the Everbe 2.0 Ransomware, a malicious threat that was first discovered almost a year ago now. Just like the new variant, this infection encrypted files and demanded money to be paid in return for a decryptor. This malware could be distributed in various ways, but it is most likely to enter unguarded Windows operating systems with the help of spam emails or using RDP backdoors. Once in, Divine Ransomware starts encrypting files almost immediately, and it is likely to encrypt photos, archives, documents, videos, and other kinds of files that we would consider to be “personal.” These are the kinds of files that cannot be replaced like, for example, system files, and that can be saved only if backup copies exist. If you do have backups stored outside the infected computer, you should not postpone the removal of the threat for much longer.
Divine Ransomware screenshot
Scroll down for full removal instructions
Once files are encrypted, and the “.[divine@cock.lu].divine” extension is attached to their names, Divine Ransomware creates a file named “!=How_to_decrypt_files=!.txt” before deleting itself. The message inside the file states that personal files were encrypted and reassures that they can be restored using a special decryptor. To obtain it, the victim must email divine@cock.lu, and the subject line of the message must include the ID code included in the message. According to the message, the price for the decryptor increases every 7 days, and victims can use a backup email (divinebackup@tuta.io) if they do not get the response from the first one. Even emailing cyber criminals could be dangerous because you do not know what kind of malware they could send your way. If you end up contacting the attackers, and they ask you to pay a ransom, make sure you think carefully if you really want to take the risk. We do not recommend it.
Since the launcher of Divine Ransomware deletes itself, it appears that the only thing you need to do to get rid of the infection completely is to eliminate every copy of the !=How_to_decrypt_files=!.txt file. Of course, there is a possibility that other threats exist, and we cannot guarantee that the launcher of the ransomware will delete itself automatically every single time. Then there’s the issue of Windows security. Basically, there are plenty of reasons to install trusted anti-malware software. If you do not install it now, keep it in the back of your head, and install it as soon as you get the chance because only protected systems can stand a chance at fending off malware. Also, do not forget to backup files to keep them safe.
Remove Divine Ransomware
- Delete recently downloaded suspicious files.
- Delete every copy of the file named !=How_to_decrypt_files=!.txt.
- Empty Recycle Bin and then perform a full system scan using a legitimate malware scanner.
In non-techie terms:
Divine Ransomware is a silent, clandestine, and aggressive infection that can encrypt files without alarming the victim. Once files are encrypted, it creates a file to make demands for a ransom payment in return for an alleged decryptor. We do not recommend emailing the attackers to get more information or paying the ransom because that could get you into more trouble. Also, the attackers are unlikely to keep their promises to decrypt files. All in all, it is most important that you handle the removal of Divine Ransomware and secure your operating system, which anti-malware software can do the best. Even if you decide not to invest in reliable security software – which you might do, considering that the ransomware should delete itself – do not forget to install this software as soon as possible to ensure full-time protection for your Windows operating system.